4 ms·

I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. More to the point, even

I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem.

meragrin_ 3y ago
> I’m not sure what you mean by “they aren’t doing it”. Making the web impossible to use if you don't fit into their specific requirements. WEI is just another signal. It won't be the only signal for the vast majority of the web. Google cannot do anything to break the web without the help of Apple. Frankly, Apple has a better chance of breaking anything open than Google does. Apple has the vertical control. Google has what? Chrome? I just don't understand how people seem to think Google has all this power, but continue to ignore Apple. > WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. Yet a lot people seemingly know its going to do this, that, and some other bad thing even though there is no proof and stated goals which are the opposite. > More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem. They cannot prevent websites from requiring X to access their sites. There is no workable solution to force someone to accept traffic against their wishes. If they only accept requests with some custom header, that's their prerogative. Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Anything Google does is automatically bad.
- daurentius523 3y ago
  Part 2: > Yet a lot people seemingly know its going to do this, that, and some other bad thing Original https://news.ycombinator.com/item?id=36935843 https://news.ycombinator.com/item?id=36935843 New Because any other option is not sensible: 1. Authors don't understand what tech they use. (not possible as they acknowledge issues) 2. Authors don't understand that something unrealistic is unrealistic. Idea that you can give companies or corporations tools to check "did user modify his environment" and they would not use it to exclude users is stupid or disingenuous because advocates for this did exactly comment in such way: We want this proposal to do precisely that. Again Google tries to defend it by saying "we will return invalid 'false' for some of the users/times of Chrome users" [to make sure that website will not do that] which for me is not only bad because it then creates "when google revokes this policy we are in even worse situation" but then leaves the issue how google decides "who" to give back this 'false': I will reject times immediately not only because this can be easily circumvented by website [check n-times] to detriment of user but it would also contradict official documentation of WEI (same token for same input from user). And this leads us to another point - if Google wants to return false negatives it would need to either keep information that is supposed to return 'false' - EU will not be very happy with that (also it does contradict this "chrome users"); or more likely it will be implemented in chrome. Now when we established that implementation in chrome is most probable - we can also establish that: A) Implement this on profile basis - companies will ask you to reset profile if you are this false negative. B) Implement on connection basis - companies will ask you to refresh. C) Implement on device age / os version / type - Google can even make the manufacturers happy with this one. … as you can see at most this will be nuisance and if by some weird way: Z) Implement on Super-complicated basis - this will be still possible because… 3. Google plays disingenuous word game with us here by saying - We won't destroy open web Other Chromium browsers may ignore that Google X% false negative (Google may loose few % of users before it scrapes this policy). And there is 0 need for Google to actually do something when companies will misuse this API. In simple words the part that should worry you is not that "Google will destroy web by using this API on Chrome and it services", what must worry you is that other companies will do that for Google and Google will wash their hands from this by saying "We wanted good but didn't work". You can see that tone from the Google - We don't want that so we created these "holdouts". They are proposing thing that any sensible person see as clear cut attack (or stupid idea that can only work this way) on Privacy and Your Right to use Your Device (and for some people Your OS and/or Your Browser) as You want to use. They are at fault here.
- daurentius523 3y ago
  Part 1: > They cannot prevent websites from requiring X to access their sites. They can by lowering amount of signals site gets - so to make it impossible to guess what client is running. > There is no workable solution to force someone to accept traffic against their wishes. Not give someone way to disallow traffic based on OS or Browser. > If they only accept requests with some custom header, that's their prerogative. And it is users prerogative to not give you any custom header which they do not want - or if you force them to do so give you not real one. >Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? Yes we should. Or at least we should do risk assesment on those to check if they should be part of standards and Browsers. We should do more risk assessment of any new feature and standard. >Anything Google does is automatically bad. If they start championing privacy and less pro-corpo bs - I will applaud them for that. > This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Don't bring your (USA) bs politics to this - if anything it is your fault to not make proper regulations on your market. > even though there is no proof If you understand even tiny bit of tech - you will see the definite proof - the proposal. > "and stated goals which are the opposite." PR is irrelevant.

meragrin_ 3y ago

> I’m not sure what you mean by “they aren’t doing it”. Making the web impossible to use if you don't fit into their specific requirements. WEI is just another signal. It won't be the only signal for the vast majority of the web. Google cannot do anything to break the web without the help of Apple. Frankly, Apple has a better chance of breaking anything open than Google does. Apple has the vertical control. Google has what? Chrome? I just don't understand how people seem to think Google has all this power, but continue to ignore Apple. > WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. Yet a lot people seemingly know its going to do this, that, and some other bad thing even though there is no proof and stated goals which are the opposite. > More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem. They cannot prevent websites from requiring X to access their sites. There is no workable solution to force someone to accept traffic against their wishes. If they only accept requests with some custom header, that's their prerogative. Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Anything Google does is automatically bad.

daurentius523 3y ago
Part 2: > Yet a lot people seemingly know its going to do this, that, and some other bad thing Original https://news.ycombinator.com/item?id=36935843 https://news.ycombinator.com/item?id=36935843 New Because any other option is not sensible: 1. Authors don't understand what tech they use. (not possible as they acknowledge issues) 2. Authors don't understand that something unrealistic is unrealistic. Idea that you can give companies or corporations tools to check "did user modify his environment" and they would not use it to exclude users is stupid or disingenuous because advocates for this did exactly comment in such way: We want this proposal to do precisely that. Again Google tries to defend it by saying "we will return invalid 'false' for some of the users/times of Chrome users" [to make sure that website will not do that] which for me is not only bad because it then creates "when google revokes this policy we are in even worse situation" but then leaves the issue how google decides "who" to give back this 'false': I will reject times immediately not only because this can be easily circumvented by website [check n-times] to detriment of user but it would also contradict official documentation of WEI (same token for same input from user). And this leads us to another point - if Google wants to return false negatives it would need to either keep information that is supposed to return 'false' - EU will not be very happy with that (also it does contradict this "chrome users"); or more likely it will be implemented in chrome. Now when we established that implementation in chrome is most probable - we can also establish that: A) Implement this on profile basis - companies will ask you to reset profile if you are this false negative. B) Implement on connection basis - companies will ask you to refresh. C) Implement on device age / os version / type - Google can even make the manufacturers happy with this one. … as you can see at most this will be nuisance and if by some weird way: Z) Implement on Super-complicated basis - this will be still possible because… 3. Google plays disingenuous word game with us here by saying - We won't destroy open web Other Chromium browsers may ignore that Google X% false negative (Google may loose few % of users before it scrapes this policy). And there is 0 need for Google to actually do something when companies will misuse this API. In simple words the part that should worry you is not that "Google will destroy web by using this API on Chrome and it services", what must worry you is that other companies will do that for Google and Google will wash their hands from this by saying "We wanted good but didn't work". You can see that tone from the Google - We don't want that so we created these "holdouts". They are proposing thing that any sensible person see as clear cut attack (or stupid idea that can only work this way) on Privacy and Your Right to use Your Device (and for some people Your OS and/or Your Browser) as You want to use. They are at fault here.
daurentius523 3y ago
Part 1: > They cannot prevent websites from requiring X to access their sites. They can by lowering amount of signals site gets - so to make it impossible to guess what client is running. > There is no workable solution to force someone to accept traffic against their wishes. Not give someone way to disallow traffic based on OS or Browser. > If they only accept requests with some custom header, that's their prerogative. And it is users prerogative to not give you any custom header which they do not want - or if you force them to do so give you not real one. >Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? Yes we should. Or at least we should do risk assesment on those to check if they should be part of standards and Browsers. We should do more risk assessment of any new feature and standard. >Anything Google does is automatically bad. If they start championing privacy and less pro-corpo bs - I will applaud them for that. > This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Don't bring your (USA) bs politics to this - if anything it is your fault to not make proper regulations on your market. > even though there is no proof If you understand even tiny bit of tech - you will see the definite proof - the proposal. > "and stated goals which are the opposite." PR is irrelevant.