9 ms·

That also applies to Javascript, or being forced to use some form of an up-to-date browser. What is different with WEI? I didn't see many people debating the a

by judge2020 3y ago

That also applies to Javascript, or being forced to use some form of an up-to-date browser. What is different with WEI? I didn't see many people debating the actual text of the WEI explainer[0] on the HN posts about WEI, and that's probably because they were links to articles about WEI. The HN post for the explainer with the most upvotes only has 89[1], likely because most of HN treats the upvote as "I agree/like this" instead of "boost this topic for discussion". 0: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/... 1: https://news.ycombinator.com/item?id=36785516 https://news.ycombinator.com/item?id=36785516

rolph 3y ago
whenever something is devised [e.g.upvotes,javascript,thumbtacks] there are those who use it for the intended purpose, and those who find as many usefull purposes for it as possible.
userbinator 3y ago
WEI is cryptographic. All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. Governments are scared that people will use encryption against them. Now we should be scared that companies are using encryption against us. I'm not in favour of banning encryption either, but the situation is more subtle. Encryption is a weapon, and not surprisingly that's why it was classified as such and strongly controlled only a few decades ago, so I don't expect there to be an easy way to solve this ...just like the debate around 2nd Amendment.
- EMIRELADERO 3y ago
  There is a legislatively easy way to solve this. Make "people who have full control over all aspects of their devices" a protected class. Make it illegal to refuse service to those people. Getting there is a whole different level of difficult, of course.
- LexiMax 3y ago
  > All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. What's stopping other browsers from piggybacking off of Chrome's keys?
  - Gazoche 3y ago
    Hardware attestation chips like TPM. Which, coincidentally, Microsoft just made mandatory.
- mike_hearn 3y ago
  Pedantic point: textbook remote attestation doesn't use encryption, it uses digital signatures. Nothing is being hidden from anyone.
friendzis 3y ago
The explainer means jack shit. It is corporate marketing mumbling, intended for techy audiences. It does not matter what the explainer says. We know what this system CAN be used for and pinky promises by a monopoly entity not to use WEI for nefarious purposes are an indication that WEI will be used for nefarious purposes. Discussing the explainer can only lead to slippery slope examinations of how bad WEI actually is and how much integrity of WEI hangs on good will of Google. WEI is very bad, extremely bad when coupled with secureboot and similar hardware restrictions, Google has a solid track history to throw anyone and anything under the bus if it means profits. What reasonable discussion would you expect?

rolph 3y ago

whenever something is devised [e.g.upvotes,javascript,thumbtacks] there are those who use it for the intended purpose, and those who find as many usefull purposes for it as possible.

userbinator 3y ago

WEI is cryptographic. All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. Governments are scared that people will use encryption against them. Now we should be scared that companies are using encryption against us. I'm not in favour of banning encryption either, but the situation is more subtle. Encryption is a weapon, and not surprisingly that's why it was classified as such and strongly controlled only a few decades ago, so I don't expect there to be an easy way to solve this ...just like the debate around 2nd Amendment.

EMIRELADERO 3y ago
There is a legislatively easy way to solve this. Make "people who have full control over all aspects of their devices" a protected class. Make it illegal to refuse service to those people. Getting there is a whole different level of difficult, of course.
LexiMax 3y ago
> All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. What's stopping other browsers from piggybacking off of Chrome's keys?
- Gazoche 3y ago
  Hardware attestation chips like TPM. Which, coincidentally, Microsoft just made mandatory.
mike_hearn 3y ago
Pedantic point: textbook remote attestation doesn't use encryption, it uses digital signatures. Nothing is being hidden from anyone.

friendzis 3y ago

The explainer means jack shit. It is corporate marketing mumbling, intended for techy audiences. It does not matter what the explainer says. We know what this system CAN be used for and pinky promises by a monopoly entity not to use WEI for nefarious purposes are an indication that WEI will be used for nefarious purposes. Discussing the explainer can only lead to slippery slope examinations of how bad WEI actually is and how much integrity of WEI hangs on good will of Google. WEI is very bad, extremely bad when coupled with secureboot and similar hardware restrictions, Google has a solid track history to throw anyone and anything under the bus if it means profits. What reasonable discussion would you expect?