10 ms·

Google Abandons Web Environment Integrity API

352 points by jjgreen 3y ago

judge2020 3y ago
7 hours ago: https://news.ycombinator.com/item?id=38118627 https://news.ycombinator.com/item?id=38118627 (it originally had the title of "Google abandons WEI" or something similar to that)
chris_wot 3y ago
"I have encouraged the team working on this to ignore feedback in any forum in which something like Chromium's code of conduct is not being maintained as anything else would be creating an unsafe working environment." - Rick Byers https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/0doc7unxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_...
- luag 3y ago
  > It is difficult to get a man to understand something, when his salary depends upon his not understanding it
- alephxyz 3y ago
  > Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies That makes it _really_ hard to believe they're debating in good faith. Anyway the entire thread makes it sound like they're temporarily backing down but still intenting to implement something similar in the future:.
  - tjpnz 3y ago
    >who are afraid this feature will disrupt their illegal and/or unethical businesses While benefiting unethical businesses like Google? That's called a cartel.
  - beej71 3y ago
    In my town, a couple (both doctors) unilaterally gated a forest service road that led to a popular outdoor area used by the citizens for years. Apparently rights of way are tough to determine on this road that's well over a century old, but the Forest is working on it. In the meantime, the doctors' business were figuratively destroyed and their property vandalized. [I don't approve of illegal actions.] And I think they're genuinely confused by the reaction of the general public. They are so far out of touch, they just can't understand. Google pushing things like this and being surprised by the violent backlash has the same feel.
    - zx8080 3y ago
      > violent backlash There's no backlash. Is there anyone stating to stop buying Google Ads? Moving to Firefox (since there's no else alternative non-Google-chromium-based browser out there)? Except the HN audience, if course. There's no danger from "users" for Google. Because their users are huge enterprises paging billions for ads. Not us. DRM is what banks love. Recently, there're several major banks' mobile apps in Singapore stopped working as they started scanning all apps installed on a device, and some they don't like (MS Authenticator, for instance; F-Droid, and any opensource apk from there, also any developers installed app). This is nightmare as mobile bank apps are a first class citizen now. Web just does not open without push dialog. Not sms otp anymore, but the app push dialog. The only way to handle it is to buy a cheapest android and install all bank apps there.
      - marak830 3y ago
        Wait what? Do you have any further details about the f-droid and Ms auth? Damnit I'm going to have to do a PSA at work if this is true.
      - matheusmoreira 3y ago
        > DRM is what banks love. > Recently, there're several major banks' mobile apps in Singapore stopped working as they started scanning all apps installed on a device, and some they don't like This seriously triggers me. I can't even enable developer mode on my phone without these apps flipping out. Banks in my country (Brazil) have a long standing tradition of doing this. Even on PCs they have these asinine "security plugins" for browsers. You literally cannot log into their systems without the goddamn thing installed. Not a single person managed to explain to me what they do, so years ago I was bored at work and tried my hand at reverse engineering the plugin to figure out why it made the computer so unusably slow. I caught it intercepting every single network connection. Didn't bother to check anything else. Just assumed it was phoning home with private information and started treating it like the malware it is from then on. Actually switched banks to one which didn't require this crap. These freaking banks think their "fraud prevention" justifies anything. There's a package for this "banking security tool" in the Arch User Repository. https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw-bin https://aur.archlinux.org/packages/warsaw-bin Who the hell knows what this thing does nowadays? Maybe it doesn't monitor people anymore, it's been years and we even have a GDPR equivalent now. But I will never install it.
  - keepamovin 3y ago
    They're saying anything that disagrees with them is bullying and criminal. But, labelling anything that disagrees with them as bullying, is a bullying tactic to try to silence dissent. Why do they want to silence opposition? Because their position does not stand up to scrutiny.
    - charcircuit 3y ago
      >They're saying anything that disagrees with them is bullying and criminal. That is not want was said. People making direct and indirect threats against the author are not acting in good faith and want to just silence the author without anyone fairly evaluating the proposal. >Why do they want to silence opposition? Threats are not productive for deciding if a proposal should be adopted. They are just noise. Wanting to get rid of noise and focus on signal is not "silencing opposition."
      - keepamovin 3y ago
        > People making direct and indirect threats against the author Indeed that would be the case if that were so, yet it looks like what actually occurred here is the author is abusing the labelling of bullying and criminal in order to falsely tar all disagreement as that. This labelling abuse is itself a bullying act designed to intimidate and shame into silence any disagreement by misrepresenting it as a threat. Which is itself a threat: agree with me or I will accuse you of evil and silence you. That's what it seemed like at the time. Let's note that the quoted comments are from a months' old thread. Do you have any evidence to support your claim about there being direct and indirect threats?
        cbolton 3y ago
        In the linked Groups post, the author reports "physical threats and other forms of abuse". I find that very easy to believe and your post reads very uncharitable, unless you have concrete reasons to think that the author is lying.
        3y ago
  - stodor89 3y ago
    Justifying shady corporate practices by pretending to stand the moral high-ground is nothing new. Just recall Apple's child pornography nonsense. "We are introducing web DRM to protect users from those evil people out there..." The hell you are.
- kelnos 3y ago
  > It's somewhat ironic to me that some folks arguing passionately for the openness of the web (something I and many of the proposal contributors are also passionate about) I cannot imagine the level of cognitive dissonance required to simultaneously believe you are passionate about the open web, and push something like WEI. Either they're flat out lying about their "passion", or they've internalized some very contradictory ideas. Not sure which is worse. Of course then there's: > Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies. Which makes me think they're just lying. Or, at best, they don't understand basic logic. Personal attacks and doxing are unacceptable, but just because people who do bad things hold a certain opinion, it doesn't mean everyone who holds that opinion does bad things. Or even that more than a small, vocal minority do. But ultimately Google is an advertising & surveillance capitalism company. If you're going to work there, and on one of most of their public-facing products, it's pretty likely you're going to eventually do shady things in service of the company's main revenue streams. Your continued employment depends on it.
  - charcircuit 3y ago
    >I cannot imagine the level of cognitive dissonance required to simultaneously believe you are passionate about the open web, and push something like WEI. Imagine a world where EME was not accepted as a standard. 1. Browsers do nothing to support DRM and sites like Netflix recommend people to just use a native app to experience the full Netflix experience. This weakens the open web by having sites leave the web and opt to move users to the mobile web instead. 2. Browsers adopt a closed standard for DRM. This weakens the open web because now a care use case of the web now uses a closed standard instead of an open one.
    - matheusmoreira 3y ago
      3. Firefox somehow manages to remain the dominant browser, refuses to adopt the standard and sites have to suck it up and deal with it. If only that had actually happened.
- 38 3y ago
  > unsafe working environment what does that even mean? we are talking about internet arguments here right? how does "safety" even enter the conversation? this guy sounds off his rocker. > find ways to reduce the harms of invalid traffic across the whole web crazy talk.
  - kccqzy 3y ago
    Makes sense to me. If during the course of your work you have to read a bunch of internet comments with so much vitriol it is a personal and psychological safety issue. Personally I would not have chosen any job that would subject me to this kind of psychological abuse, and I would imagine someone choosing to work at Google would have thought the same. Curiously your HN profile says "removed due to doxing, because people are awful" so I'd like to think you at least would have the empathy to imagine someone experiencing something similar to what you experienced. Internet arguments can hurt people; period.
    - 38 3y ago
      [flagged]
    - jchw 3y ago
      Agreed. And, I can imagine anyone working on anything like WEI will not find a safe work environment so as long as their work environment involves being on the internet in any shape or form. So I guess if you work on the Chrome team and this is assigned to you, I genuinely do feel empathy, although I also think that you should probably quit if you value psychological safety. This is a complicated issue. I view work as a mutual exchange: I work on software in exchange for money. It is a bonus when I think the software or mission is genuinely cool. That said, I'm not one to be highly moralizing about it. I'd quit if someone asked me to do something illegal, and I will (and have) generally refuse to do work that is just simply morally bankrupt (And I have been tested on this. Early in my career, I refused to remove annual subscription renewal reminders for a subscription service. I didn't suggest that I would quit if it were done, but I voiced my disapproval and made it clear I wouldn't do it. We didn't wind up doing this, thankfully.) But, I will generally work on things that I don't agree with. I'm vocal about it, but work is work. But y'know, people have livelihoods to maintain. It's easy to say this if you live alone, have plenty in the bank, a great safety net, and a great network. (Not that all of that applies to me, but for sake of argument.) Certainly the job market is also tighter and the future of software engineering as a career is uncertain in some regards. So outright refusing to do work could be a scary prospect. Even being vocal about it and rocking the boat may be scary. But that said, this being the case does not make the answer any less certain. While harassment and toxicity that crosses certain lines is not something I think people should justify, I certainly understand the why: working on something like WEI triggers an immune response from the proponents of the open web. And while I'm sure many people would prefer to do things "right", I think that there is an overwhelming feeling that the open web is hostage to the big corporate interests, and that the open web proponents are strongly outnumbered and outgunned in the modern world. And Google never played fair anyway, so they probably don't feel especially enticed to either. So I think it's natural. What's going to happen is that this will probably continue to escalate, and I can't really say I strongly blame anyone. Google is probably happy to push this responsibility onto employees knowing it could be very mentally taxing, employees with increasingly poor career prospects will not want to rock the boat, and disgruntled "internet activists" who feel pushed to their limits are unlikely to care tremendously about the emotional damage they cause (it's not like the Internet is really known for its kindness to begin with.) I'm thinking it's gonna be a good time to pivot away from computer careers these next few years...
- deleted 3y ago
  [deleted]
- gardenhedge 3y ago
  Nonsense and an excuse to ignore any criticism they don't like
- Pannoniae 3y ago
  I'm sorry for the raw words but this is soy as fuck. This is the usual excuse of "well, we got harassment (which we totally deserved) so we are finally justified to do <bad thing>"... These companies present it like harassment and threats just come out of nowhere because people are unreasonable or "hateful", and they refuse to acknowledge they deliberately create the conditions for such extreme measures. If they don't want harassment or threats, they should maybe stop messing with people's stuff...
jeffparsons 3y ago
It will be back. Somewhere along the line the kinds of people who push these sorts of things realised that it doesn't matter if everyone hates the thing and it gets temporarily "defeated". If you can afford to keep reinventing the same thing under another name, you can get the outcome you want through sheer persistence. See also: surveillance laws.
- deleted 3y ago
  [deleted]
- AnthonyMouse 3y ago
  The key is to keep aggressively attacking the ones that already exist. If they have to be constantly vigilant to things from getting better, they won't have as much time to spend trying to make it worse. And sometimes they'll lose and you'll actually make things better.
  - marak830 3y ago
    The tiring part is that, we have to be vigilant and won every time. They have to win once. The tables are stacked against us.
    - rightbyte 3y ago
      Why are you assuming bad decisions can't be reversed?
      - troupo 3y ago
        It takes too long for them to be reversed, and by that time the damage is done.
- ryandrake 3y ago
  See also: any unpopular law. It has to be fought and defeated every time, but only has to succeed and pass once.
danShumway 3y ago
> Instead, the Android team aims to focus on the Android WebView Media Integrity API, which provides a similar form of attestation but only for WebViews embedded in Android apps. I'm not as dismissive of this as the Register is; it's definitely less harmful than the original proposal, but it's still DRM, and now it's no longer going through a standards process so we just don't have a ton of details about how it will work. I honestly feel like this announcement should probably be getting more skepticism than I've seen from the news sites reporting it. I'm not saying it's just as bad, I'm just saying we should question how much this is going to help security for end users or whether this is just going to to turn into more DRM to let embedded webapps act like native apps.
- magicalist 3y ago
  WebViews can already be given access to literally anything you want to give them from your app you embedded them in, so I don't see any fundamental change? It's basically a new android DRM API, of which there are already several.
  - danShumway 3y ago
    I wonder how hard it would have been before this to simulate the same API using the Play Integrity API and just exposing it to the webview. Is that something where the remote server would still have to trust the client to not lie about the API, or could they do an attestation check remotely in a way that would be difficult to fake?
    - matheusmoreira 3y ago
      Remote attestation happens in hardware now. Significantly harder to fake.
      - danShumway 3y ago
        Can you elaborate? I'm not sure I understand what you mean by "now". What I'm asking is whether or not the Play Integrity API supports remote attestation on its own today (ie, before any of the webview changes ship). Or I guess, more specifically, is there a challenge-response API currently for the Play Integrity API that a remote server could use? If yes, then sure, I buy that this is not really adding anything new. If no, then adding a webview API does seem to me like a meaningful expansion of Android's DRM capabilities.
mindwok 3y ago
After reading through the proposal, I really don't think it was that bad. As a recap, websites never see any information about your device but basically receive a 'thumbs-up' from a trusted provider that your browser is 'likely' to be a human agent and untampered with. There is definitely the potential for it to go quite badly if Google ends up as the sole trust source, but if it was executed well I could see a situation where it ends up similar to TLS, where there are a relatively large number of trusted providers including some like LetsEncrypt that are non-profit and considered a public good. In that sense it would allow quite a bit of flexibility in what 'untampered' means based on the trust source which would be a good thing. IMO the dialogue around this was incredibly disappointing. I understand and support the hesitation around a proposal like this that could do harm to the web, but people were basically attacking these people and having meltdowns in the GitHub comments. Given how much large platforms have struggled to fight bots, and that it's only going to get worse with the rise of AI, I think something like this is going to end up being a necessity eventually. This won't be the last we will see of something like this.
- j0hnyl 3y ago
  I absolutely agree that it's very much a big nothing burger compared to the reaction it got.
  - saltymug76 3y ago
    [flagged]
- danShumway 3y ago
  > In that sense it would allow quite a bit of flexibility in what 'untampered' means based on the trust source which would be a good thing. The problem is that the APIs for botting are the same APIs that are used for browser automation and extension support and that are implemented by experimental browsers that are building new tools for the web. You're correct to bring up that people didn't trust Google; that's part of it. But there's a more fundamental problem: there is no way to restrict someone from using APIs to automate a browser without also killing a lot of more traditionally accepted use-cases for those APIs. Every accessibility API and presentation API is an adblocking API. Every web extension and request redirector is a bot API. Google didn't seem to understand this; they came into the discussion believing that as long as they could get people to believe Google wouldn't abuse the API, everything would be fine (whether or not that was an honest claim is another discussion, the problems with WEI were numerous). But beyond the discussions of Google's motivations, at a fundamental level what critics were saying was that there was no such thing as a working version of this API that would be effective at reducing bots without reducing user freedom. Making the API more Open or getting more implementers on board wouldn't change that. It simply isn't possible to truthfully verify to a server that a user environment is "trusted" without blocking the user from accessing normal browser APIs.
xeonmc 3y ago
Great. Now kill WebHID and WebUSB next.
- djbusby 3y ago
  WebUSB is pretty useful for web-based POS. Scanner and printer integrations.
  - surajrmal 3y ago
    It's great for a lot of use cases. We use it to enable a cross platform device flashing tool. Much easier to build and distribute than native applications for all platforms we need to support. Serial is similarly useful for getting logs off of devices.
  - nicman23 3y ago
    you know what is better? a upstream kernel driver
    - djbusby 3y ago
      I think you don't understand the use case. Kernel drivers don't connect the USB device to the JavaScript in the web-app.
      - nicman23 3y ago
        that whole sentence is disgusting
  - tremon 3y ago
    But why should web-based POS be better than dedicated devices?
    - ultimatt42 3y ago
      That's the wrong comparison. We used to only have dedicated POS systems, now we have the option to run POS software on a general purpose computing device. The question is why should that POS software be a native app instead of a web app?
xvector 3y ago
The security engineer in me loved this proposal, the privacy/FOSS enthusiast in me hated it.
- rightbyte 3y ago
  I read the proposal to be a way for sites to execute a hash function on my ram? It sounds like a security nightmare.
  - hurryer 3y ago
    It could ensure that an employee laptop is not infected when connecting to the intranet which could prevent customer data leakage which would be a benefit for all of us.
    - rightbyte 3y ago
      Such a scan would take like half an hour. You need to scan each unloaded executable. WEI won't be used for that. It will be used for blocking ad blockers and ensure Google's malware is active. I am quite sure that the client programs need to be cooperating for the WEI to be practical.
    - drtgh 3y ago
      It would not ensure the laptop is not infected. It would only ensure that the laptop user does not run software that is not approved by Google or similar, a DRM, as Trojans will continue to find ways to disguise themselves and insert themselves into authorized processes. The company would find difficult to run custom software not covered by such DRM. In time, the Web Environment Integrity API organisation would say that there are too many authorisation requests or similar and demand economic compensation from developers to be included in the authorized filter scans, at time the supposed initial objective is not accomplished, as this DRM does not ensure the laptop is not infected.
      - hurryer 3y ago
        In was speaking in general about remote attestation, not about the Chrome only one. A good example is Xbox, for which there is no known custom software, which in turn guarantees the lack of cheating software.
figassis 3y ago
With ideas like this, it may often be just as dangerous to publish them in the first place. Governments are now aware of it (including Apple's CSAM tech). How long until they start mandating this from browser/phone makers?
- master-lincoln 3y ago
  What interest would a government have in getting something like the "Web Environment Integrity" API?
  - figassis 3y ago
    Create a blacklist of websites built into browsers for one. Would defeat VPNs and other techniques for the average users.
    - master-lincoln 3y ago
      Afaik most governments don't build browsers. How would this defeat VPNs? As far as I understood this API allows websites to make sure they run on unmodified browsers. The underlying network stack is not checked.
- jillesvangurp 3y ago
  The more relevant question is when governments will force Apple and Google to open up their app stores. Particularly Apple is enforcing a monopoly on browser engines by not allowing applications to use anything else than Safari on IOS. Google isn't much better and is forcing OEMs into, arguably, illegal licensing deals where they are required to ship Google apps. Breaking that monopoly will change the mobile web landscape.
  - Eggpants 3y ago
    While they are at it, they can force PlayStation and Xbox to sell each others games on their closed systems. Then force Walmart to allow Target to open a kiosk rent free in their stores… Closing an adtech attack vector by restricting the browser engine on a device they paid all the R&D for to develop doesn’t make Apple a monopoly.
fmajid 3y ago
They'll rename it and reintroduce it subrepticiously, just as they did with ~~FLoC~~ Topics API.
- whywhywhywhy 3y ago
  > Topics API Really messed up having something so far reaching and giving it such an innocuous name a normal person couldn't possibly understand the implications of. Definitely an evil mind behind that one.
- dsr_ 3y ago
  "surreptitiously"
  - coldacid 3y ago
    Maybe the GP is also insinuating that Google is full of reptilians?
    - fmajid 3y ago
      No, just a native French speaker, where the root word is "subreptice".
      - dsr_ 3y ago
        In the time honored way of English, we stole it from you and changed the spelling to match our crummy pronunciation.
        fmajid 3y ago
        Well, it happened sometime after 1652: https://www.dsl.ac.uk/entry/dost/surreptitiously https://www.dsl.ac.uk/entry/dost/surreptitiously
        dsr_ 3y ago
        Also in the time-honored way of English, we didn't really standardize spelling for another 200 years. Then we started being really pedantic.
al_be_back 3y ago
let's be honest, WEI & similar are poor approaches to solve market-issues framed wrongly as a "user problem". the problem is not the User wanting to download your content, bypassing ads, or spoofing Geo location using VPNs, or sharing of passwords. The real issue is with the Providers/Vendors relying on the Web as a Cheap Ways & Means to quickly access, conquer the market. The web is a generic platform, powered by general-purpose tech and methods, therefore it's "open", "cheap", and easily accessible, that's why it's popular and adopted globally. There are tradeoffs - choose web for being cheap, open and accessible, or chose to build expensive, risky custom standalone services.

352 points by jjgreen 3y ago

judge2020 3y ago

7 hours ago: https://news.ycombinator.com/item?id=38118627 https://news.ycombinator.com/item?id=38118627 (it originally had the title of "Google abandons WEI" or something similar to that)

chris_wot 3y ago

"I have encouraged the team working on this to ignore feedback in any forum in which something like Chromium's code of conduct is not being maintained as anything else would be creating an unsafe working environment." - Rick Byers https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/0doc7unxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_...

luag 3y ago
> It is difficult to get a man to understand something, when his salary depends upon his not understanding it
alephxyz 3y ago
> Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies That makes it _really_ hard to believe they're debating in good faith. Anyway the entire thread makes it sound like they're temporarily backing down but still intenting to implement something similar in the future:.
- tjpnz 3y ago
  >who are afraid this feature will disrupt their illegal and/or unethical businesses While benefiting unethical businesses like Google? That's called a cartel.
- beej71 3y ago
  In my town, a couple (both doctors) unilaterally gated a forest service road that led to a popular outdoor area used by the citizens for years. Apparently rights of way are tough to determine on this road that's well over a century old, but the Forest is working on it. In the meantime, the doctors' business were figuratively destroyed and their property vandalized. [I don't approve of illegal actions.] And I think they're genuinely confused by the reaction of the general public. They are so far out of touch, they just can't understand. Google pushing things like this and being surprised by the violent backlash has the same feel.
  - zx8080 3y ago
    > violent backlash There's no backlash. Is there anyone stating to stop buying Google Ads? Moving to Firefox (since there's no else alternative non-Google-chromium-based browser out there)? Except the HN audience, if course. There's no danger from "users" for Google. Because their users are huge enterprises paging billions for ads. Not us. DRM is what banks love. Recently, there're several major banks' mobile apps in Singapore stopped working as they started scanning all apps installed on a device, and some they don't like (MS Authenticator, for instance; F-Droid, and any opensource apk from there, also any developers installed app). This is nightmare as mobile bank apps are a first class citizen now. Web just does not open without push dialog. Not sms otp anymore, but the app push dialog. The only way to handle it is to buy a cheapest android and install all bank apps there.
    - marak830 3y ago
      Wait what? Do you have any further details about the f-droid and Ms auth? Damnit I'm going to have to do a PSA at work if this is true.
    - matheusmoreira 3y ago
      > DRM is what banks love. > Recently, there're several major banks' mobile apps in Singapore stopped working as they started scanning all apps installed on a device, and some they don't like This seriously triggers me. I can't even enable developer mode on my phone without these apps flipping out. Banks in my country (Brazil) have a long standing tradition of doing this. Even on PCs they have these asinine "security plugins" for browsers. You literally cannot log into their systems without the goddamn thing installed. Not a single person managed to explain to me what they do, so years ago I was bored at work and tried my hand at reverse engineering the plugin to figure out why it made the computer so unusably slow. I caught it intercepting every single network connection. Didn't bother to check anything else. Just assumed it was phoning home with private information and started treating it like the malware it is from then on. Actually switched banks to one which didn't require this crap. These freaking banks think their "fraud prevention" justifies anything. There's a package for this "banking security tool" in the Arch User Repository. https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw-bin https://aur.archlinux.org/packages/warsaw-bin Who the hell knows what this thing does nowadays? Maybe it doesn't monitor people anymore, it's been years and we even have a GDPR equivalent now. But I will never install it.
- keepamovin 3y ago
  They're saying anything that disagrees with them is bullying and criminal. But, labelling anything that disagrees with them as bullying, is a bullying tactic to try to silence dissent. Why do they want to silence opposition? Because their position does not stand up to scrutiny.
  - charcircuit 3y ago
    >They're saying anything that disagrees with them is bullying and criminal. That is not want was said. People making direct and indirect threats against the author are not acting in good faith and want to just silence the author without anyone fairly evaluating the proposal. >Why do they want to silence opposition? Threats are not productive for deciding if a proposal should be adopted. They are just noise. Wanting to get rid of noise and focus on signal is not "silencing opposition."
    - keepamovin 3y ago
      > People making direct and indirect threats against the author Indeed that would be the case if that were so, yet it looks like what actually occurred here is the author is abusing the labelling of bullying and criminal in order to falsely tar all disagreement as that. This labelling abuse is itself a bullying act designed to intimidate and shame into silence any disagreement by misrepresenting it as a threat. Which is itself a threat: agree with me or I will accuse you of evil and silence you. That's what it seemed like at the time. Let's note that the quoted comments are from a months' old thread. Do you have any evidence to support your claim about there being direct and indirect threats?
      - cbolton 3y ago
        In the linked Groups post, the author reports "physical threats and other forms of abuse". I find that very easy to believe and your post reads very uncharitable, unless you have concrete reasons to think that the author is lying.
        3y ago
- stodor89 3y ago
  Justifying shady corporate practices by pretending to stand the moral high-ground is nothing new. Just recall Apple's child pornography nonsense. "We are introducing web DRM to protect users from those evil people out there..." The hell you are.
kelnos 3y ago
> It's somewhat ironic to me that some folks arguing passionately for the openness of the web (something I and many of the proposal contributors are also passionate about) I cannot imagine the level of cognitive dissonance required to simultaneously believe you are passionate about the open web, and push something like WEI. Either they're flat out lying about their "passion", or they've internalized some very contradictory ideas. Not sure which is worse. Of course then there's: > Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies. Which makes me think they're just lying. Or, at best, they don't understand basic logic. Personal attacks and doxing are unacceptable, but just because people who do bad things hold a certain opinion, it doesn't mean everyone who holds that opinion does bad things. Or even that more than a small, vocal minority do. But ultimately Google is an advertising & surveillance capitalism company. If you're going to work there, and on one of most of their public-facing products, it's pretty likely you're going to eventually do shady things in service of the company's main revenue streams. Your continued employment depends on it.
- charcircuit 3y ago
  >I cannot imagine the level of cognitive dissonance required to simultaneously believe you are passionate about the open web, and push something like WEI. Imagine a world where EME was not accepted as a standard. 1. Browsers do nothing to support DRM and sites like Netflix recommend people to just use a native app to experience the full Netflix experience. This weakens the open web by having sites leave the web and opt to move users to the mobile web instead. 2. Browsers adopt a closed standard for DRM. This weakens the open web because now a care use case of the web now uses a closed standard instead of an open one.
  - matheusmoreira 3y ago
    3. Firefox somehow manages to remain the dominant browser, refuses to adopt the standard and sites have to suck it up and deal with it. If only that had actually happened.
38 3y ago
> unsafe working environment what does that even mean? we are talking about internet arguments here right? how does "safety" even enter the conversation? this guy sounds off his rocker. > find ways to reduce the harms of invalid traffic across the whole web crazy talk.
- kccqzy 3y ago
  Makes sense to me. If during the course of your work you have to read a bunch of internet comments with so much vitriol it is a personal and psychological safety issue. Personally I would not have chosen any job that would subject me to this kind of psychological abuse, and I would imagine someone choosing to work at Google would have thought the same. Curiously your HN profile says "removed due to doxing, because people are awful" so I'd like to think you at least would have the empathy to imagine someone experiencing something similar to what you experienced. Internet arguments can hurt people; period.
  - 38 3y ago
    [flagged]
  - jchw 3y ago
    Agreed. And, I can imagine anyone working on anything like WEI will not find a safe work environment so as long as their work environment involves being on the internet in any shape or form. So I guess if you work on the Chrome team and this is assigned to you, I genuinely do feel empathy, although I also think that you should probably quit if you value psychological safety. This is a complicated issue. I view work as a mutual exchange: I work on software in exchange for money. It is a bonus when I think the software or mission is genuinely cool. That said, I'm not one to be highly moralizing about it. I'd quit if someone asked me to do something illegal, and I will (and have) generally refuse to do work that is just simply morally bankrupt (And I have been tested on this. Early in my career, I refused to remove annual subscription renewal reminders for a subscription service. I didn't suggest that I would quit if it were done, but I voiced my disapproval and made it clear I wouldn't do it. We didn't wind up doing this, thankfully.) But, I will generally work on things that I don't agree with. I'm vocal about it, but work is work. But y'know, people have livelihoods to maintain. It's easy to say this if you live alone, have plenty in the bank, a great safety net, and a great network. (Not that all of that applies to me, but for sake of argument.) Certainly the job market is also tighter and the future of software engineering as a career is uncertain in some regards. So outright refusing to do work could be a scary prospect. Even being vocal about it and rocking the boat may be scary. But that said, this being the case does not make the answer any less certain. While harassment and toxicity that crosses certain lines is not something I think people should justify, I certainly understand the why: working on something like WEI triggers an immune response from the proponents of the open web. And while I'm sure many people would prefer to do things "right", I think that there is an overwhelming feeling that the open web is hostage to the big corporate interests, and that the open web proponents are strongly outnumbered and outgunned in the modern world. And Google never played fair anyway, so they probably don't feel especially enticed to either. So I think it's natural. What's going to happen is that this will probably continue to escalate, and I can't really say I strongly blame anyone. Google is probably happy to push this responsibility onto employees knowing it could be very mentally taxing, employees with increasingly poor career prospects will not want to rock the boat, and disgruntled "internet activists" who feel pushed to their limits are unlikely to care tremendously about the emotional damage they cause (it's not like the Internet is really known for its kindness to begin with.) I'm thinking it's gonna be a good time to pivot away from computer careers these next few years...
deleted 3y ago
[deleted]
gardenhedge 3y ago
Nonsense and an excuse to ignore any criticism they don't like
Pannoniae 3y ago
I'm sorry for the raw words but this is soy as fuck. This is the usual excuse of "well, we got harassment (which we totally deserved) so we are finally justified to do <bad thing>"... These companies present it like harassment and threats just come out of nowhere because people are unreasonable or "hateful", and they refuse to acknowledge they deliberately create the conditions for such extreme measures. If they don't want harassment or threats, they should maybe stop messing with people's stuff...

jeffparsons 3y ago

It will be back. Somewhere along the line the kinds of people who push these sorts of things realised that it doesn't matter if everyone hates the thing and it gets temporarily "defeated". If you can afford to keep reinventing the same thing under another name, you can get the outcome you want through sheer persistence. See also: surveillance laws.

deleted 3y ago
[deleted]
AnthonyMouse 3y ago
The key is to keep aggressively attacking the ones that already exist. If they have to be constantly vigilant to things from getting better, they won't have as much time to spend trying to make it worse. And sometimes they'll lose and you'll actually make things better.
- marak830 3y ago
  The tiring part is that, we have to be vigilant and won every time. They have to win once. The tables are stacked against us.
  - rightbyte 3y ago
    Why are you assuming bad decisions can't be reversed?
    - troupo 3y ago
      It takes too long for them to be reversed, and by that time the damage is done.
ryandrake 3y ago
See also: any unpopular law. It has to be fought and defeated every time, but only has to succeed and pass once.

danShumway 3y ago

> Instead, the Android team aims to focus on the Android WebView Media Integrity API, which provides a similar form of attestation but only for WebViews embedded in Android apps. I'm not as dismissive of this as the Register is; it's definitely less harmful than the original proposal, but it's still DRM, and now it's no longer going through a standards process so we just don't have a ton of details about how it will work. I honestly feel like this announcement should probably be getting more skepticism than I've seen from the news sites reporting it. I'm not saying it's just as bad, I'm just saying we should question how much this is going to help security for end users or whether this is just going to to turn into more DRM to let embedded webapps act like native apps.

magicalist 3y ago
WebViews can already be given access to literally anything you want to give them from your app you embedded them in, so I don't see any fundamental change? It's basically a new android DRM API, of which there are already several.
- danShumway 3y ago
  I wonder how hard it would have been before this to simulate the same API using the Play Integrity API and just exposing it to the webview. Is that something where the remote server would still have to trust the client to not lie about the API, or could they do an attestation check remotely in a way that would be difficult to fake?
  - matheusmoreira 3y ago
    Remote attestation happens in hardware now. Significantly harder to fake.
    - danShumway 3y ago
      Can you elaborate? I'm not sure I understand what you mean by "now". What I'm asking is whether or not the Play Integrity API supports remote attestation on its own today (ie, before any of the webview changes ship). Or I guess, more specifically, is there a challenge-response API currently for the Play Integrity API that a remote server could use? If yes, then sure, I buy that this is not really adding anything new. If no, then adding a webview API does seem to me like a meaningful expansion of Android's DRM capabilities.

mindwok 3y ago

After reading through the proposal, I really don't think it was that bad. As a recap, websites never see any information about your device but basically receive a 'thumbs-up' from a trusted provider that your browser is 'likely' to be a human agent and untampered with. There is definitely the potential for it to go quite badly if Google ends up as the sole trust source, but if it was executed well I could see a situation where it ends up similar to TLS, where there are a relatively large number of trusted providers including some like LetsEncrypt that are non-profit and considered a public good. In that sense it would allow quite a bit of flexibility in what 'untampered' means based on the trust source which would be a good thing. IMO the dialogue around this was incredibly disappointing. I understand and support the hesitation around a proposal like this that could do harm to the web, but people were basically attacking these people and having meltdowns in the GitHub comments. Given how much large platforms have struggled to fight bots, and that it's only going to get worse with the rise of AI, I think something like this is going to end up being a necessity eventually. This won't be the last we will see of something like this.

j0hnyl 3y ago
I absolutely agree that it's very much a big nothing burger compared to the reaction it got.
- saltymug76 3y ago
  [flagged]
danShumway 3y ago
> In that sense it would allow quite a bit of flexibility in what 'untampered' means based on the trust source which would be a good thing. The problem is that the APIs for botting are the same APIs that are used for browser automation and extension support and that are implemented by experimental browsers that are building new tools for the web. You're correct to bring up that people didn't trust Google; that's part of it. But there's a more fundamental problem: there is no way to restrict someone from using APIs to automate a browser without also killing a lot of more traditionally accepted use-cases for those APIs. Every accessibility API and presentation API is an adblocking API. Every web extension and request redirector is a bot API. Google didn't seem to understand this; they came into the discussion believing that as long as they could get people to believe Google wouldn't abuse the API, everything would be fine (whether or not that was an honest claim is another discussion, the problems with WEI were numerous). But beyond the discussions of Google's motivations, at a fundamental level what critics were saying was that there was no such thing as a working version of this API that would be effective at reducing bots without reducing user freedom. Making the API more Open or getting more implementers on board wouldn't change that. It simply isn't possible to truthfully verify to a server that a user environment is "trusted" without blocking the user from accessing normal browser APIs.

xeonmc 3y ago

Great. Now kill WebHID and WebUSB next.

djbusby 3y ago
WebUSB is pretty useful for web-based POS. Scanner and printer integrations.
- surajrmal 3y ago
  It's great for a lot of use cases. We use it to enable a cross platform device flashing tool. Much easier to build and distribute than native applications for all platforms we need to support. Serial is similarly useful for getting logs off of devices.
- nicman23 3y ago
  you know what is better? a upstream kernel driver
  - djbusby 3y ago
    I think you don't understand the use case. Kernel drivers don't connect the USB device to the JavaScript in the web-app.
    - nicman23 3y ago
      that whole sentence is disgusting
- tremon 3y ago
  But why should web-based POS be better than dedicated devices?
  - ultimatt42 3y ago
    That's the wrong comparison. We used to only have dedicated POS systems, now we have the option to run POS software on a general purpose computing device. The question is why should that POS software be a native app instead of a web app?

xvector 3y ago

The security engineer in me loved this proposal, the privacy/FOSS enthusiast in me hated it.

rightbyte 3y ago
I read the proposal to be a way for sites to execute a hash function on my ram? It sounds like a security nightmare.
- hurryer 3y ago
  It could ensure that an employee laptop is not infected when connecting to the intranet which could prevent customer data leakage which would be a benefit for all of us.
  - rightbyte 3y ago
    Such a scan would take like half an hour. You need to scan each unloaded executable. WEI won't be used for that. It will be used for blocking ad blockers and ensure Google's malware is active. I am quite sure that the client programs need to be cooperating for the WEI to be practical.
  - drtgh 3y ago
    It would not ensure the laptop is not infected. It would only ensure that the laptop user does not run software that is not approved by Google or similar, a DRM, as Trojans will continue to find ways to disguise themselves and insert themselves into authorized processes. The company would find difficult to run custom software not covered by such DRM. In time, the Web Environment Integrity API organisation would say that there are too many authorisation requests or similar and demand economic compensation from developers to be included in the authorized filter scans, at time the supposed initial objective is not accomplished, as this DRM does not ensure the laptop is not infected.
    - hurryer 3y ago
      In was speaking in general about remote attestation, not about the Chrome only one. A good example is Xbox, for which there is no known custom software, which in turn guarantees the lack of cheating software.

figassis 3y ago

With ideas like this, it may often be just as dangerous to publish them in the first place. Governments are now aware of it (including Apple's CSAM tech). How long until they start mandating this from browser/phone makers?

master-lincoln 3y ago
What interest would a government have in getting something like the "Web Environment Integrity" API?
- figassis 3y ago
  Create a blacklist of websites built into browsers for one. Would defeat VPNs and other techniques for the average users.
  - master-lincoln 3y ago
    Afaik most governments don't build browsers. How would this defeat VPNs? As far as I understood this API allows websites to make sure they run on unmodified browsers. The underlying network stack is not checked.
jillesvangurp 3y ago
The more relevant question is when governments will force Apple and Google to open up their app stores. Particularly Apple is enforcing a monopoly on browser engines by not allowing applications to use anything else than Safari on IOS. Google isn't much better and is forcing OEMs into, arguably, illegal licensing deals where they are required to ship Google apps. Breaking that monopoly will change the mobile web landscape.
- Eggpants 3y ago
  While they are at it, they can force PlayStation and Xbox to sell each others games on their closed systems. Then force Walmart to allow Target to open a kiosk rent free in their stores… Closing an adtech attack vector by restricting the browser engine on a device they paid all the R&D for to develop doesn’t make Apple a monopoly.

fmajid 3y ago

They'll rename it and reintroduce it subrepticiously, just as they did with ~~FLoC~~ Topics API.

whywhywhywhy 3y ago
> Topics API Really messed up having something so far reaching and giving it such an innocuous name a normal person couldn't possibly understand the implications of. Definitely an evil mind behind that one.
dsr_ 3y ago
"surreptitiously"
- coldacid 3y ago
  Maybe the GP is also insinuating that Google is full of reptilians?
  - fmajid 3y ago
    No, just a native French speaker, where the root word is "subreptice".
    - dsr_ 3y ago
      In the time honored way of English, we stole it from you and changed the spelling to match our crummy pronunciation.
      - fmajid 3y ago
        Well, it happened sometime after 1652: https://www.dsl.ac.uk/entry/dost/surreptitiously https://www.dsl.ac.uk/entry/dost/surreptitiously
        dsr_ 3y ago
        Also in the time-honored way of English, we didn't really standardize spelling for another 200 years. Then we started being really pedantic.

al_be_back 3y ago

let's be honest, WEI & similar are poor approaches to solve market-issues framed wrongly as a "user problem". the problem is not the User wanting to download your content, bypassing ads, or spoofing Geo location using VPNs, or sharing of passwords. The real issue is with the Providers/Vendors relying on the Web as a Cheap Ways & Means to quickly access, conquer the market. The web is a generic platform, powered by general-purpose tech and methods, therefore it's "open", "cheap", and easily accessible, that's why it's popular and adopted globally. There are tradeoffs - choose web for being cheap, open and accessible, or chose to build expensive, risky custom standalone services.