6 ms·

Of course it is anticompetitive, if a given service (which is defacto mandatory) strikes a deal with select few hardware vendors to artificially make it imposs

by zb3 3y ago

Of course it is anticompetitive, if a given service (which is defacto mandatory) strikes a deal with select few hardware vendors to artificially make it impossible to access the service using different hardware (for purely business reasons), then it obviously is anticompetitive.

charcircuit 3y ago
>strikes a deal with select few hardware vendors That isn't what is happening. Anyone can become a manufacturer for Windows PCs or Android certified phones.
- daurentius523 3y ago
  Right because Microsoft and Google don't mandate what can and cannot be installed by manufacturer… oh wait.
  - charcircuit 3y ago
    The whole point of Android certification is that you are following Google's rules. If you make something that is not certified you can not get play services.
    - daurentius523 3y ago
      >The whole point of Android certification is that you are following Google's rules. Whole point of WEI is that you are following Google's rules. You essentially acknowledged that YOU CANNOT become manufacturer - you become subcontractor for corporation that dictates what you can and cannot do. Which from point of trust is precisely that - anticompetitive behaviour.
      - charcircuit 3y ago
        >Whole point of WEI is that you are following Google's rules. That would be the point of the Google Play attestor. With WEI sites can use anyone as an attestor. It is up for attestors to compete in providing a valuable signal to sites. It's not anticompetitive because you can come up with your own standard of a secure device and get sites to trust your attestor.
        zb3 3y ago
        Even if that'd be the case I'd still consider this API nothing more than a framework for enabling anticompetitive behaviour. But let's go back to the "anyone as attestor" argument. I don't see it in the API at all - I see only content binding..
        charcircuit 3y ago
        When navigator.getEnvironmentIntegrity is called the browser can get an attestation from any single atestor willing to attest to it.
        zb3 3y ago
        I'm unable to understand this. Since the API doesn't provide a way to force a specific atestor to be invoked, doesn't it mean it will be the browser that decides which atestor can run on a given platform? Of course then substitute browser for Chrome and we'll get the obvious outcome - Google will decide.
        daurentius523 3y ago
        There are seriously so many conflicting informations that this should be hanged from implementation before it its fully formulated (aside fact that it is bad idea and should be scrapped). Firstly on Android Chrome implementation (testing) only Google Play is now implemented as attester and it does not seem that probable for it to change. (so presumably at least Chrome+Root wont work). Second and Most Important - the mechanism does not allow for "willing to attest it" - it actually contains this phrase "The web server then checks that the token came from an attester it trusts" so it is disingenuous to say that "any single atestor" is OK - it must be attestor that server decided beforehand (so if server decide we only trust Google and Microsoft - and you have Mac, then tough luck. [more realistically Linux will be at issue]) - so we are getting system that can exclude certain OS and Browsers permanently without recourse - by server side. @zb3 >doesn't it mean it will be the browser that decides which atestor can run on a given platform? That seems to be case in Chrome implementation* - and there is nothing about this in standard so unless other browsers would create another standard - this way seems likely. This would be disastrous for any decentralized OS like Linux or BSD - it would be completely impossible for it to realistically work as it requires single "platform" by design - and I should remark "there is no single uniform thing in Linux". * - note that server decides which attestors it trusts. Which means in essentia that sever decides which platforms it trusts. Again this must be scrapped.
- zb3 3y ago
  That's not the competition I really meant, replace hardware vendors with OS vendors / Google. "Android certified" means it follows Google's rules, so there's no way to compete by creating alternative security model (for example where the user has more power). So the anticompetitive part is the attestation part, which artificially makes it impossible to run an app that'd otherwise work on the system that doesn't follow Google's rules.
  - charcircuit 3y ago
    >so there's no way to compete by creating alternative security model (for example where the user has more power). There is a way, by creating a new attestor service that provides less guarantees than what Google Play's attestor provides.
    - zb3 3y ago
      Compete in anticompetitiveness? Attestation is the problem itself, it makes it harder to compete, by definition excluding any newly created environment. But this isn't really my problem as I'm not a business. As an user, I'd be happy to have a secure OS with hardware attestation and app security but without Google Adware and Spyware.
      - charcircuit 3y ago
        >Compete in anticompetitiveness? Trust isn't anticompetitive.
        zb3 3y ago
        In this context it clearly is - if the server assumes the request sent by the client is always untrusted, then any capable device / app can use the service and it's possible to manufacture that device / app without permission from some company that has a dominant market position.. I acknowledge though, that this is incompatible with many practical scenarios, and CPC advertisements are one of those. It's hard for me to argue here theoretically without taking context into account, as it turns out what I'm arguing for depends on it heavily.. It could be possible for Google to make changes where while theoretically possible to compete, it's not practical, and when it gets practical, Google could make another change and so on..

by zb3 3y ago

charcircuit 3y ago

>strikes a deal with select few hardware vendors That isn't what is happening. Anyone can become a manufacturer for Windows PCs or Android certified phones.

daurentius523 3y ago
Right because Microsoft and Google don't mandate what can and cannot be installed by manufacturer… oh wait.
- charcircuit 3y ago
  The whole point of Android certification is that you are following Google's rules. If you make something that is not certified you can not get play services.
  - daurentius523 3y ago
    >The whole point of Android certification is that you are following Google's rules. Whole point of WEI is that you are following Google's rules. You essentially acknowledged that YOU CANNOT become manufacturer - you become subcontractor for corporation that dictates what you can and cannot do. Which from point of trust is precisely that - anticompetitive behaviour.
    - charcircuit 3y ago
      >Whole point of WEI is that you are following Google's rules. That would be the point of the Google Play attestor. With WEI sites can use anyone as an attestor. It is up for attestors to compete in providing a valuable signal to sites. It's not anticompetitive because you can come up with your own standard of a secure device and get sites to trust your attestor.
      - zb3 3y ago
        Even if that'd be the case I'd still consider this API nothing more than a framework for enabling anticompetitive behaviour. But let's go back to the "anyone as attestor" argument. I don't see it in the API at all - I see only content binding..
        charcircuit 3y ago
        When navigator.getEnvironmentIntegrity is called the browser can get an attestation from any single atestor willing to attest to it.
        zb3 3y ago
        I'm unable to understand this. Since the API doesn't provide a way to force a specific atestor to be invoked, doesn't it mean it will be the browser that decides which atestor can run on a given platform? Of course then substitute browser for Chrome and we'll get the obvious outcome - Google will decide.
        daurentius523 3y ago
        There are seriously so many conflicting informations that this should be hanged from implementation before it its fully formulated (aside fact that it is bad idea and should be scrapped). Firstly on Android Chrome implementation (testing) only Google Play is now implemented as attester and it does not seem that probable for it to change. (so presumably at least Chrome+Root wont work). Second and Most Important - the mechanism does not allow for "willing to attest it" - it actually contains this phrase "The web server then checks that the token came from an attester it trusts" so it is disingenuous to say that "any single atestor" is OK - it must be attestor that server decided beforehand (so if server decide we only trust Google and Microsoft - and you have Mac, then tough luck. [more realistically Linux will be at issue]) - so we are getting system that can exclude certain OS and Browsers permanently without recourse - by server side. @zb3 >doesn't it mean it will be the browser that decides which atestor can run on a given platform? That seems to be case in Chrome implementation* - and there is nothing about this in standard so unless other browsers would create another standard - this way seems likely. This would be disastrous for any decentralized OS like Linux or BSD - it would be completely impossible for it to realistically work as it requires single "platform" by design - and I should remark "there is no single uniform thing in Linux". * - note that server decides which attestors it trusts. Which means in essentia that sever decides which platforms it trusts. Again this must be scrapped.
zb3 3y ago
That's not the competition I really meant, replace hardware vendors with OS vendors / Google. "Android certified" means it follows Google's rules, so there's no way to compete by creating alternative security model (for example where the user has more power). So the anticompetitive part is the attestation part, which artificially makes it impossible to run an app that'd otherwise work on the system that doesn't follow Google's rules.
- charcircuit 3y ago
  >so there's no way to compete by creating alternative security model (for example where the user has more power). There is a way, by creating a new attestor service that provides less guarantees than what Google Play's attestor provides.
  - zb3 3y ago
    Compete in anticompetitiveness? Attestation is the problem itself, it makes it harder to compete, by definition excluding any newly created environment. But this isn't really my problem as I'm not a business. As an user, I'd be happy to have a secure OS with hardware attestation and app security but without Google Adware and Spyware.
    - charcircuit 3y ago
      >Compete in anticompetitiveness? Trust isn't anticompetitive.
      - zb3 3y ago
        In this context it clearly is - if the server assumes the request sent by the client is always untrusted, then any capable device / app can use the service and it's possible to manufacture that device / app without permission from some company that has a dominant market position.. I acknowledge though, that this is incompatible with many practical scenarios, and CPC advertisements are one of those. It's hard for me to argue here theoretically without taking context into account, as it turns out what I'm arguing for depends on it heavily.. It could be possible for Google to make changes where while theoretically possible to compete, it's not practical, and when it gets practical, Google could make another change and so on..