5 ms·

I'd avoid taking that route because that would move the Overton window [0] on the issue to Google's side. The premise is unacceptable and discussion on the tec

I'd avoid taking that route because that would move the Overton window [0] on the issue to Google's side. The premise is unacceptable and discussion on the technical merits will only give it the fuel to make it more material. [0] - https://en.wikipedia.org/wiki/Overton_window https://en.wikipedia.org/wiki/Overton_window

haswell 3y ago
If the window even applies here, it expanded the moment Google initiated all of this publicly. We're in it now, and fully understanding the issue and the problems it purports to solve is incredibly important. Dialogue is all we have, and to even build a solid argument against WEI, understanding the details matters.
- JoshTriplett 3y ago
  It's worth understanding the problem it purports to solve in order to properly dismiss it. WEI positions itself in a way that sounds ambiguously like it might ever serve the user's purposes, and a clear framing of the problem statement would make it more obvious that it does not serve the user at all. For instance, one of the framings of WEI is that it gives advertisers a way to verify the client so they don't "have" to do fingerprinting. Except WEI does nothing to take away fingerprinting, so advertisers will then have fingerprinting and WEI. (Even if it did simultaneously take away fingerprinting it would still not be OK, but the current framing is not even offering the user benefit it claims to offer.)
  - charcircuit 3y ago
    Before taking away fingerprinting there would need to be a sunset period to have everyone migrate over to the new API. Ripping it out before new APIs are available or doing it at the same time is irresponsible.
    - ImPostingOnHN 3y ago
      I'm not sure how that addresses the point you're responding to: regardless of the excuse, WEI with fingerprinting is bad, and WEI without fingerprinting is also bad, and fingerprinting without WEI is also bad doing bad things (for example, any of the 3 above options) is more irresponsible than implementing bad things poorly
      - flangola7 3y ago
        So how do you intend to prevent fraud and abuse? You need signals of some kind to know whether a visitor is likely to be malicious or not.
        wmf 3y ago
        You don't have to worry about ad fraud if advertising goes away.
        daurentius523 3y ago
        Let me ask you instead: "how you intend to prevent matrimonial fraud?" … You can not. Because that is not how world works - crime did happen, happens, and will happen. You can stop attempts or fight it by education or by arresting criminals but never eliminate or prevent it. "You need signals of some kind to know whether a visitor is likely to be malicious or not." Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? You are being being wrong here - you don't have 'visitor' but 'client' and as far as I'm concerned you do not spy on every client to "know" if he "is likely to be malicious or not". You may be suspicious of client activities but that is what you can realistically do. Also define "fraud and abuse" because this can mean many things which may have many solutions.
        charcircuit 3y ago
        >Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? That innkeeper would have used the signal of how the visitor looks. If a visitor was being malicious and got kicked out, that person could not just come right back in as the inkeeper would be able to tell that he was the same person as before. Also your metaphor is not great because WEI can only happen after the first page load since it requires the site to use javascript to use the api.
- the_lego 3y ago
  But the details aren't the issue. It's the entire idea of remote attestation that is repulsive and user-hostile. Otherwise I agree that examining the details doesn't move the Overton window - the broad idea already did that.
  - therein 3y ago
    Details aren't the issue and that's exactly my point. There is no reason to discuss on average how many lightning rods we should place on each street and the necessary budget allocations and compromises that would need to be made and how this whole undertaking would be facilitated. We have been doing just fine without these lightning rods on every street proposal Google made. We knew we could have it, we don't have it because we don't want it.
- wudangmonk 3y ago
  The problems it aims to solve seems like an issue for google or those that care if their ad is viewed by a human or not. Can someone give a counter argument of how this might benefit the users themselves?. Chrome on android is completely unusable due to no adblocker, is this what WEI will do everywhere?
  - fruitreunion1 3y ago
    >Can someone give a counter argument of how this might benefit the users themselves? Remote attestation might reduce the amount of cheaters in games and fraud in banks if implemented properly. So, through potential indirect means. I don't think any of this is worth the loss of user freedom and functionality, though. So I will vehemently oppose WEI and similar to be used outside of internal facilities.
    - therein 3y ago
      Anti-cheats are already remote attestation in theory for online games and they are unable to protect the process perfectly. They are unable to detect alterations to the process memory and be correct in their attestation at all times. And cheating isn't a significant problem in in-browser games, it's not like anyone modified the browser source to create cheats for in-browser games. And for competitive online games, we have a great imperfect attempt at showing what remote attestation would look like. Anti cheat in games. We have AAA titles that work flawlessly under Proton but you can't play them on Linux because anti-cheat needs to do DKOM on your Windows kernel before it lets you play. I agree with the rest of your post though.
gochi 3y ago
I'm not trying to understand it's "technical merits" but what exactly it is. Even experts on The Registry are quoted saying it's "nebulous". So what exactly are we even talking about here? The idea of attestation or just this proposal or is it a Google thing? Does this compare to cloudflare private tokens or safetynet or are they completely different? If proposal goes through what does that functionally mean for browsers both ones based on chromium and ones not? I don't know why it's so difficult to find these details and I'm instead being told to just accept the idea that the premise is unacceptable.
- QuantumG 3y ago
  Wow, if an unbiased independent news source as credible as The Register is against it then maybe I should reevaluate!

haswell 3y ago

If the window even applies here, it expanded the moment Google initiated all of this publicly. We're in it now, and fully understanding the issue and the problems it purports to solve is incredibly important. Dialogue is all we have, and to even build a solid argument against WEI, understanding the details matters.

JoshTriplett 3y ago
It's worth understanding the problem it purports to solve in order to properly dismiss it. WEI positions itself in a way that sounds ambiguously like it might ever serve the user's purposes, and a clear framing of the problem statement would make it more obvious that it does not serve the user at all. For instance, one of the framings of WEI is that it gives advertisers a way to verify the client so they don't "have" to do fingerprinting. Except WEI does nothing to take away fingerprinting, so advertisers will then have fingerprinting and WEI. (Even if it did simultaneously take away fingerprinting it would still not be OK, but the current framing is not even offering the user benefit it claims to offer.)
- charcircuit 3y ago
  Before taking away fingerprinting there would need to be a sunset period to have everyone migrate over to the new API. Ripping it out before new APIs are available or doing it at the same time is irresponsible.
  - ImPostingOnHN 3y ago
    I'm not sure how that addresses the point you're responding to: regardless of the excuse, WEI with fingerprinting is bad, and WEI without fingerprinting is also bad, and fingerprinting without WEI is also bad doing bad things (for example, any of the 3 above options) is more irresponsible than implementing bad things poorly
    - flangola7 3y ago
      So how do you intend to prevent fraud and abuse? You need signals of some kind to know whether a visitor is likely to be malicious or not.
      - wmf 3y ago
        You don't have to worry about ad fraud if advertising goes away.
      - daurentius523 3y ago
        Let me ask you instead: "how you intend to prevent matrimonial fraud?" … You can not. Because that is not how world works - crime did happen, happens, and will happen. You can stop attempts or fight it by education or by arresting criminals but never eliminate or prevent it. "You need signals of some kind to know whether a visitor is likely to be malicious or not." Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? You are being being wrong here - you don't have 'visitor' but 'client' and as far as I'm concerned you do not spy on every client to "know" if he "is likely to be malicious or not". You may be suspicious of client activities but that is what you can realistically do. Also define "fraud and abuse" because this can mean many things which may have many solutions.
        charcircuit 3y ago
        >Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? That innkeeper would have used the signal of how the visitor looks. If a visitor was being malicious and got kicked out, that person could not just come right back in as the inkeeper would be able to tell that he was the same person as before. Also your metaphor is not great because WEI can only happen after the first page load since it requires the site to use javascript to use the api.
the_lego 3y ago
But the details aren't the issue. It's the entire idea of remote attestation that is repulsive and user-hostile. Otherwise I agree that examining the details doesn't move the Overton window - the broad idea already did that.
- therein 3y ago
  Details aren't the issue and that's exactly my point. There is no reason to discuss on average how many lightning rods we should place on each street and the necessary budget allocations and compromises that would need to be made and how this whole undertaking would be facilitated. We have been doing just fine without these lightning rods on every street proposal Google made. We knew we could have it, we don't have it because we don't want it.
wudangmonk 3y ago
The problems it aims to solve seems like an issue for google or those that care if their ad is viewed by a human or not. Can someone give a counter argument of how this might benefit the users themselves?. Chrome on android is completely unusable due to no adblocker, is this what WEI will do everywhere?
- fruitreunion1 3y ago
  >Can someone give a counter argument of how this might benefit the users themselves? Remote attestation might reduce the amount of cheaters in games and fraud in banks if implemented properly. So, through potential indirect means. I don't think any of this is worth the loss of user freedom and functionality, though. So I will vehemently oppose WEI and similar to be used outside of internal facilities.
  - therein 3y ago
    Anti-cheats are already remote attestation in theory for online games and they are unable to protect the process perfectly. They are unable to detect alterations to the process memory and be correct in their attestation at all times. And cheating isn't a significant problem in in-browser games, it's not like anyone modified the browser source to create cheats for in-browser games. And for competitive online games, we have a great imperfect attempt at showing what remote attestation would look like. Anti cheat in games. We have AAA titles that work flawlessly under Proton but you can't play them on Linux because anti-cheat needs to do DKOM on your Windows kernel before it lets you play. I agree with the rest of your post though.

gochi 3y ago

I'm not trying to understand it's "technical merits" but what exactly it is. Even experts on The Registry are quoted saying it's "nebulous". So what exactly are we even talking about here? The idea of attestation or just this proposal or is it a Google thing? Does this compare to cloudflare private tokens or safetynet or are they completely different? If proposal goes through what does that functionally mean for browsers both ones based on chromium and ones not? I don't know why it's so difficult to find these details and I'm instead being told to just accept the idea that the premise is unacceptable.

QuantumG 3y ago
Wow, if an unbiased independent news source as credible as The Register is against it then maybe I should reevaluate!