15 ms·

Your computer should say what you tell it to say

689 points by skilled 3y ago

local_issues 3y ago
The EFF stands alone in its commitment to actually speaking truth to power. The ACLU has become just another arm of the DNC, same with the SPLC etc - repeating CNN-esque talking points. Same with the NRA - milquetoast arm of those in power. The EFF will go after orgs that fund it, which requires true compunction. FIRE is a good replacement for the ACLU, FYI. And John Brown Gun Club is becoming a better NRA.
- mistrial9 3y ago
  that's all great but you realize a lot of readers here are not USA, eh? "web-TPM" needs to be named-and-shamed among literate people in all nations IMHO. It is clearly political -- there are private winners and public losers in the change to locked and enforced access to digital content on the Internet. Any commercial company in any country that can successfully block the roads and check ID will make money, and they know it.
  - Avamander 3y ago
    It's not a "web-TPM", far from it conceptually.
    - Brian_K_White 3y ago
      It is totally web-tpm. The differences are irellevant to the essence.
      - Avamander 3y ago
        It's far from essence as well. A safe secret storage is not platform attestation.
        Brian_K_White 3y ago
        They are not even merely similar, they are identical. They are both someone else controlling some part of your property, to control your use of the rest of your property. Neither is benign or honest. Neither actually does what the sales pitch claims. The sales pitch is a Sales Pitch. It is what you say when you need to convince someone to do something they normally would not want. Anyone can make up a good sounding sales pitch for anything. Quoting the good sounding sales pitch does not show that the thing is good. It just makes one wonder about the speaker. TPM is not merely "safe secret storage", it's someone else's secret used for someone else's purposes, and one of those purposes is absolutely to "attest" that WEI is valid on this machine at this time. I can only assume that you know all of this perfectly well and can only guess at possible reasons why anyone who knows what these things do would try to sell the bs cover story that TPM is just another bit of neutral useful handy tech that users can use like a special kind of thumb drive, without mentioning anything about Microsoft and the reality of most actual manufactured devices, and what it actually means even on a machine where it's "disabled".
        Avamander 3y ago
        > TPM is not merely "safe secret storage", it's someone else's secret used for someone else's purposes Not true, you can use it for your secrets as well. There are many many great use-cases for such secret storage. > one of those purposes is absolutely to "attest" that WEI is valid on this machine at this time. It can be one of the end results. But that's like blaming CPUs for accelerating crypto with AES-NI. > They are not even merely similar, they are identical. If you want to wage an ideological battle, at least remain technically correct.
        Brian_K_White 3y ago
        "you can use it for your secrets as well" There's that sales pitch again. Why do Linux bootloaders have to get a blessing from Microsoft? Why does even one machine exist that has a bios that lacks the supposedly spec mandated option for the user to install their own keys? Why are there keys preloaded on every machine that the user did not provide? Why do they all come from Microsoft? And why can't the user edit or remove them? Why can't the user decide that the MS keys are invalid and that things signed by them should not be allowed to run? There are so many ways and proofs that this tech is not what it's sales pitch claims it's not even funny. I can understand not being aware of the underhanded aspects by simply not being aware of anything about it. I can not understand being aware of what it is and how it works, and still being OK with it and defending it as reasonable, useful, not dishonest at all, and exerting no outside _and superior_ control over what is supposed to be the users own property and actions and associations. They graciously, most of the time, allow you to also store some keys of your own in their vault they caused to be placed on your machine even if you didn't want it? How magnanimous and generous of them!
  - surajrmal 3y ago
    Your ability to mischaracterize it as "webtpm" makes me question your credibility entirely. It's fine to be opposed to the proposal, but it would be best to stay truthful and not exaggerate.
    - hot_gril 3y ago
      It is web-TPM. Yes the spec theoretically allows for any kind of attestation, but in practice it's only useful with hardware security like TPM involved.
    - mistrial9 3y ago
      the term is quoted -- informal for "something like that" It is deliberately not a compliment
- wwalexander 3y ago
  While I agree that the ACLU has become defanged, there are many more civil liberties to protect beyond simply free speech, which seems to be the only concern of FIRE.
  - no_wizard 3y ago
    To be fair, free speech is pretty huge though And it’s constantly under attack even in this day and age
  - local_issues 3y ago
    I agree with you, but I don't see a big attack on freedom of religion, assembly (post COVID) or movement lately. Freedom of Speech is under massive, coordinated attack by gigacorporations and https://freddiedeboer.substack.com/p/please-just-fucking-tell-me-what https://freddiedeboer.substack.com/p/please-just-fucking-tel...
    - hot_gril 3y ago
      Covid wasn't very long ago. But yeah, I'm fine with an org deciding to focus on speech.
- dmoy 3y ago
  > John Brown Gun Club is becoming a better NRA. JBCG doesn't really replace much of the NRA. Even if hypothetically people could join JBCG at mass scale, which they can't due to the way its structured. The NRA-ILA is increasingly useless for 2A advocacy and legal efforts, but JBCG isn't replacing that at all. FPC, 2AF, to a lesser extent GOA do more there. NRA courses are crufty but don't really have a replacement approaching anywhere near the same scale. Certainly not JBCG. Maybe USCCA for just the pistol side of things, but that has its own issues since their business model is fleecing people. NRA competition... there's no replacement for bullseye, but that's because bullseye is becoming an afterthought compared to e.g. USPSA in a lot of areas... smallbore and air as a college&younger sport notwithstanding. And nothing is close to trap/skeet/sc in popularity in the US, but that's not NRA either. NRA club/range support and insurance.... also nothing replaces this. --- What JBCG has that the NRA doesn't, and never had, is the same thing that the black panthers had in the 60s - armed support of disenfranchised subsets of the population. It's harder for the police to shut you down, or stand and watch as an adjacent supremacist group shuts you down, if you have your own armed guards. Same as armed guards prevented mobs from attacking schoolchildren during desegregation in the late 60s, you see JBCG in a lot of places protecting pride events, drag events, etc. 'cus the police often don't. (In the US, it's not the police's job to protect anyone, that's been tried in the Supreme Court multiple times)
  - dmoy 3y ago
    > What JBCG has that the NRA doesn't, and never had, (Corollary: maybe that makes them a "better NRA", but it's an odd statement to look at because it sounds something like "DuckDuckGo is becoming a better Nvidia". Yes both are computer-adjacent, but they do completely different things, and have roughly never had any overlap in activities)
ChrisMarshallNY 3y ago
That's a very well-written explanation! I would hope that we see this kind of explanation more frequently.
- judge2020 3y ago
  So much better written than the articles that were at the top of HN originally. People somehow thought this would mean checking for ad block? The original proposal specifically called out that browser extensions are completely unrelated to WEI, which just calls into existing OS and TPM-based attestation APIs and makes the status of this attestation available to sites.
  - chabad360 3y ago
    > People somehow thought this would mean checking for ad block? No, the worry about adblock was that Google could now just remove the ability for that work in chrome and there would be nothing you could do, because your forked chromium wouldn't pass the attestation check (cause it would never be blessed by Google). This concern extends to other browsers as well. Because Google is making themselves the signing authority here, they can choose which browsers are allowed and which aren't, letting them force other browsers to add or drop certain features if they want to be granted attestation.
    - no_time 3y ago
      Not sure why you were downvoted. This is the exact scenario that will unfold in the mid term future. Not to mention that chrome on android already does not have any access to extensions and thus adblocking. Isn't that awfully convenient? For GOOG that is.
  - dns_snek 3y ago
    > People somehow thought this would mean checking for ad block This is an obvious consequence of this proposal, yes. Ad-block prevention isn't an explicit goal, just a very obvious consequence when you create a mechanism that whereby attesters (OS) inform the server about the presence or absence of software on your computer. It doesn't require a logical leap, it's a plainly obvious use case. > Goals: > Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device.
barbariangrunge 3y ago
Remember: upvoting the EFF's articles is good, but you (yes, you!) can also donate to them to help with these campaigns!
- smegsicle 3y ago
  but i just gave all my money to uganda...
- tailspin2019 3y ago
  Agreed. I have a lot of respect for the work they do. They make some cool merch too: https://supporters.eff.org/donate/ https://supporters.eff.org/donate/
  - freedomben 3y ago
    Can anyone speak to the quality of the shirts? I bought one many years ago at a Linux conference and the design was cool but the shirt itself feels like cardboard and sandpaper, so I never wear it. If the shirts are Bella Canvas or American Life or something else high quality, I'd happily buy some. Tshirts are a great way to raise funds IMHO, and the EFF is doing extremely important work and needs to be funded.
    - bsilvereagle 3y ago
      The sizing charts give the shirt manufacturer: https://supporters.eff.org/t-shirt-size-chart#watcheru https://supporters.eff.org/t-shirt-size-chart#watcheru
      - freedomben 3y ago
        Wonderful! Thank you, this is even better than I hoped for :-)
- minerva23 3y ago
  I had donated to the EFF in the past, but their stance[1] that CDNs/hosted services shouldn't be allowed to choose the customers they are willing work with is not only wrong, it's causes harm[2]. [1] https://www.eff.org/press/releases/international-coalition-rights-groups-call-internet-infrastructure-providers-avoid https://www.eff.org/press/releases/international-coalition-r... [2] https://blog.cloudflare.com/kiwifarms-blocked/ https://blog.cloudflare.com/kiwifarms-blocked/
cortesoft 3y ago
I agree with most of this, but one nit pick: > Originally, secure computing relied on a second processor - a "Technical Protection Module" or TPM - to monitor the parts of your computer you directly interact with. TPM stands for Trusted Platform Module, not Technical Protection Module
- benatkin 3y ago
  That's wild. It seems these blog posts are outsourced. Edit: I'm wrong about this one. It's an actual article, and a pretty good one at that. But it is either a mistake or they are introducing an alternate expansion for TPM (other acronyms have been given different sets of words).
  - hvis 3y ago
    They don't have to be outsourced to this to happen. To put out lengthy press-releases, you hire a copywriter. You don't ask an engineer to write them. People make mistakes sometimes. And this one is not a huge one -- the meaning is conveyed fine.
    - JohnFen 3y ago
      I've also seen that exact incorrect explanation of what "TPM" stands for in several other places now. I'm guessing that someone authoritative made the error and now it's being propagated by people who aren't otherwise familiar with the terminology.
      - benatkin 3y ago
        Google/Bing say otherwise, at least when it comes to the exact pharase "Technical Protection Module".
  - oaktrout 3y ago
    Or written with help from chat gtp, I've seen it hallucinate similar mistakes before.
tapoxi 3y ago
I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implement in Chrome, it just moves the problem elsewhere. The fight was implementing TPM in the first place.
- shadowgovt 3y ago
  You are correct, and that is fine. If the ecosystem becomes "You control your browser but not the apps on your mobile device," that's pretty much the status quo.
- bayindirh 3y ago
  The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can and will be abused to lock any tech savvy person from daily internet based on arbitrary rules. There are no checks and balances. This is a very broad set of capabilities which is forced upon users. This is no proposal, or experiment. It's a force-push attempt.
  - judge2020 3y ago
    There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#open-questions https://github.com/RupertBenWiser/Web-Environment-Integrity/...
    - bayindirh 3y ago
      I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys. Mathematics & cryptography doesn't work like that. It doesn't discriminate. It levels everyone. It'll either become an iron fist or a Swiss Cheese. There can be no middle. This is maths.
no_wizard 3y ago
EDIT: Originally posited an incorrect fact here. I completely missed who wrote the article at hand (not sure why, but I didn't see the authors names) Good catch everyone
- hgomersall 3y ago
  I'm puzzled by your comment. This is literally the article by him....
  - no_wizard 3y ago
    I completely missed it, edited in kind. thanks!
ceroxylon 3y ago
Would it be possible for attackers/fraudsters to just set up "proxy farms" of real hardware that provide the device details for attestation? It would make bots less efficient but surely the incentive for ad fraud would still exist and adaptations would be made.
- alexpotato 3y ago
  This comment made me think of the videos of scammers with racks upon racks of cheap cell phones. They are all legitimate phones and labor is cheap so it's easier to just do that rather than try to create script to click on ads etc.
- tornato7 3y ago
  Yes, but in theory if suspicious behavior was detected those devices could be permanently blacklisted from a website, making the investment challenging. If WEI goes through we'll probably see cheap PCs popping up on eBay that are unable to access certain websites.
  - yomlica8 3y ago
    You thought having your google account banned was bad now, wait until they ban all associated hardware with a heuristic routine and most of the web doesn't work for you anymore. That should really cut down on the account support requests they didn't want to deal with.
    - deleted 3y ago
      [deleted]
endisneigh 3y ago
I read the entire thing and it’s not clear how this reduces control of your own computer. It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong. > It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI). This, however, is true for sure. At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional. Those who implement it are those who are not interested in an “open web” to begin with and definitionally were never going to support it anyways.
- zuminator 3y ago
  It reduces control of my computer because without it my computer can identify itself to websites and advertisers in the way that I want, but with it, it can only use its TPM assigned identity. You can argue (I'd disagree) that it's a good thing that I can't make my computer spoof as something else, but unquestionably it does reduce my control.
  - endisneigh 3y ago
    This is wrong though. Wei doesn’t stop your ability to spoof, it stops your ability to be successful in spoofing.
  - wilsonnb3 3y ago
    > unquestionably it does reduce my control It doesn't reduce your control, you are still welcome to identify your computer however you want to websites by using a browser without WEI or disabling it. You will just have to live with the reality that a lot of servers aren't going to want to talk to your client.
    - wpietri 3y ago
      Their point is that a browser with WEI reduces your control versus a browser without WEI. I would agree with them that it's definitional.
2OEH8eoCRo0 3y ago
What is to stop me from virtualizing a TPM?
- liamkearney 3y ago
  Your poorly drawn signature.
- chupasaurus 3y ago
  Google Cloud does it. [0] [0] https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#vtpm https://cloud.google.com/compute/shielded-vm/docs/shielded-v...
- wmf 3y ago
  Your vTPM doesn't have a certificate from any respected authority.
  - 2OEH8eoCRo0 3y ago
    Yeah, and there is no (easy) way to extract the root cert from your own real TPM either.
LunicLynx 3y ago
Here is an idea: If WEI is available use it to block chrome otherwise allow access disregarding WEI. XD
- hot_gril 3y ago
  I used to have a little website in middle school that banned Chrome by user agent, cause even back then (2008) I said it was evil.
- hot_gril 3y ago
  Ok but seriously, this might be the only way to combat WEI. Don't even preach to the user about the evils of WEI (ain't nobody gonna read that wall of text), just say it is not supported and tell them succinctly how to turn it off / get a different browser.
  - seabass-labrax 3y ago
    I agree; this may well be an effective last-resort action if Google Chrome does implement Google's WEI proposal. However, I sincerely hope that it won't come to that, because it's not a foregone conclusion that Chrome wouldn't win :(
uwagar 3y ago
such an irony that WEI seeks to impose the tyranny of the "giants of flesh and steel" into cyberspace.
- barbariangrunge 3y ago
  Very poetic. Once can imagine a cyberpunk plotline around that idea
nologic01 3y ago
> A handful of companies have established chokepoints between buyers and sellers, performers and audiences, workers and employers, as well as families and communities. When those companies refuse to deal with you, your digital life grinds to a halt This short paragraph summarizes the (ex-ante) improbably unusual situation we have drifted into. The negatively affected stakeholders being enumerated are more or less the entire society. These gatekeepers and chokepoint operators do have a few natural allies (the captured politicos, others in direct or indirect payroll, externality-blind markets). Yet somehow they can bully into submission basically the entire universe. With its infinite financial, political, intellectual resources. Rather strange dont you think? It almost as if they already operate effective mind control at systemic scale.
- HPsquared 3y ago
  See also the history of railroads and telecoms.
  - version_five 3y ago
    Also every industry in Canada
    - mig39 3y ago
      The solution in Canada is to break up some of these huge companies. The free market can solve things, but only if there's a free market. When you have 1 or 2 companies, there's no competition.
      - WarOnPrivacy 3y ago
        > The solution in Canada is to break up some of these huge companies. The free market can solve things, but only if there's a free market. I'm not familiar with Canada but this sounds like oversight there is similar to how the US DoJ operates - which is to say it has a long history of rubberstamping (massive, competition-killing) mergers
      - 3y ago
charcircuit 3y ago
>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy. WEI doesn't stop you from changing your user agent, nor does it prevent you from using your privacy web extentions. >But, despite their valiant attempts to cast these benefits as accruing to device owners, these are really designed to benefit the owners of commercial services; the benefit to users comes from the assumption that commercial operators will use the additional profits from remote attestation to make their services better for their users. End users are not the only stake holders in the web. I would say most changes to the web are for people who develop sites and end users benefit from sites using those features. >Putting handcuffs on every shopper who enters a store would doubtless reduce shoplifting, and stores with less shoplifting might lower their prices, benefitting all of their customers. But ultimately, shoplifting is the store’s problem, not the shoppers’, and it’s not fair for the store to make everyone else bear the cost of resolving its difficulties. This metaphor isn't the same since WEI is transparent to users. Physical handcuffs would be very intrusive, but that isn't what is happening here. Shop lifting affects the profitablity of the store. A better metaphor would be a bouncer for a club. Technically a club could have a set of rules of entering and customers could promise that they follow them. Unfortunately, people lie and just trusting them isn't good enough so clubs end up adding bouncers even though they don't directly make the experience for customers better. >The problem is, there are lots of websites that would really, really like the power to dictate what browser and operating system people can use This claim needs a citation of where user agent based blocking isn't enough. People spoofing their user agent won't make much of a difference to support costs of the site. >The web is the last major open platform left on the internet - the last platform where anyone can make a browser or a website and participate, without having to ask permission or meet someone else’s specifications. WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser. >We sympathize with businesses whose revenues might be impacted by ad-fraud, game companies that struggle with cheaters, and services that struggle with bots. But addressing these problems can’t come before the right of technology users to choose how their computers work, or what those computers tell others about them, because the right to control one’s own devices is a building block of all civil rights in the digital world.. To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy. If EFF cares no much about privacy on the web they should be in favor of this proposal. I disagree that beivg a to lie about what your device is running in a building block of all civil rights because the physical analog, fraud, is illegal, and the world seems better without people commuting fraud to one another.
freedomben 3y ago
I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chomping at the bit to implement WEI because they hate the open web or they hate Linux users. They'll be chomping at the bit because if they don't it will be a liability, and a "you're not doing all you can for security" type of risk that can open them to lawsuits, regulatory punishments, and even higher insurance costs. WEI is not a requirement right now because it doesn't exist. Once it exists though, you can be sure it will become a standard practice requirement, and anyone arguing against it might as well be arguing that using CC cameras is a privacy invasion: they'll seem absurd and won't last long in that position. In short order it will be implemented by all the CDNs like Cloudflare, and it will be a simple checkbox for site owners to add to their site. Failure to implement this would be a fiduciary disaster, so they will have no choice. Once that is there, nobody who cares at all about security for their site (which is pretty much all people) are going to uncheck that box.
- JohnFen 3y ago
  > Once it exists though, you can be sure it will become a standard practice requirement Yes, this seems inevitable. At which point, I will no longer be using the bank's website. > they'll seem absurd and won't last long in that position. I'm not sure what you mean here, though. People who object to ubiquitous surveillance don't seem absurd to most (even those who aren't so upset about it), and they certainly aren't changing their position.
  - freedomben 3y ago
    Hey John, I love that we are in the same threads on HN so much :-D > I'm not sure what you mean here, though. People who object to ubiquitous surveillance don't seem absurd to most (even those who aren't so upset about it), and they certainly aren't changing their position. Yeah good question/clarification, I'm referring to the CCTV cameras in the bank itself (such as in the vault, in the lobby, etc).
seabass-labrax 3y ago
This is one of the most detailed and balanced articles I have read so far on the topic. However, like every other one I've read, it omits one very important clarification about 'Web Environment Integrity': It is not part of the Web. This is exclusively a Google draft for a Google Chrome feature, and whilst Google is a member of the World Wide Web Consortium (W3C), they are not doing this as a member. I don't believe such a proposal would get even as far as a working group charter, given how limited it is to Google's interests. The only reason that it's a threat to the Web is because of their overwhelming market dominance, which is approaching a monopoly already. I fear that the prominent use of the term 'Web' in this kind of document is tarnishing the reputation of the W3C, who have a solid process[1] to avoid pursuing these short term interests when they come with the risk of long term damage to the openness of the Web. [1]: https://www.w3.org/Consortium/Process/ https://www.w3.org/Consortium/Process/
- NoGravitas 3y ago
  Web standards today aren't made by the W3C; they're made by WhatWG, which is Google, Apple, and Mozilla, but mostly Google.
  - seabass-labrax 3y ago
    Some historical context: WHATWG[1], the Web Hypertext Application Technology Working Group, was originally a spin-off of the W3C[2], and was an organisation formed in 2004 by W3C members unhappy with decisions made in the W3C at that time. In 2019, a 'Memorandum of Understanding' was signed[3] agreeing to various principles for coordination between the two organisations. The W3C is still very much active, and produces the vast majority of specifications that are implemented by 'web browsers' (in the general sense) like Chrome, Firefox and Safari, and they have their own standardisation process which is comparable in quality to organisations like ISO. The area in which WHATWG are most active, though, is HTML, for which they produce what they call 'Living Standards' that have a different process from W3C's. CSS is done inside the W3C, and JavaScript is formalised by ECMA, an entirely different organisation still. [1]: https://whatwg.org/ https://whatwg.org/ [2]: https://www.w3.org/ https://www.w3.org/ [3]: https://www.w3.org/2019/04/WHATWG-W3C-MOU.html https://www.w3.org/2019/04/WHATWG-W3C-MOU.html [4]: https://www.ecma-international.org https://www.ecma-international.org
Brian_K_White 3y ago
WEI is a bit like the the old phone system where you were not allowed to own your own phone and connect it to the network. Eventually the government decreed that illegal.
- Avamander 3y ago
  This is the most likely path we'll take, I suspect.
  - Brian_K_White 3y ago
    Telephones came about gradually, but say the kind of phone and system roughly like a modern pots line, served up by Bell, started around 1930. Breakup of ma bell (roughly the same time you were allowed to own a phone) 1984 And even today I can't buy or connect an ONT of my own to the new fiber that Optimum installed a few weeks ago to replace my coax cable and cable modem that I did own (but did not fully control thanks to docsis), somehow. I am not actually hopeful.
amadeuspagel 3y ago
Have these people heard of the iPhone? It came out in 2007. That's 16 years ago. It was never controlled by its users, and that enabled many apps and features, like disappearing messages, that are impossible on devices that are controlled by their users. I think after 16 years it's time to admit that this model is here to stay, and the only question is whether the web supports it, or whether there will be certain apps and features that will never be available on the web.
xbruteforce 3y ago
> Google is adding code to Chrome that will send tamper-proof information about your operating system and other software, and share it with websites. Google says this will reduce ad fraud. Is it only to "reduce ad fraud" though, or the wider agenda is deeper entangle their tracking in one's life.
glimshe 3y ago
Why do I care about reducing Google's ad fraud and helping Google's ad business? This is their problem and should never involve relaying my personal computer's information to third party so Google can make more money.
rogual 3y ago
Because I, for now, have the ability to make my computer say what I tell it to say, I have developed a small Firefox extension [1] that tells it what to say. Silly? Yeah. Petty? Yeah. But sometimes it feels good to exercise your rights. [1] https://github.com/rogual/wei-gfy https://github.com/rogual/wei-gfy
calibas 3y ago
I'm curious as to why this is being flagged/downvoted. Seems like somebody doesn't want it on the front page of HN...
bevdecloud 3y ago
Not gonna lie this title "Had me"
1vuio0pswjnm7 3y ago
Maybe the internet ad the web specifically just wasn't designed to support a "business" like Google's. All data collection and advertising service. Paying enormous fines to regulators. Maybe it was not designed for this.
ColdElectron 3y ago
So, what can we actually do about this? The EFF doesn't mention anyone we can talk to. Are we all just waiting around for Google to do it or is there something we can do to raise awareness or campaign against google?

689 points by skilled 3y ago

The EFF stands alone in its commitment to actually speaking truth to power. The ACLU has become just another arm of the DNC, same with the SPLC etc - repeating CNN-esque talking points. Same with the NRA - milquetoast arm of those in power. The EFF will go after orgs that fund it, which requires true compunction. FIRE is a good replacement for the ACLU, FYI. And John Brown Gun Club is becoming a better NRA.

mistrial9 3y ago
that's all great but you realize a lot of readers here are not USA, eh? "web-TPM" needs to be named-and-shamed among literate people in all nations IMHO. It is clearly political -- there are private winners and public losers in the change to locked and enforced access to digital content on the Internet. Any commercial company in any country that can successfully block the roads and check ID will make money, and they know it.
- Avamander 3y ago
  It's not a "web-TPM", far from it conceptually.
  - Brian_K_White 3y ago
    It is totally web-tpm. The differences are irellevant to the essence.
    - Avamander 3y ago
      It's far from essence as well. A safe secret storage is not platform attestation.
      - Brian_K_White 3y ago
        They are not even merely similar, they are identical. They are both someone else controlling some part of your property, to control your use of the rest of your property. Neither is benign or honest. Neither actually does what the sales pitch claims. The sales pitch is a Sales Pitch. It is what you say when you need to convince someone to do something they normally would not want. Anyone can make up a good sounding sales pitch for anything. Quoting the good sounding sales pitch does not show that the thing is good. It just makes one wonder about the speaker. TPM is not merely "safe secret storage", it's someone else's secret used for someone else's purposes, and one of those purposes is absolutely to "attest" that WEI is valid on this machine at this time. I can only assume that you know all of this perfectly well and can only guess at possible reasons why anyone who knows what these things do would try to sell the bs cover story that TPM is just another bit of neutral useful handy tech that users can use like a special kind of thumb drive, without mentioning anything about Microsoft and the reality of most actual manufactured devices, and what it actually means even on a machine where it's "disabled".
        Avamander 3y ago
        > TPM is not merely "safe secret storage", it's someone else's secret used for someone else's purposes Not true, you can use it for your secrets as well. There are many many great use-cases for such secret storage. > one of those purposes is absolutely to "attest" that WEI is valid on this machine at this time. It can be one of the end results. But that's like blaming CPUs for accelerating crypto with AES-NI. > They are not even merely similar, they are identical. If you want to wage an ideological battle, at least remain technically correct.
        Brian_K_White 3y ago
        "you can use it for your secrets as well" There's that sales pitch again. Why do Linux bootloaders have to get a blessing from Microsoft? Why does even one machine exist that has a bios that lacks the supposedly spec mandated option for the user to install their own keys? Why are there keys preloaded on every machine that the user did not provide? Why do they all come from Microsoft? And why can't the user edit or remove them? Why can't the user decide that the MS keys are invalid and that things signed by them should not be allowed to run? There are so many ways and proofs that this tech is not what it's sales pitch claims it's not even funny. I can understand not being aware of the underhanded aspects by simply not being aware of anything about it. I can not understand being aware of what it is and how it works, and still being OK with it and defending it as reasonable, useful, not dishonest at all, and exerting no outside _and superior_ control over what is supposed to be the users own property and actions and associations. They graciously, most of the time, allow you to also store some keys of your own in their vault they caused to be placed on your machine even if you didn't want it? How magnanimous and generous of them!
- surajrmal 3y ago
  Your ability to mischaracterize it as "webtpm" makes me question your credibility entirely. It's fine to be opposed to the proposal, but it would be best to stay truthful and not exaggerate.
  - hot_gril 3y ago
    It is web-TPM. Yes the spec theoretically allows for any kind of attestation, but in practice it's only useful with hardware security like TPM involved.
  - mistrial9 3y ago
    the term is quoted -- informal for "something like that" It is deliberately not a compliment
wwalexander 3y ago
While I agree that the ACLU has become defanged, there are many more civil liberties to protect beyond simply free speech, which seems to be the only concern of FIRE.
- no_wizard 3y ago
  To be fair, free speech is pretty huge though And it’s constantly under attack even in this day and age
- local_issues 3y ago
  I agree with you, but I don't see a big attack on freedom of religion, assembly (post COVID) or movement lately. Freedom of Speech is under massive, coordinated attack by gigacorporations and https://freddiedeboer.substack.com/p/please-just-fucking-tell-me-what https://freddiedeboer.substack.com/p/please-just-fucking-tel...
  - hot_gril 3y ago
    Covid wasn't very long ago. But yeah, I'm fine with an org deciding to focus on speech.
dmoy 3y ago
> John Brown Gun Club is becoming a better NRA. JBCG doesn't really replace much of the NRA. Even if hypothetically people could join JBCG at mass scale, which they can't due to the way its structured. The NRA-ILA is increasingly useless for 2A advocacy and legal efforts, but JBCG isn't replacing that at all. FPC, 2AF, to a lesser extent GOA do more there. NRA courses are crufty but don't really have a replacement approaching anywhere near the same scale. Certainly not JBCG. Maybe USCCA for just the pistol side of things, but that has its own issues since their business model is fleecing people. NRA competition... there's no replacement for bullseye, but that's because bullseye is becoming an afterthought compared to e.g. USPSA in a lot of areas... smallbore and air as a college&younger sport notwithstanding. And nothing is close to trap/skeet/sc in popularity in the US, but that's not NRA either. NRA club/range support and insurance.... also nothing replaces this. --- What JBCG has that the NRA doesn't, and never had, is the same thing that the black panthers had in the 60s - armed support of disenfranchised subsets of the population. It's harder for the police to shut you down, or stand and watch as an adjacent supremacist group shuts you down, if you have your own armed guards. Same as armed guards prevented mobs from attacking schoolchildren during desegregation in the late 60s, you see JBCG in a lot of places protecting pride events, drag events, etc. 'cus the police often don't. (In the US, it's not the police's job to protect anyone, that's been tried in the Supreme Court multiple times)
- dmoy 3y ago
  > What JBCG has that the NRA doesn't, and never had, (Corollary: maybe that makes them a "better NRA", but it's an odd statement to look at because it sounds something like "DuckDuckGo is becoming a better Nvidia". Yes both are computer-adjacent, but they do completely different things, and have roughly never had any overlap in activities)

ChrisMarshallNY 3y ago

That's a very well-written explanation! I would hope that we see this kind of explanation more frequently.

judge2020 3y ago
So much better written than the articles that were at the top of HN originally. People somehow thought this would mean checking for ad block? The original proposal specifically called out that browser extensions are completely unrelated to WEI, which just calls into existing OS and TPM-based attestation APIs and makes the status of this attestation available to sites.
- chabad360 3y ago
  > People somehow thought this would mean checking for ad block? No, the worry about adblock was that Google could now just remove the ability for that work in chrome and there would be nothing you could do, because your forked chromium wouldn't pass the attestation check (cause it would never be blessed by Google). This concern extends to other browsers as well. Because Google is making themselves the signing authority here, they can choose which browsers are allowed and which aren't, letting them force other browsers to add or drop certain features if they want to be granted attestation.
  - no_time 3y ago
    Not sure why you were downvoted. This is the exact scenario that will unfold in the mid term future. Not to mention that chrome on android already does not have any access to extensions and thus adblocking. Isn't that awfully convenient? For GOOG that is.
- dns_snek 3y ago
  > People somehow thought this would mean checking for ad block This is an obvious consequence of this proposal, yes. Ad-block prevention isn't an explicit goal, just a very obvious consequence when you create a mechanism that whereby attesters (OS) inform the server about the presence or absence of software on your computer. It doesn't require a logical leap, it's a plainly obvious use case. > Goals: > Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device.

barbariangrunge 3y ago

Remember: upvoting the EFF's articles is good, but you (yes, you!) can also donate to them to help with these campaigns!

smegsicle 3y ago
but i just gave all my money to uganda...
tailspin2019 3y ago
Agreed. I have a lot of respect for the work they do. They make some cool merch too: https://supporters.eff.org/donate/ https://supporters.eff.org/donate/
- freedomben 3y ago
  Can anyone speak to the quality of the shirts? I bought one many years ago at a Linux conference and the design was cool but the shirt itself feels like cardboard and sandpaper, so I never wear it. If the shirts are Bella Canvas or American Life or something else high quality, I'd happily buy some. Tshirts are a great way to raise funds IMHO, and the EFF is doing extremely important work and needs to be funded.
  - bsilvereagle 3y ago
    The sizing charts give the shirt manufacturer: https://supporters.eff.org/t-shirt-size-chart#watcheru https://supporters.eff.org/t-shirt-size-chart#watcheru
    - freedomben 3y ago
      Wonderful! Thank you, this is even better than I hoped for :-)
minerva23 3y ago
I had donated to the EFF in the past, but their stance[1] that CDNs/hosted services shouldn't be allowed to choose the customers they are willing work with is not only wrong, it's causes harm[2]. [1] https://www.eff.org/press/releases/international-coalition-rights-groups-call-internet-infrastructure-providers-avoid https://www.eff.org/press/releases/international-coalition-r... [2] https://blog.cloudflare.com/kiwifarms-blocked/ https://blog.cloudflare.com/kiwifarms-blocked/

cortesoft 3y ago

I agree with most of this, but one nit pick: > Originally, secure computing relied on a second processor - a "Technical Protection Module" or TPM - to monitor the parts of your computer you directly interact with. TPM stands for Trusted Platform Module, not Technical Protection Module

benatkin 3y ago
That's wild. It seems these blog posts are outsourced. Edit: I'm wrong about this one. It's an actual article, and a pretty good one at that. But it is either a mistake or they are introducing an alternate expansion for TPM (other acronyms have been given different sets of words).
- hvis 3y ago
  They don't have to be outsourced to this to happen. To put out lengthy press-releases, you hire a copywriter. You don't ask an engineer to write them. People make mistakes sometimes. And this one is not a huge one -- the meaning is conveyed fine.
  - JohnFen 3y ago
    I've also seen that exact incorrect explanation of what "TPM" stands for in several other places now. I'm guessing that someone authoritative made the error and now it's being propagated by people who aren't otherwise familiar with the terminology.
    - benatkin 3y ago
      Google/Bing say otherwise, at least when it comes to the exact pharase "Technical Protection Module".
- oaktrout 3y ago
  Or written with help from chat gtp, I've seen it hallucinate similar mistakes before.

tapoxi 3y ago

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implement in Chrome, it just moves the problem elsewhere. The fight was implementing TPM in the first place.

shadowgovt 3y ago
You are correct, and that is fine. If the ecosystem becomes "You control your browser but not the apps on your mobile device," that's pretty much the status quo.
bayindirh 3y ago
The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can and will be abused to lock any tech savvy person from daily internet based on arbitrary rules. There are no checks and balances. This is a very broad set of capabilities which is forced upon users. This is no proposal, or experiment. It's a force-push attempt.
- judge2020 3y ago
  There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#open-questions https://github.com/RupertBenWiser/Web-Environment-Integrity/...
  - bayindirh 3y ago
    I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys. Mathematics & cryptography doesn't work like that. It doesn't discriminate. It levels everyone. It'll either become an iron fist or a Swiss Cheese. There can be no middle. This is maths.

no_wizard 3y ago

EDIT: Originally posited an incorrect fact here. I completely missed who wrote the article at hand (not sure why, but I didn't see the authors names) Good catch everyone

hgomersall 3y ago
I'm puzzled by your comment. This is literally the article by him....
- no_wizard 3y ago
  I completely missed it, edited in kind. thanks!

ceroxylon 3y ago

Would it be possible for attackers/fraudsters to just set up "proxy farms" of real hardware that provide the device details for attestation? It would make bots less efficient but surely the incentive for ad fraud would still exist and adaptations would be made.

alexpotato 3y ago
This comment made me think of the videos of scammers with racks upon racks of cheap cell phones. They are all legitimate phones and labor is cheap so it's easier to just do that rather than try to create script to click on ads etc.
tornato7 3y ago
Yes, but in theory if suspicious behavior was detected those devices could be permanently blacklisted from a website, making the investment challenging. If WEI goes through we'll probably see cheap PCs popping up on eBay that are unable to access certain websites.
- yomlica8 3y ago
  You thought having your google account banned was bad now, wait until they ban all associated hardware with a heuristic routine and most of the web doesn't work for you anymore. That should really cut down on the account support requests they didn't want to deal with.
  - deleted 3y ago
    [deleted]

endisneigh 3y ago

I read the entire thing and it’s not clear how this reduces control of your own computer. It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong. > It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI). This, however, is true for sure. At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional. Those who implement it are those who are not interested in an “open web” to begin with and definitionally were never going to support it anyways.

zuminator 3y ago
It reduces control of my computer because without it my computer can identify itself to websites and advertisers in the way that I want, but with it, it can only use its TPM assigned identity. You can argue (I'd disagree) that it's a good thing that I can't make my computer spoof as something else, but unquestionably it does reduce my control.
- endisneigh 3y ago
  This is wrong though. Wei doesn’t stop your ability to spoof, it stops your ability to be successful in spoofing.
- wilsonnb3 3y ago
  > unquestionably it does reduce my control It doesn't reduce your control, you are still welcome to identify your computer however you want to websites by using a browser without WEI or disabling it. You will just have to live with the reality that a lot of servers aren't going to want to talk to your client.
  - wpietri 3y ago
    Their point is that a browser with WEI reduces your control versus a browser without WEI. I would agree with them that it's definitional.

2OEH8eoCRo0 3y ago

What is to stop me from virtualizing a TPM?

liamkearney 3y ago
Your poorly drawn signature.
chupasaurus 3y ago
Google Cloud does it. [0] [0] https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#vtpm https://cloud.google.com/compute/shielded-vm/docs/shielded-v...
wmf 3y ago
Your vTPM doesn't have a certificate from any respected authority.
- 2OEH8eoCRo0 3y ago
  Yeah, and there is no (easy) way to extract the root cert from your own real TPM either.

LunicLynx 3y ago

Here is an idea: If WEI is available use it to block chrome otherwise allow access disregarding WEI. XD

hot_gril 3y ago
I used to have a little website in middle school that banned Chrome by user agent, cause even back then (2008) I said it was evil.
hot_gril 3y ago
Ok but seriously, this might be the only way to combat WEI. Don't even preach to the user about the evils of WEI (ain't nobody gonna read that wall of text), just say it is not supported and tell them succinctly how to turn it off / get a different browser.
- seabass-labrax 3y ago
  I agree; this may well be an effective last-resort action if Google Chrome does implement Google's WEI proposal. However, I sincerely hope that it won't come to that, because it's not a foregone conclusion that Chrome wouldn't win :(

uwagar 3y ago

such an irony that WEI seeks to impose the tyranny of the "giants of flesh and steel" into cyberspace.

barbariangrunge 3y ago
Very poetic. Once can imagine a cyberpunk plotline around that idea

nologic01 3y ago

> A handful of companies have established chokepoints between buyers and sellers, performers and audiences, workers and employers, as well as families and communities. When those companies refuse to deal with you, your digital life grinds to a halt This short paragraph summarizes the (ex-ante) improbably unusual situation we have drifted into. The negatively affected stakeholders being enumerated are more or less the entire society. These gatekeepers and chokepoint operators do have a few natural allies (the captured politicos, others in direct or indirect payroll, externality-blind markets). Yet somehow they can bully into submission basically the entire universe. With its infinite financial, political, intellectual resources. Rather strange dont you think? It almost as if they already operate effective mind control at systemic scale.

HPsquared 3y ago
See also the history of railroads and telecoms.
- version_five 3y ago
  Also every industry in Canada
  - mig39 3y ago
    The solution in Canada is to break up some of these huge companies. The free market can solve things, but only if there's a free market. When you have 1 or 2 companies, there's no competition.
    - WarOnPrivacy 3y ago
      > The solution in Canada is to break up some of these huge companies. The free market can solve things, but only if there's a free market. I'm not familiar with Canada but this sounds like oversight there is similar to how the US DoJ operates - which is to say it has a long history of rubberstamping (massive, competition-killing) mergers
    - 3y ago

charcircuit 3y ago

>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy. WEI doesn't stop you from changing your user agent, nor does it prevent you from using your privacy web extentions. >But, despite their valiant attempts to cast these benefits as accruing to device owners, these are really designed to benefit the owners of commercial services; the benefit to users comes from the assumption that commercial operators will use the additional profits from remote attestation to make their services better for their users. End users are not the only stake holders in the web. I would say most changes to the web are for people who develop sites and end users benefit from sites using those features. >Putting handcuffs on every shopper who enters a store would doubtless reduce shoplifting, and stores with less shoplifting might lower their prices, benefitting all of their customers. But ultimately, shoplifting is the store’s problem, not the shoppers’, and it’s not fair for the store to make everyone else bear the cost of resolving its difficulties. This metaphor isn't the same since WEI is transparent to users. Physical handcuffs would be very intrusive, but that isn't what is happening here. Shop lifting affects the profitablity of the store. A better metaphor would be a bouncer for a club. Technically a club could have a set of rules of entering and customers could promise that they follow them. Unfortunately, people lie and just trusting them isn't good enough so clubs end up adding bouncers even though they don't directly make the experience for customers better. >The problem is, there are lots of websites that would really, really like the power to dictate what browser and operating system people can use This claim needs a citation of where user agent based blocking isn't enough. People spoofing their user agent won't make much of a difference to support costs of the site. >The web is the last major open platform left on the internet - the last platform where anyone can make a browser or a website and participate, without having to ask permission or meet someone else’s specifications. WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser. >We sympathize with businesses whose revenues might be impacted by ad-fraud, game companies that struggle with cheaters, and services that struggle with bots. But addressing these problems can’t come before the right of technology users to choose how their computers work, or what those computers tell others about them, because the right to control one’s own devices is a building block of all civil rights in the digital world.. To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy. If EFF cares no much about privacy on the web they should be in favor of this proposal. I disagree that beivg a to lie about what your device is running in a building block of all civil rights because the physical analog, fraud, is illegal, and the world seems better without people commuting fraud to one another.

freedomben 3y ago

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chomping at the bit to implement WEI because they hate the open web or they hate Linux users. They'll be chomping at the bit because if they don't it will be a liability, and a "you're not doing all you can for security" type of risk that can open them to lawsuits, regulatory punishments, and even higher insurance costs. WEI is not a requirement right now because it doesn't exist. Once it exists though, you can be sure it will become a standard practice requirement, and anyone arguing against it might as well be arguing that using CC cameras is a privacy invasion: they'll seem absurd and won't last long in that position. In short order it will be implemented by all the CDNs like Cloudflare, and it will be a simple checkbox for site owners to add to their site. Failure to implement this would be a fiduciary disaster, so they will have no choice. Once that is there, nobody who cares at all about security for their site (which is pretty much all people) are going to uncheck that box.

JohnFen 3y ago
> Once it exists though, you can be sure it will become a standard practice requirement Yes, this seems inevitable. At which point, I will no longer be using the bank's website. > they'll seem absurd and won't last long in that position. I'm not sure what you mean here, though. People who object to ubiquitous surveillance don't seem absurd to most (even those who aren't so upset about it), and they certainly aren't changing their position.
- freedomben 3y ago
  Hey John, I love that we are in the same threads on HN so much :-D > I'm not sure what you mean here, though. People who object to ubiquitous surveillance don't seem absurd to most (even those who aren't so upset about it), and they certainly aren't changing their position. Yeah good question/clarification, I'm referring to the CCTV cameras in the bank itself (such as in the vault, in the lobby, etc).

seabass-labrax 3y ago

This is one of the most detailed and balanced articles I have read so far on the topic. However, like every other one I've read, it omits one very important clarification about 'Web Environment Integrity': It is not part of the Web. This is exclusively a Google draft for a Google Chrome feature, and whilst Google is a member of the World Wide Web Consortium (W3C), they are not doing this as a member. I don't believe such a proposal would get even as far as a working group charter, given how limited it is to Google's interests. The only reason that it's a threat to the Web is because of their overwhelming market dominance, which is approaching a monopoly already. I fear that the prominent use of the term 'Web' in this kind of document is tarnishing the reputation of the W3C, who have a solid process[1] to avoid pursuing these short term interests when they come with the risk of long term damage to the openness of the Web. [1]: https://www.w3.org/Consortium/Process/ https://www.w3.org/Consortium/Process/

NoGravitas 3y ago
Web standards today aren't made by the W3C; they're made by WhatWG, which is Google, Apple, and Mozilla, but mostly Google.
- seabass-labrax 3y ago
  Some historical context: WHATWG[1], the Web Hypertext Application Technology Working Group, was originally a spin-off of the W3C[2], and was an organisation formed in 2004 by W3C members unhappy with decisions made in the W3C at that time. In 2019, a 'Memorandum of Understanding' was signed[3] agreeing to various principles for coordination between the two organisations. The W3C is still very much active, and produces the vast majority of specifications that are implemented by 'web browsers' (in the general sense) like Chrome, Firefox and Safari, and they have their own standardisation process which is comparable in quality to organisations like ISO. The area in which WHATWG are most active, though, is HTML, for which they produce what they call 'Living Standards' that have a different process from W3C's. CSS is done inside the W3C, and JavaScript is formalised by ECMA, an entirely different organisation still. [1]: https://whatwg.org/ https://whatwg.org/ [2]: https://www.w3.org/ https://www.w3.org/ [3]: https://www.w3.org/2019/04/WHATWG-W3C-MOU.html https://www.w3.org/2019/04/WHATWG-W3C-MOU.html [4]: https://www.ecma-international.org https://www.ecma-international.org

Brian_K_White 3y ago

WEI is a bit like the the old phone system where you were not allowed to own your own phone and connect it to the network. Eventually the government decreed that illegal.

Avamander 3y ago
This is the most likely path we'll take, I suspect.
- Brian_K_White 3y ago
  Telephones came about gradually, but say the kind of phone and system roughly like a modern pots line, served up by Bell, started around 1930. Breakup of ma bell (roughly the same time you were allowed to own a phone) 1984 And even today I can't buy or connect an ONT of my own to the new fiber that Optimum installed a few weeks ago to replace my coax cable and cable modem that I did own (but did not fully control thanks to docsis), somehow. I am not actually hopeful.

amadeuspagel 3y ago

Have these people heard of the iPhone? It came out in 2007. That's 16 years ago. It was never controlled by its users, and that enabled many apps and features, like disappearing messages, that are impossible on devices that are controlled by their users. I think after 16 years it's time to admit that this model is here to stay, and the only question is whether the web supports it, or whether there will be certain apps and features that will never be available on the web.

xbruteforce 3y ago

> Google is adding code to Chrome that will send tamper-proof information about your operating system and other software, and share it with websites. Google says this will reduce ad fraud. Is it only to "reduce ad fraud" though, or the wider agenda is deeper entangle their tracking in one's life.

glimshe 3y ago

Why do I care about reducing Google's ad fraud and helping Google's ad business? This is their problem and should never involve relaying my personal computer's information to third party so Google can make more money.

rogual 3y ago

Because I, for now, have the ability to make my computer say what I tell it to say, I have developed a small Firefox extension [1] that tells it what to say. Silly? Yeah. Petty? Yeah. But sometimes it feels good to exercise your rights. [1] https://github.com/rogual/wei-gfy https://github.com/rogual/wei-gfy

calibas 3y ago

I'm curious as to why this is being flagged/downvoted. Seems like somebody doesn't want it on the front page of HN...

bevdecloud 3y ago

Not gonna lie this title "Had me"

1vuio0pswjnm7 3y ago

Maybe the internet ad the web specifically just wasn't designed to support a "business" like Google's. All data collection and advertising service. Paying enormous fines to regulators. Maybe it was not designed for this.

ColdElectron 3y ago

So, what can we actually do about this? The EFF doesn't mention anyone we can talk to. Are we all just waiting around for Google to do it or is there something we can do to raise awareness or campaign against google?