4 ms·

> it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them. On the contrary, my main issue is t

> it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them. On the contrary, my main issue is that they identify one of the primary issues and fail to address it. The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” Essentially this means an end to the open web: websites block you if you aren’t attested. If you want to browse from NewOS, tough cookies that’s not recognized by attesters This is addressed in the proposal in “Open Questions > How will we prevent this signal from being used to exclude vendors”. The only proposed solution is in section “Holdback”: “[…] we are evaluating whether attestation signals must sometimes be held back for a meaningful number of requests […] Such a holdback would encourage web developers to use signals for aggregate analysis and opportunistic reduction of friction, as opposed to a quasi-allowlist […]” This is a massive potential issue. The author acknowledges WEI could become an allowlist for the web. The author implicitly acknowledges this is most likely if most clients are using WEI (hence, the proposed solution of artificially decreasing WEI usage via holdback) And even then, the proposed solution of holdback is not a solid one. There’s no technical reason that WEI will continue to have holdback in the future, at best maybe a google pinky promise. Further, there’s solid game theoretic reasons we can predict that holdback may vanish: if popular sites start using WEI as an allowlist, then any browser with holdback will have a degraded browsing experience on a percentage of visits. You can win market share by abandoning holdback! As a tragedy of the commons, we can reasonably assume in the long term WEI is supported on all visits by all major browsers and a nontrivial number of websites use it as an allowlist. In conclusion: the author admits WEI breaks the open web with sufficient market share, but the only proposed solution seems guaranteed to fail in a competitive browser marketplace based on game theory.

meragrin_ 3y ago
> The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” You know they can do that right now, right? They aren't doing it. Will more do it because it is simpler now? Sure. Will it put "an end to the open web"? Nope. If they wanted to end it, they could have already achieved that. WEI is just simply another better option for the websites which sorely need it. Sure, some other sites will abuse it, but I think you already avoid them since you still think the "open web" is still a thing.
- dns_snek 3y ago
  "We will abuse this but you should stop complaining because we sorely need this to pad the profit margins for our investors."
- helen___keller 3y ago
  I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem.
  - meragrin_ 3y ago
    > I’m not sure what you mean by “they aren’t doing it”. Making the web impossible to use if you don't fit into their specific requirements. WEI is just another signal. It won't be the only signal for the vast majority of the web. Google cannot do anything to break the web without the help of Apple. Frankly, Apple has a better chance of breaking anything open than Google does. Apple has the vertical control. Google has what? Chrome? I just don't understand how people seem to think Google has all this power, but continue to ignore Apple. > WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. Yet a lot people seemingly know its going to do this, that, and some other bad thing even though there is no proof and stated goals which are the opposite. > More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem. They cannot prevent websites from requiring X to access their sites. There is no workable solution to force someone to accept traffic against their wishes. If they only accept requests with some custom header, that's their prerogative. Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Anything Google does is automatically bad.
    - daurentius523 3y ago

meragrin_ 3y ago

> The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” You know they can do that right now, right? They aren't doing it. Will more do it because it is simpler now? Sure. Will it put "an end to the open web"? Nope. If they wanted to end it, they could have already achieved that. WEI is just simply another better option for the websites which sorely need it. Sure, some other sites will abuse it, but I think you already avoid them since you still think the "open web" is still a thing.

dns_snek 3y ago
"We will abuse this but you should stop complaining because we sorely need this to pad the profit margins for our investors."
helen___keller 3y ago
I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem.
- meragrin_ 3y ago
  > I’m not sure what you mean by “they aren’t doing it”. Making the web impossible to use if you don't fit into their specific requirements. WEI is just another signal. It won't be the only signal for the vast majority of the web. Google cannot do anything to break the web without the help of Apple. Frankly, Apple has a better chance of breaking anything open than Google does. Apple has the vertical control. Google has what? Chrome? I just don't understand how people seem to think Google has all this power, but continue to ignore Apple. > WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. Yet a lot people seemingly know its going to do this, that, and some other bad thing even though there is no proof and stated goals which are the opposite. > More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem. They cannot prevent websites from requiring X to access their sites. There is no workable solution to force someone to accept traffic against their wishes. If they only accept requests with some custom header, that's their prerogative. Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Anything Google does is automatically bad.
  - daurentius523 3y ago