11 ms·

Web Environment Integrity has no standing at W3C; understanding new W3C work

234 points by TangerineDream 3y ago

candiddevmike 3y ago
The browsers keep circumventing them, so the W3C seems more ceremonial than a real standards body. In an ideal world something like the W3C would own Chromium, but alas...
- throw_m239339 3y ago
  That's symbolic but important. I wish the W3C had the same resolve with EME.
- hanniabu 3y ago
  It'd be nice if there were a consortium of organizations that maintained a fork of Chromium, such as W3C, Brave, Edge, Opera, Vivaldi
  - __MatrixMan__ 3y ago
    A suite of tests might be better: point them at a candidate browser and they'll tell you which naughty and which nice features that browser supports. Then point the other half of the test suite at a candidate site and get a similar list of naughies and nices. Conscientious technologists of the world can then refuse to support browsers or sites that test naughty. This is my attempt to avoid preaching to the choir. Market share wise, only a tiny slice would opt into the non-evil browser. But it's that slice who also makes things work for the rest of the world, so: > it's out of my scope of support unless it passes these tests Might impact a wider audience.
    - jefftk 3y ago
      > A suite of tests might be better: point them at a candidate browser and they'll tell you which naughty and which nice features that browser supports. Perhaps we could have a suite of Web Platform Tests? And we could host them at https://wpt.fyi https://wpt.fyi ?
      - __MatrixMan__ 3y ago
        Yeah, something like that. If Google adds WEI to chromium, will wpt.fyi flag it as broken?
        jefftk 3y ago
        I was being a bit silly; wpt.fyi doesn't do the naughty/nice thing. If the WEI proposal keeps progressing towards a standard I'd expect that team to submit a test to WPT, yes.
  - paulmd 3y ago
    As long as google gets to use its monopoly to push chrome-by-default on its platforms while breaking open safari, none of that matters. The council of neckbeards representing 2% of browser share is as relevant as polling slashdot opinions, in terms of actual effected change on the world. When those neckbeards represent 50-60% of total web traffic their opinion might matter. Marketshare is power and in realpolitik power is all that matters. The tech world is littered with the remains of the companies that made principled stands, google and Microsoft are where they are for a reason and it’s not because of their overriding morals. Right now google has >80% of traffic and now that they have pried safari open that number is gonna climb. Their opinion is literally the only one that matters - what are you gonna do, not use google products? if google wants to fight they’ll win, have fun getting into your gmail account if they require attestation. What are you gonna do, not use email? Change your whole internet identity to not run on google? Gmail is effectively email, and small mailservers are fundamentally broken on the modern web. Even for things like outlook.com they could require that other mailservers provide the attestation used to send it and lock people out of gmail entirely, even just needing to gmail. It’s game over, the apple sideloading case swept away the last resistance to chrome monoculture, and google already runs a supermajority of the other web services that matter. This is google flexing their muscles now that they know they’re utterly unopposed. But unfortunately the EU is way more concerned with outlawing the lightning port and mandating 2000s-vintage removable battery phone designs than actually fighting a monopoly using its monopoly power to leverage abusive behavior in related market segments to the detriment of consumers. This is a classic useful-idiot situation where all the android fanboys waved their flags at their “team win” over “braindead” apple fans getting the app-review process neutered by sideloading. Because it’s not enough to have a popular brand which supports that too, you need to outlaw any alternative business models to your preferred brand. And despite warnings that exactly this chrome monoculture would be the outcome, people pushed for it anyway. Wait and see, they said, we’ll cross that bridge when we come to it and if google starts to be a problem the EU will step in. It took literally a matter of weeks before google just went ahead and crossed that bridge. Extremely frustrating. And yea, safari has some attestation features too. Not necessarily the same ones as google, and they don’t prevent Wipr or Adblock Plus extensions from working. But now you’ve gone and made sure there’s no alternative browsers that don’t, either. You pushed this on yourself. sideloading has locked in an unshakeable chrome monopoly marketshare, it’s going to be a massive uphill battle to sell people on Firefox when it doesn’t even work on almost any relevant web services because it doesn’t (by design) allow attestation. Almost as if... most of Apple's iOS stances aren't just random/exploitative, but actually have some basis in security posture or app-review. And almost as if... Apple is still fundamentally trying to sell you a phone first and foremost, then icloud/apple music revenue, and then adtech is way down on the list, while google makes all its money from (a) ecosystem effect and the monopolistic behaviors it allows, and (b) direct revenue from adtech. People keep trying to push the "apple is the same thing!" and just like you can see from their attestation not caring about adblocking, it's really not. I loathe that the brand wars have gotten to this place, "both sides are the same" but also they are different enough that you need to literally outlaw the business model of your competition and reduce choice in the market. Can't let some "brainless" apple fan make a different choice from you, you know best for everyone.
- notatoad 3y ago
  the W3C's role has been explicitly and intentionally ceremonial since they tried to invent xhtml, and learned exactly how much power they really have. their mission is only to write formal standards to describe and document the things that browsers have already implemented, not to drive browser development.
t3rabytes 3y ago
At this point I don't think it matters -- if Google wants to do it, they'll do it. :/
- wkat4242 3y ago
  Well, outcry does help. It did manage to nip FLoC in the bud.
  - ocdtrekkie 3y ago
    Not really, it just got rebranded as the Topics API and is still, as far as I know, being pushed into Chrome.
    - krono 3y ago
      Eternal vigilance is the price of liberty.
    - nerdponx 3y ago
      I just got a topics intro popup on my work computer the other day. One of many many other reasons I'm happy I use Firefox at home.
    - wkat4242 3y ago
      I don't really agree. Topics are materially different from FLoC. Especially in the way of moving it from a shady background activity into something the user can interact with. Also, nobody really gives a shit about it. WEI could break adblockers and that would be a huge issue.
- DaiPlusPlus 3y ago
  And Google wanted WebM to happen and for people to pay full-retail price for rented games. Google isn't (yet) big enough to force it through: given iOS marketshare in the US it means web-app devs won't (can't?) do anything unless both Apple and Google adopt it (yes, there are plenty of Chrome-only websites, and Safari has been slow to adopt new web-standards, especially when they begin to tread on the toes of Apple's App Store (PWAs, WebUSB, etc). ---- That said, I am sympathetic to the reasons why orgs like banks want things like remote-device attestation (and am less sympathetic to the likes of the MPAA, etc) - it is unfortunate that better ideas are hard to come by.
koromak 3y ago
Take a stance at least
- ramesh31 3y ago
  > Take a stance at least A stance to irrelevance, sadly. This was always the deal with the devil that W3C had; play ball with the vendors or get left in the dust.
deleted 3y ago
[deleted]
bryanlarsen 3y ago
w3c is completely irrelevant. https://whatwg.org/ https://whatwg.org/ is the functional keeper of the standard.
- Eduard 3y ago
  https://news.ycombinator.com/context?id=36882166 https://news.ycombinator.com/context?id=36882166 W3C is not only about HTML, JavaScript, and CSS. https://en.m.wikipedia.org/wiki/World_Wide_Web_Consortium#Standards https://en.m.wikipedia.org/wiki/World_Wide_Web_Consortium#St... E.g., I don't see WHATWG contributing anything of relevance regarding web accessibility, whereas W3C takes care of accessibility with WAI-ARIA and WCAG.
- tw061023 3y ago
  My understanding is that WHATWG doesn't govern standards at all - it basically documents what browsers are doing at the moment. So when Google rolls WEI in a Chrome update, it will become a WHATWG "standard" automatically. Is that correct?
  - notatoad 3y ago
    no, to become a standard at least one other browser vendor would have to at least signal an intent to implement it.
    - troupo 3y ago
      No. To actually become a standard it needs at least two inependent implementations. But it's interesting that you wrote what you wrote. Because that's exactly what Chrome is doing: it's announcing an intent to implement, and then enables whatever they intend by default. Oh, they do pretend to ask other vendors about their position, but ship anyway. And then use web.dev to pretend it's a standard.
- seabass-labrax 3y ago
  The W3C is relevant in multiple critical areas of the Web. Just to name a few topics where W3C is the primary venue for all standardisation efforts: - Accessibility - Authentication - CSS - Self-Sovereign Identity - Virtual Reality - Linked Data - XML I wrote a comment about the W3C's relationship with WHATWG a few days ago: https://news.ycombinator.com/item?id=37052428 https://news.ycombinator.com/item?id=37052428 If you do nothing else, please pass your eyes over the list of W3C Recommendations and other publications on standards track: https://www.w3.org/TR/ https://www.w3.org/TR/
deleted 3y ago
[deleted]
InTheArena 3y ago
I'd believe this- if it were not for the fact that Google is ignoring the W3C across the board. This includes privacy sandbox (fledge) and topics (floc) as well. Google can come up with good reasons why something that has negative impacts on the entirety of the ecosystem (except them), because it always ends with Google in a stronger position
- tptacek 3y ago
  What's there to believe? Standards follow implementations. The W3C aren't the browser police; they just standardize the interoperable things browsers do. It's not W3C's (or WhatWG's) role to "oppose" random things browser vendors decide to do.
  - colordrops 3y ago
    Maybe it should be their role. Arguably, things like browser standards are as important to society as electrical or network standards.
    - Analemma_ 3y ago
      Maybe, but it's a moot point, because there's no way to get from here to there. If the browser vendors want to add a standard, they will; and if they don't, they won't. On one or two prior occasions the W3C has proposed something that the browser makers didn't like, they unanimously told the W3C to go pound sand, and that was the end of it.
    - Semaphor 3y ago
      But then you’d also need a world police who enforces that.
      - colordrops 3y ago
        Who enforces electrical and network standards? Those don't require world police.
anotherhue 3y ago
This matters about as much as the US defying the UN. Chrome needs to be spun out.
- troyvit 3y ago
  Heh, yeah or the UN defying anybody who is a member of their own security council.
  - dragonwriter 3y ago
    Considers who was on the other side of the military conflict in which the first, only, and still active UN military command was involved as a direct party and... Not sure I understand your point.
    - HideousKojima 3y ago
      China at the time referred to the Republic of China, i.e. Taiwan. And the USSR's delegation to the UN was boycotting the UNSC entirely (and immediately began using their power to prevent any further UNSC resolutions regarding Korea being passed as soon as they stopped boycotting).
- nerdponx 3y ago
  Has there ever been an anti-trust suit on the grounds that an actor is using their market dominance to subvert a standards process/body? Is there any legal precedent or standing for such a thing in the US or elsewhere?
  - TheAceOfHearts 3y ago
    I don't think web standards work that way. Often times we'll see things get deployed and implemented before they become standards anyway. And it's not as if W3C has any authority. But even if W3C had any authority, Google and Apple would just pay off every seat.
  - anonymousiam 3y ago
mkl95 3y ago
So? Since W3C approved DRM, any self respecting user should struggle to take them seriously.
- yjftsjthsd-h 3y ago
  Surely it's the other way: an organization that approved DRM pumping the brakes implies that the thing in question is remarkably bad
nilshauk 3y ago
Ok so Google ignores W3C on WEI. But could someone else create a W3C proposal that could counteract WEI? It wouldn't have to implementation-specific but rather one or more principles drawing a line in the sand that shouldn't be crossed like what WEI is built to achieve?
- ISV_Damocles 3y ago
  Not with a "White Hat" on, I think. If a user who is not you uses a browser using WEI (implicitly approving of this attestation tech) and connects to a website that uses WEI, that's entirely up to third-parties and there's nothing legal that you can do. The most you can do is protest this with: 1. Using a browser without WEI or with WEI disabled. 2. Modifying your own site to talk the WEI protocol but for any browser that can talk that protocol, you ban the user from using your site (or redirect them to a site explaining how WEI is DRM of the entire internet, etc) Moving beyond White Hat to Grey Hat and Black Hat, you get things like: 1. Modifying your own hosting company to apply this WEI-blacklisting mechanism to your clients' websites. 2. Convincing (or "convincing") owners of core backend libraries in popular programming languages to introspect connections and blacklist WEI-compatible browsers. 3. Take advantage of XSS vulnerabilities to interfere with WEI operations on other tabs within the same browser on the user's machine if they happen to be using your website. 4. Take advantage of vulnerabilities in the WEI protocol to corrupt the underlying attestation system so it fails to function in all future WEI requests for that physical machine. 5. Hack/Crack attestation system security and publicly release the keys, making any hardware using that version suspicious/blacklisted by users of WEI. 6. Probably some other things I haven't thought of, but as you can see they quickly go from dubiously legal to straight-up illegal. It would be best to nip WEI in the bud before such measures are deemed necessary.
thatcherthorn 3y ago
WEI would be super valuable if it was targeted at corporate network infrastructure. In those situations, enterprises have the jurisdiction and need to know who is connecting to their network. Putting a technology like this into a browser seems to only benefit sites that monetize their content...
seabass-labrax 3y ago
If you like what the W3C is doing for the privacy, accessibility and openness of the Web, you can become a W3C participant. Upon finding a W3C Working Group[1] to which you think you could contribute, you can send an email to the address of that WG's 'Staff Contact' explaining how you think you could help. If the Chairs and the Staff Contact agree, they will ask you to join as an 'Invited Expert' (IE). This does not confer voting rights but grants you access to the meetings, relevant Git repositories etc. You'll need to sign a licensing agreement allowing the W3C to freely publish your contributions. I say this because, at first glance, it seems like the only stakeholders with any influence are W3C Members. The reality is that W3C is very open to contributions from individuals, but just has had a constitutional framework that makes things slightly more complicated for individuals, a situation which they are deliberately improving. As for myself, I'm an IE for the W3C in the Linked Data area, so whilst of course I do not speak for the W3C, I would be more than happy to answer questions here on HN about how the W3C works. [1]: https://www.w3.org/groups/wg/ https://www.w3.org/groups/wg/
- EGreg 3y ago
  Back in 2014 I met with Tim Berners-Lee himself, and his SoLiD team, and proposed to join forces. Here is the pic: https://lh5.googleusercontent.com/Rp4Su5Z2h28vCASKfrbhYKrULGDP506umz_va7RsF3DssL5NJBBAkdVo5GVeSNmhtIOB-q9ucKEylklc_gJo-JPZzpydaktpH3rsfZYKf-wgpJ561A5NqwJIDCwffnhyfHbAW34b https://lh5.googleusercontent.com/Rp4Su5Z2h28vCASKfrbhYKrULG... His team lead (Dmitry Zagidulin) liked what we were doing a lot. But ultimately Tim chose to go in a different direction, spun off "Inrupt" and left MIT. We continued building our open source platform to try to realize the vision he keeps writing about: https://theconversation.com/tim-berners-lees-plan-to-save-the-internet-give-us-back-control-of-our-data-154130 https://theconversation.com/tim-berners-lees-plan-to-save-th... I was writing very similar things, but of course I didn't invent the Web: https://cointelegraph.com/news/how-a-web-that-lost-its-way-can-find-a-new-one https://cointelegraph.com/news/how-a-web-that-lost-its-way-c... Ultimately, my point is that we tried our best. I even hired Dmitry when he left Tim's project for a while, but very quickly Dmitry got demotivated to work with us because we were putting out working code for customers, instead of conforming to standards. Back then I argued to him that we don't have a ton of funding and executions matters more, after which the winners can help spearhead the standards. After all, Twitter pioneered oAuth, and Meebo+Google pioneered xAuth (if anyone remembers that). Dmitri and I did. So we went our separate ways, and I realized that standards are an expensive detour that can work if you have extra funds to hire people. We plan to support Matrix, Mastodon and other interoperability. But for the time being, our platform is "just" free and open source. Whether it's the UBI "movement", or the decentralized web, or other initiatives, everyone seems to go their separate way and it fizzles out (e.g. https://decentralizedweb.net https://decentralizedweb.net and https://indieweb.org/ https://indieweb.org/). I wish people were willing to join forces on projects more, and get each other funded. That's how we can build real open source alternatives to the corporate internet we are all forced to depend on.
tiffanyh 3y ago
Does the W3C have any influence anymore? I thought it lost some of it's influence, but can't recall why.
- seabass-labrax 3y ago
  The W3C took a hit to it's influence in the early 2000s after their introduction of RDF (Resource Description Framework), the technology behind Linked Data and XHTML. Whilst technically superior and philosophically more elegant than the raw HTML they sought to enhance (note that HTML5 hadn't been invented at this point), it was not immediately very popular - the concept of Linked Data was somewhat harder to understand than the concept of markup, and getting it wrong would mean your website might fail to display. This lead to the creation of WHATWG, which holds sway over HTML5 and some miscellaneous JavaScript browser APIs, but still a very limited set of Web features compared to the W3C, which standardises lots of areas including CSS. I would say that it was a pretty minor loss of influence overall, and their Linked Data is now used in almost all websites in at least a basic metadata capacity, which is how those 'social links' work (where you paste a URL in a chatroom or social network and find the title, logo and header picture appear automatically) for instance. More extensive use of Linked Data is often not directly visible to website visitors, but will soon form the foundation of a number of digital identity card systems, even for entire countries, and will do so in a way which has the potential to be significantly more privacy-friendly than a traditional 'citizen number' approach. I'm currently a participant in the Linked Data area of W3C's work, but I wasn't around during the events I describe above. Resilient Web Design[1], a short but excellent ebook by Jeremy Keith is a good read for understanding why RDF didn't catch on initially, and anything by Manu Sporny will be worth reading/watching for getting a positive description of how useful RDF and Linked Data can be (his introduction video to the topic, for instance[2]). [1]: https://resilientwebdesign.com/introduction/ https://resilientwebdesign.com/introduction/ [2]: https://www.youtube.com/watch?v=4x_xzT5eF5Q https://www.youtube.com/watch?v=4x_xzT5eF5Q
1letterunixname 3y ago
Vote with your eyes: switch browsers. Firefox/TorBrowser, Brave, or Safari.
- lujz 3y ago
  Ladybird
  - 1letterunixname 3y ago
    And I'll raise you a Lynx.. in development since 1992. :] https://web.archive.org/web/20041204114715/http://www.cc.ukans.edu/~grobe/early-lynx.html https://web.archive.org/web/20041204114715/http://www.cc.uka...
- ranguna 3y ago
  Librewolf as well

The browsers keep circumventing them, so the W3C seems more ceremonial than a real standards body. In an ideal world something like the W3C would own Chromium, but alas...

throw_m239339 3y ago
That's symbolic but important. I wish the W3C had the same resolve with EME.
hanniabu 3y ago
It'd be nice if there were a consortium of organizations that maintained a fork of Chromium, such as W3C, Brave, Edge, Opera, Vivaldi
- __MatrixMan__ 3y ago
  A suite of tests might be better: point them at a candidate browser and they'll tell you which naughty and which nice features that browser supports. Then point the other half of the test suite at a candidate site and get a similar list of naughies and nices. Conscientious technologists of the world can then refuse to support browsers or sites that test naughty. This is my attempt to avoid preaching to the choir. Market share wise, only a tiny slice would opt into the non-evil browser. But it's that slice who also makes things work for the rest of the world, so: > it's out of my scope of support unless it passes these tests Might impact a wider audience.
  - jefftk 3y ago
    > A suite of tests might be better: point them at a candidate browser and they'll tell you which naughty and which nice features that browser supports. Perhaps we could have a suite of Web Platform Tests? And we could host them at https://wpt.fyi https://wpt.fyi ?
    - __MatrixMan__ 3y ago
      Yeah, something like that. If Google adds WEI to chromium, will wpt.fyi flag it as broken?
      - jefftk 3y ago
        I was being a bit silly; wpt.fyi doesn't do the naughty/nice thing. If the WEI proposal keeps progressing towards a standard I'd expect that team to submit a test to WPT, yes.
- paulmd 3y ago
  As long as google gets to use its monopoly to push chrome-by-default on its platforms while breaking open safari, none of that matters. The council of neckbeards representing 2% of browser share is as relevant as polling slashdot opinions, in terms of actual effected change on the world. When those neckbeards represent 50-60% of total web traffic their opinion might matter. Marketshare is power and in realpolitik power is all that matters. The tech world is littered with the remains of the companies that made principled stands, google and Microsoft are where they are for a reason and it’s not because of their overriding morals. Right now google has >80% of traffic and now that they have pried safari open that number is gonna climb. Their opinion is literally the only one that matters - what are you gonna do, not use google products? if google wants to fight they’ll win, have fun getting into your gmail account if they require attestation. What are you gonna do, not use email? Change your whole internet identity to not run on google? Gmail is effectively email, and small mailservers are fundamentally broken on the modern web. Even for things like outlook.com they could require that other mailservers provide the attestation used to send it and lock people out of gmail entirely, even just needing to gmail. It’s game over, the apple sideloading case swept away the last resistance to chrome monoculture, and google already runs a supermajority of the other web services that matter. This is google flexing their muscles now that they know they’re utterly unopposed. But unfortunately the EU is way more concerned with outlawing the lightning port and mandating 2000s-vintage removable battery phone designs than actually fighting a monopoly using its monopoly power to leverage abusive behavior in related market segments to the detriment of consumers. This is a classic useful-idiot situation where all the android fanboys waved their flags at their “team win” over “braindead” apple fans getting the app-review process neutered by sideloading. Because it’s not enough to have a popular brand which supports that too, you need to outlaw any alternative business models to your preferred brand. And despite warnings that exactly this chrome monoculture would be the outcome, people pushed for it anyway. Wait and see, they said, we’ll cross that bridge when we come to it and if google starts to be a problem the EU will step in. It took literally a matter of weeks before google just went ahead and crossed that bridge. Extremely frustrating. And yea, safari has some attestation features too. Not necessarily the same ones as google, and they don’t prevent Wipr or Adblock Plus extensions from working. But now you’ve gone and made sure there’s no alternative browsers that don’t, either. You pushed this on yourself. sideloading has locked in an unshakeable chrome monopoly marketshare, it’s going to be a massive uphill battle to sell people on Firefox when it doesn’t even work on almost any relevant web services because it doesn’t (by design) allow attestation. Almost as if... most of Apple's iOS stances aren't just random/exploitative, but actually have some basis in security posture or app-review. And almost as if... Apple is still fundamentally trying to sell you a phone first and foremost, then icloud/apple music revenue, and then adtech is way down on the list, while google makes all its money from (a) ecosystem effect and the monopolistic behaviors it allows, and (b) direct revenue from adtech. People keep trying to push the "apple is the same thing!" and just like you can see from their attestation not caring about adblocking, it's really not. I loathe that the brand wars have gotten to this place, "both sides are the same" but also they are different enough that you need to literally outlaw the business model of your competition and reduce choice in the market. Can't let some "brainless" apple fan make a different choice from you, you know best for everyone.
notatoad 3y ago
the W3C's role has been explicitly and intentionally ceremonial since they tried to invent xhtml, and learned exactly how much power they really have. their mission is only to write formal standards to describe and document the things that browsers have already implemented, not to drive browser development.

t3rabytes 3y ago

At this point I don't think it matters -- if Google wants to do it, they'll do it. :/

wkat4242 3y ago
Well, outcry does help. It did manage to nip FLoC in the bud.
- ocdtrekkie 3y ago
  Not really, it just got rebranded as the Topics API and is still, as far as I know, being pushed into Chrome.
  - krono 3y ago
    Eternal vigilance is the price of liberty.
  - nerdponx 3y ago
    I just got a topics intro popup on my work computer the other day. One of many many other reasons I'm happy I use Firefox at home.
  - wkat4242 3y ago
    I don't really agree. Topics are materially different from FLoC. Especially in the way of moving it from a shady background activity into something the user can interact with. Also, nobody really gives a shit about it. WEI could break adblockers and that would be a huge issue.
DaiPlusPlus 3y ago
And Google wanted WebM to happen and for people to pay full-retail price for rented games. Google isn't (yet) big enough to force it through: given iOS marketshare in the US it means web-app devs won't (can't?) do anything unless both Apple and Google adopt it (yes, there are plenty of Chrome-only websites, and Safari has been slow to adopt new web-standards, especially when they begin to tread on the toes of Apple's App Store (PWAs, WebUSB, etc). ---- That said, I am sympathetic to the reasons why orgs like banks want things like remote-device attestation (and am less sympathetic to the likes of the MPAA, etc) - it is unfortunate that better ideas are hard to come by.

koromak 3y ago

Take a stance at least

ramesh31 3y ago
> Take a stance at least A stance to irrelevance, sadly. This was always the deal with the devil that W3C had; play ball with the vendors or get left in the dust.

deleted 3y ago

[deleted]

bryanlarsen 3y ago

w3c is completely irrelevant. https://whatwg.org/ https://whatwg.org/ is the functional keeper of the standard.

Eduard 3y ago
https://news.ycombinator.com/context?id=36882166 https://news.ycombinator.com/context?id=36882166 W3C is not only about HTML, JavaScript, and CSS. https://en.m.wikipedia.org/wiki/World_Wide_Web_Consortium#Standards https://en.m.wikipedia.org/wiki/World_Wide_Web_Consortium#St... E.g., I don't see WHATWG contributing anything of relevance regarding web accessibility, whereas W3C takes care of accessibility with WAI-ARIA and WCAG.
tw061023 3y ago
My understanding is that WHATWG doesn't govern standards at all - it basically documents what browsers are doing at the moment. So when Google rolls WEI in a Chrome update, it will become a WHATWG "standard" automatically. Is that correct?
- notatoad 3y ago
  no, to become a standard at least one other browser vendor would have to at least signal an intent to implement it.
  - troupo 3y ago
    No. To actually become a standard it needs at least two inependent implementations. But it's interesting that you wrote what you wrote. Because that's exactly what Chrome is doing: it's announcing an intent to implement, and then enables whatever they intend by default. Oh, they do pretend to ask other vendors about their position, but ship anyway. And then use web.dev to pretend it's a standard.
seabass-labrax 3y ago
The W3C is relevant in multiple critical areas of the Web. Just to name a few topics where W3C is the primary venue for all standardisation efforts: - Accessibility - Authentication - CSS - Self-Sovereign Identity - Virtual Reality - Linked Data - XML I wrote a comment about the W3C's relationship with WHATWG a few days ago: https://news.ycombinator.com/item?id=37052428 https://news.ycombinator.com/item?id=37052428 If you do nothing else, please pass your eyes over the list of W3C Recommendations and other publications on standards track: https://www.w3.org/TR/ https://www.w3.org/TR/

deleted 3y ago

[deleted]

InTheArena 3y ago

I'd believe this- if it were not for the fact that Google is ignoring the W3C across the board. This includes privacy sandbox (fledge) and topics (floc) as well. Google can come up with good reasons why something that has negative impacts on the entirety of the ecosystem (except them), because it always ends with Google in a stronger position

tptacek 3y ago
What's there to believe? Standards follow implementations. The W3C aren't the browser police; they just standardize the interoperable things browsers do. It's not W3C's (or WhatWG's) role to "oppose" random things browser vendors decide to do.
- colordrops 3y ago
  Maybe it should be their role. Arguably, things like browser standards are as important to society as electrical or network standards.
  - Analemma_ 3y ago
    Maybe, but it's a moot point, because there's no way to get from here to there. If the browser vendors want to add a standard, they will; and if they don't, they won't. On one or two prior occasions the W3C has proposed something that the browser makers didn't like, they unanimously told the W3C to go pound sand, and that was the end of it.
  - Semaphor 3y ago
    But then you’d also need a world police who enforces that.
    - colordrops 3y ago
      Who enforces electrical and network standards? Those don't require world police.

anotherhue 3y ago

This matters about as much as the US defying the UN. Chrome needs to be spun out.

troyvit 3y ago
Heh, yeah or the UN defying anybody who is a member of their own security council.
- dragonwriter 3y ago
  Considers who was on the other side of the military conflict in which the first, only, and still active UN military command was involved as a direct party and... Not sure I understand your point.
  - HideousKojima 3y ago
    China at the time referred to the Republic of China, i.e. Taiwan. And the USSR's delegation to the UN was boycotting the UNSC entirely (and immediately began using their power to prevent any further UNSC resolutions regarding Korea being passed as soon as they stopped boycotting).
nerdponx 3y ago
Has there ever been an anti-trust suit on the grounds that an actor is using their market dominance to subvert a standards process/body? Is there any legal precedent or standing for such a thing in the US or elsewhere?
- TheAceOfHearts 3y ago
  I don't think web standards work that way. Often times we'll see things get deployed and implemented before they become standards anyway. And it's not as if W3C has any authority. But even if W3C had any authority, Google and Apple would just pay off every seat.
- anonymousiam 3y ago

mkl95 3y ago

So? Since W3C approved DRM, any self respecting user should struggle to take them seriously.

yjftsjthsd-h 3y ago
Surely it's the other way: an organization that approved DRM pumping the brakes implies that the thing in question is remarkably bad

nilshauk 3y ago

Ok so Google ignores W3C on WEI. But could someone else create a W3C proposal that could counteract WEI? It wouldn't have to implementation-specific but rather one or more principles drawing a line in the sand that shouldn't be crossed like what WEI is built to achieve?

ISV_Damocles 3y ago
Not with a "White Hat" on, I think. If a user who is not you uses a browser using WEI (implicitly approving of this attestation tech) and connects to a website that uses WEI, that's entirely up to third-parties and there's nothing legal that you can do. The most you can do is protest this with: 1. Using a browser without WEI or with WEI disabled. 2. Modifying your own site to talk the WEI protocol but for any browser that can talk that protocol, you ban the user from using your site (or redirect them to a site explaining how WEI is DRM of the entire internet, etc) Moving beyond White Hat to Grey Hat and Black Hat, you get things like: 1. Modifying your own hosting company to apply this WEI-blacklisting mechanism to your clients' websites. 2. Convincing (or "convincing") owners of core backend libraries in popular programming languages to introspect connections and blacklist WEI-compatible browsers. 3. Take advantage of XSS vulnerabilities to interfere with WEI operations on other tabs within the same browser on the user's machine if they happen to be using your website. 4. Take advantage of vulnerabilities in the WEI protocol to corrupt the underlying attestation system so it fails to function in all future WEI requests for that physical machine. 5. Hack/Crack attestation system security and publicly release the keys, making any hardware using that version suspicious/blacklisted by users of WEI. 6. Probably some other things I haven't thought of, but as you can see they quickly go from dubiously legal to straight-up illegal. It would be best to nip WEI in the bud before such measures are deemed necessary.

thatcherthorn 3y ago

WEI would be super valuable if it was targeted at corporate network infrastructure. In those situations, enterprises have the jurisdiction and need to know who is connecting to their network. Putting a technology like this into a browser seems to only benefit sites that monetize their content...

seabass-labrax 3y ago

If you like what the W3C is doing for the privacy, accessibility and openness of the Web, you can become a W3C participant. Upon finding a W3C Working Group[1] to which you think you could contribute, you can send an email to the address of that WG's 'Staff Contact' explaining how you think you could help. If the Chairs and the Staff Contact agree, they will ask you to join as an 'Invited Expert' (IE). This does not confer voting rights but grants you access to the meetings, relevant Git repositories etc. You'll need to sign a licensing agreement allowing the W3C to freely publish your contributions. I say this because, at first glance, it seems like the only stakeholders with any influence are W3C Members. The reality is that W3C is very open to contributions from individuals, but just has had a constitutional framework that makes things slightly more complicated for individuals, a situation which they are deliberately improving. As for myself, I'm an IE for the W3C in the Linked Data area, so whilst of course I do not speak for the W3C, I would be more than happy to answer questions here on HN about how the W3C works. [1]: https://www.w3.org/groups/wg/ https://www.w3.org/groups/wg/

EGreg 3y ago
Back in 2014 I met with Tim Berners-Lee himself, and his SoLiD team, and proposed to join forces. Here is the pic: https://lh5.googleusercontent.com/Rp4Su5Z2h28vCASKfrbhYKrULGDP506umz_va7RsF3DssL5NJBBAkdVo5GVeSNmhtIOB-q9ucKEylklc_gJo-JPZzpydaktpH3rsfZYKf-wgpJ561A5NqwJIDCwffnhyfHbAW34b https://lh5.googleusercontent.com/Rp4Su5Z2h28vCASKfrbhYKrULG... His team lead (Dmitry Zagidulin) liked what we were doing a lot. But ultimately Tim chose to go in a different direction, spun off "Inrupt" and left MIT. We continued building our open source platform to try to realize the vision he keeps writing about: https://theconversation.com/tim-berners-lees-plan-to-save-the-internet-give-us-back-control-of-our-data-154130 https://theconversation.com/tim-berners-lees-plan-to-save-th... I was writing very similar things, but of course I didn't invent the Web: https://cointelegraph.com/news/how-a-web-that-lost-its-way-can-find-a-new-one https://cointelegraph.com/news/how-a-web-that-lost-its-way-c... Ultimately, my point is that we tried our best. I even hired Dmitry when he left Tim's project for a while, but very quickly Dmitry got demotivated to work with us because we were putting out working code for customers, instead of conforming to standards. Back then I argued to him that we don't have a ton of funding and executions matters more, after which the winners can help spearhead the standards. After all, Twitter pioneered oAuth, and Meebo+Google pioneered xAuth (if anyone remembers that). Dmitri and I did. So we went our separate ways, and I realized that standards are an expensive detour that can work if you have extra funds to hire people. We plan to support Matrix, Mastodon and other interoperability. But for the time being, our platform is "just" free and open source. Whether it's the UBI "movement", or the decentralized web, or other initiatives, everyone seems to go their separate way and it fizzles out (e.g. https://decentralizedweb.net https://decentralizedweb.net and https://indieweb.org/ https://indieweb.org/). I wish people were willing to join forces on projects more, and get each other funded. That's how we can build real open source alternatives to the corporate internet we are all forced to depend on.

tiffanyh 3y ago

Does the W3C have any influence anymore? I thought it lost some of it's influence, but can't recall why.

seabass-labrax 3y ago
The W3C took a hit to it's influence in the early 2000s after their introduction of RDF (Resource Description Framework), the technology behind Linked Data and XHTML. Whilst technically superior and philosophically more elegant than the raw HTML they sought to enhance (note that HTML5 hadn't been invented at this point), it was not immediately very popular - the concept of Linked Data was somewhat harder to understand than the concept of markup, and getting it wrong would mean your website might fail to display. This lead to the creation of WHATWG, which holds sway over HTML5 and some miscellaneous JavaScript browser APIs, but still a very limited set of Web features compared to the W3C, which standardises lots of areas including CSS. I would say that it was a pretty minor loss of influence overall, and their Linked Data is now used in almost all websites in at least a basic metadata capacity, which is how those 'social links' work (where you paste a URL in a chatroom or social network and find the title, logo and header picture appear automatically) for instance. More extensive use of Linked Data is often not directly visible to website visitors, but will soon form the foundation of a number of digital identity card systems, even for entire countries, and will do so in a way which has the potential to be significantly more privacy-friendly than a traditional 'citizen number' approach. I'm currently a participant in the Linked Data area of W3C's work, but I wasn't around during the events I describe above. Resilient Web Design[1], a short but excellent ebook by Jeremy Keith is a good read for understanding why RDF didn't catch on initially, and anything by Manu Sporny will be worth reading/watching for getting a positive description of how useful RDF and Linked Data can be (his introduction video to the topic, for instance[2]). [1]: https://resilientwebdesign.com/introduction/ https://resilientwebdesign.com/introduction/ [2]: https://www.youtube.com/watch?v=4x_xzT5eF5Q https://www.youtube.com/watch?v=4x_xzT5eF5Q

1letterunixname 3y ago

Vote with your eyes: switch browsers. Firefox/TorBrowser, Brave, or Safari.

lujz 3y ago
Ladybird
- 1letterunixname 3y ago
  And I'll raise you a Lynx.. in development since 1992. :] https://web.archive.org/web/20041204114715/http://www.cc.ukans.edu/~grobe/early-lynx.html https://web.archive.org/web/20041204114715/http://www.cc.uka...
ranguna 3y ago
Librewolf as well