4 ms·

And Google wanted WebM to happen and for people to pay full-retail price for rented games. Google isn't (yet) big enough to force it through: given iOS markets

And Google wanted WebM to happen and for people to pay full-retail price for rented games. Google isn't (yet) big enough to force it through: given iOS marketshare in the US it means web-app devs won't (can't?) do anything unless both Apple and Google adopt it (yes, there are plenty of Chrome-only websites, and Safari has been slow to adopt new web-standards, especially when they begin to tread on the toes of Apple's App Store (PWAs, WebUSB, etc). ---- That said, I am sympathetic to the reasons why orgs like banks want things like remote-device attestation (and am less sympathetic to the likes of the MPAA, etc) - it is unfortunate that better ideas are hard to come by.

troupo 3y ago
> Safari has been slow to adopt new web-standards, especially when they begin to tread on the toes of Apple's App Store (PWAs, WebUSB, etc). Many of those are not "new web standards". Those are Chrome-only non-standards, and Firefox agrees with Safari on most of them. As for PWAs, there's no such thing as a single PWA standard, and Safari has supported the vast majority of the PWA standards for years (but if you point that out, the goalposts of what constitutes a PWA shift faster than superheated plasma).
- AlexErrant 3y ago
  I'd just be happy with Safari having a functional IndexedDB - an old web standard. https://gist.github.com/pesterhazy/4de96193af89a6dd5ce682ce2adff49a https://gist.github.com/pesterhazy/4de96193af89a6dd5ce682ce2...
  - tw061023 3y ago
    How critical that is, compared to WEI - and more broad problem adopting it entails, namely a single company basically dictating the whole web what it can and cannot do?
  - threeseed 3y ago
    Reading through that page it looks like a combination of Safari (a) prioritising privacy and performance and (b) not implementing draft specs. With a whole bunch of bugs that have already been fixed.
  - DaiPlusPlus 3y ago
    IndexedDB's API design is one of the worst I've ever seen (next to the original JS document.cookies "API") Fortunately, Safari does support OPFS ( https://stackoverflow.com/a/71581910/159145 https://stackoverflow.com/a/71581910/159145 ) so provided you don't need all of IndexedDB's features and just need an async blob store for large blobs/files/etc (potentially gigabytes and beyond) then OPFS should work for you.
crazysim 3y ago
WebM happened? Safari takes WebM now and Apple SOCs decode VP9 that's commonly used in them in hardware.
jchw 3y ago
Why include WebM in that list? WebM is good.
- meragrin_ 3y ago
  It is just an example that because Google makes it available and wants it to be used doesn't mean it will be used in any appreciable manner.
  - crazysim 3y ago
    They couldn't really push VP9/Opus without making it available in a non-Google proprietary format. WebM seemed more like a vehicle for that. The amount of popular videos served on YouTube in VP9 and Opus may not exactly be WebM, but the codec support byproduct it pushed probably saved Google/YouTube a huge pile of cash.
jsnell 3y ago
Apple have already been shipping an equivalent attestation mechanism in Safari for a year.
- DaiPlusPlus 3y ago
  Safari's support for WebAuthn does not include support for "direct attestation", if that's what you're referring to. EDIT: Or do you mean "Private Access Tokens"? I just found out about this now and wow... looks like I've got some reading to do, but so-far it seems far more limited in scope than Google's version, and doesn't seem like it can be used to fingerprint visitors between sessions either. ( https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://httptoolkit.com/blog/apple-private-access-tokens-att... )
  - jsnell 3y ago
    I indeed mean PATs. They are not more limited than WEI in any meaningful way. Both could in principle attest anything. Both claim they are meant to attest only certain kinds of properties. They would be just as useful (or useless) for fingerprinting.
- tw061023 3y ago
  Apple doesn't have a monopoly on the web ad market, and thus this is kind of irrelevant - they aren't forcing this down everyone's throat. Though I cannot help but wonder why exactly they did that. Some kind of a corporate requirement?
  - jsnell 3y ago
    So, first of all, the entire point of the GP was that Apple would be slow to implement this. Clearly that is not true. But also JFC, it is amazing how the moment it is pointed out that Apple is already doing a thing that's being railing at, and the reaction shifts from outrage to basically "I wonder what amazing and important reason they have for doing this" and "nobody but Apple can possibly be allowed to benefit from this because monopoly". Apple's stated reason is exactly the same as Google's. To make a privacy-preserving anti-abuse signal for browsers. Apple need it because they are piping their best customers' traffic into what is basically an open sewer of IP reputation (Apple Private Relay), and need a way to avoid said customers giving up in disgust due to the high rate of captchas. Google need it because they want to remove all fingerprinting vectors, and need privacy-preserving replacements for legit use cases.
tw061023 3y ago
And we still have people crying Safari being new IE all the time. The remaining minor incompatibilities that we have now are nothing compared to what we had in IE6 days, and yes, this is the price we pay for not giving complete control of the web to a single ad company.
goalieca 3y ago
Banks shouldn’t care to authenticate the browser, they should care to authenticate the user. WebauthN is the solution there and is w3c
threeseed 3y ago
> Safari has been slow to adopt new web-standards, especially when they begin to tread on the toes of Apple's App Store Cautious. Many of those web-standards e.g. WebUSB have significant security vectors and have been used in the past to fingerprint devices for advertiser tracking. Also many have impacts on battery life and performance. Whereas Chrome seems to be getting slower and bloated over time, Safari has remained fast and light-weight.
- jwells89 3y ago
  Not to mention that many of the things that the WebKit team has been reluctant to implement the Gecko team has been similarly reluctant about.
Zak 3y ago
> I am sympathetic to the reasons why orgs like banks want things like remote-device attestation I'm not. I mean, I am in theory; being able to warn a user their device might have some sort of malware upon trying to log into a banking website is useful, but we've already seen how banks handle these things in practice with mobile devices having attestation capabilities. The result is some banking apps refuse to run on my phone with a very up-to-date and definitely not compromised LineageOS, but will happily run on devices several years out of date. Google SafetyNet can tell that the bootloader is locked and the system partition hasn't been modified, but can't tell that some malware has gained root access by privilege escalation. I don't want them doing that to their websites as well. This technology should not be let loose on the world.
troupo 3y ago
> Google isn't (yet) big enough to force it through When they want, Google literally strongarms various vendors into implementing their codecs: https://www.protocol.com/youtube-tv-roku-issues https://www.protocol.com/youtube-tv-roku-issues --- start quote --- At the core of this allegation appears to be Google's decision to push hardware makers to adopt the AV1 codec, an open video codec that promises better-looking 4K videos at lower bitrates. As Protocol first reported in October, Google is requiring makers of Android TV devices to support AV1 starting this month. Additionally, Google also seems to push makers of smart TVs and streaming devices not based on Android TV to use AV1 for YouTube. ... Google has long forced device makers to use the free VP9 codec for 4K YouTube streams. --- end quote ---

troupo 3y ago

> Safari has been slow to adopt new web-standards, especially when they begin to tread on the toes of Apple's App Store (PWAs, WebUSB, etc). Many of those are not "new web standards". Those are Chrome-only non-standards, and Firefox agrees with Safari on most of them. As for PWAs, there's no such thing as a single PWA standard, and Safari has supported the vast majority of the PWA standards for years (but if you point that out, the goalposts of what constitutes a PWA shift faster than superheated plasma).

AlexErrant 3y ago
I'd just be happy with Safari having a functional IndexedDB - an old web standard. https://gist.github.com/pesterhazy/4de96193af89a6dd5ce682ce2adff49a https://gist.github.com/pesterhazy/4de96193af89a6dd5ce682ce2...
- tw061023 3y ago
  How critical that is, compared to WEI - and more broad problem adopting it entails, namely a single company basically dictating the whole web what it can and cannot do?
- threeseed 3y ago
  Reading through that page it looks like a combination of Safari (a) prioritising privacy and performance and (b) not implementing draft specs. With a whole bunch of bugs that have already been fixed.
- DaiPlusPlus 3y ago
  IndexedDB's API design is one of the worst I've ever seen (next to the original JS document.cookies "API") Fortunately, Safari does support OPFS ( https://stackoverflow.com/a/71581910/159145 https://stackoverflow.com/a/71581910/159145 ) so provided you don't need all of IndexedDB's features and just need an async blob store for large blobs/files/etc (potentially gigabytes and beyond) then OPFS should work for you.

crazysim 3y ago

WebM happened? Safari takes WebM now and Apple SOCs decode VP9 that's commonly used in them in hardware.

jchw 3y ago

Why include WebM in that list? WebM is good.

meragrin_ 3y ago
It is just an example that because Google makes it available and wants it to be used doesn't mean it will be used in any appreciable manner.
- crazysim 3y ago
  They couldn't really push VP9/Opus without making it available in a non-Google proprietary format. WebM seemed more like a vehicle for that. The amount of popular videos served on YouTube in VP9 and Opus may not exactly be WebM, but the codec support byproduct it pushed probably saved Google/YouTube a huge pile of cash.

jsnell 3y ago

Apple have already been shipping an equivalent attestation mechanism in Safari for a year.

DaiPlusPlus 3y ago
Safari's support for WebAuthn does not include support for "direct attestation", if that's what you're referring to. EDIT: Or do you mean "Private Access Tokens"? I just found out about this now and wow... looks like I've got some reading to do, but so-far it seems far more limited in scope than Google's version, and doesn't seem like it can be used to fingerprint visitors between sessions either. ( https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://httptoolkit.com/blog/apple-private-access-tokens-att... )
- jsnell 3y ago
  I indeed mean PATs. They are not more limited than WEI in any meaningful way. Both could in principle attest anything. Both claim they are meant to attest only certain kinds of properties. They would be just as useful (or useless) for fingerprinting.
tw061023 3y ago
Apple doesn't have a monopoly on the web ad market, and thus this is kind of irrelevant - they aren't forcing this down everyone's throat. Though I cannot help but wonder why exactly they did that. Some kind of a corporate requirement?
- jsnell 3y ago
  So, first of all, the entire point of the GP was that Apple would be slow to implement this. Clearly that is not true. But also JFC, it is amazing how the moment it is pointed out that Apple is already doing a thing that's being railing at, and the reaction shifts from outrage to basically "I wonder what amazing and important reason they have for doing this" and "nobody but Apple can possibly be allowed to benefit from this because monopoly". Apple's stated reason is exactly the same as Google's. To make a privacy-preserving anti-abuse signal for browsers. Apple need it because they are piping their best customers' traffic into what is basically an open sewer of IP reputation (Apple Private Relay), and need a way to avoid said customers giving up in disgust due to the high rate of captchas. Google need it because they want to remove all fingerprinting vectors, and need privacy-preserving replacements for legit use cases.

tw061023 3y ago

And we still have people crying Safari being new IE all the time. The remaining minor incompatibilities that we have now are nothing compared to what we had in IE6 days, and yes, this is the price we pay for not giving complete control of the web to a single ad company.

goalieca 3y ago

Banks shouldn’t care to authenticate the browser, they should care to authenticate the user. WebauthN is the solution there and is w3c

threeseed 3y ago

> Safari has been slow to adopt new web-standards, especially when they begin to tread on the toes of Apple's App Store Cautious. Many of those web-standards e.g. WebUSB have significant security vectors and have been used in the past to fingerprint devices for advertiser tracking. Also many have impacts on battery life and performance. Whereas Chrome seems to be getting slower and bloated over time, Safari has remained fast and light-weight.

jwells89 3y ago
Not to mention that many of the things that the WebKit team has been reluctant to implement the Gecko team has been similarly reluctant about.

Zak 3y ago

> I am sympathetic to the reasons why orgs like banks want things like remote-device attestation I'm not. I mean, I am in theory; being able to warn a user their device might have some sort of malware upon trying to log into a banking website is useful, but we've already seen how banks handle these things in practice with mobile devices having attestation capabilities. The result is some banking apps refuse to run on my phone with a very up-to-date and definitely not compromised LineageOS, but will happily run on devices several years out of date. Google SafetyNet can tell that the bootloader is locked and the system partition hasn't been modified, but can't tell that some malware has gained root access by privilege escalation. I don't want them doing that to their websites as well. This technology should not be let loose on the world.

troupo 3y ago

> Google isn't (yet) big enough to force it through When they want, Google literally strongarms various vendors into implementing their codecs: https://www.protocol.com/youtube-tv-roku-issues https://www.protocol.com/youtube-tv-roku-issues --- start quote --- At the core of this allegation appears to be Google's decision to push hardware makers to adopt the AV1 codec, an open video codec that promises better-looking 4K videos at lower bitrates. As Protocol first reported in October, Google is requiring makers of Android TV devices to support AV1 starting this month. Additionally, Google also seems to push makers of smart TVs and streaming devices not based on Android TV to use AV1 for YouTube. ... Google has long forced device makers to use the free VP9 codec for 4K YouTube streams. --- end quote ---