4 ms·

Agreed on hoping this is the inflection point, but only partial agreement that it's about adblock. For sure Google wants adblock to die, but I think it goes ev

Agreed on hoping this is the inflection point, but only partial agreement that it's about adblock. For sure Google wants adblock to die, but I think it goes even deeper than that. I think it's part of a much bigger trend in tech in general but also in Google: Removing user control. When you look at the "security" things they are doing, many of them have a common philosophy underpinning them that the user (aka device owner) is a security threat and must be protected against. Web integrity, Manifest v3, various DoH/DoT, bootloader locking, device integrity which conveniently makes root difficult/impossible, and more. To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. The next generation won't have the wonderful and fertile computing environment that we enjoyed, and it's (partly) your fault.

justanotheratom 2y ago
yes, iOS now restricts Apps from getting blanket access to their contacts, photos, and even clipboard. On the one hand, it does protect the user from malicious Apps that trick users into giving blanket access. On the other hand, they could have atleast done it like location access - where user still has an option to give blanket access. It is not fair that Siri is the only one that can access these things now.
- moi2388 2y ago
  It can. You can still give apps access to all of it with a single press. And manifest v3 makes things a bit more tedious but not impossible. There are other adblockers which still function just fine
- kstrauser 2y ago
  That's literally how iOS works today. If I go into Settings > Privacy & Security > Photos, I can give apps None, Limited Access, or Full Access. Same with Contacts, same with the clipboard (where the per-app choices are Ask, Deny, or Allow). > It is not fair that Siri is the only one that can access these things now. That would be true if it was, but it isn't.
kbolino 2y ago
It is important, I think, to understand that personal computing is just one part of the picture. "Enterprise" environments (governments, businesses, large organizations, etc.) have demanded many of these "features" even before Google started implementing them. Your workplace, by and large, does not want you, the replaceable person who happens to be sitting at the keyboard, to be in full control of the device that they own and which is connected to their network. Often this is made more explicit by the device just being a "thin client" or other totally locked down narrow viewport to some other computer you can't even touch. It sucks and the general trend of workplaces trusting their employees less and less has been demeaning and degenerative to the point of often fostering self-fulfilling prophecies of mistrust (don't trust anyone => get untrustworthy people => bad things happen => don't trust anyone => ...). However, it is important to also understand that the employee is not the only stakeholder. Government agencies answer to legislators, nonprofit management answer to donors, corporate management answer to investors, etc. There are layers of compliance that must be considered as well (internal policies, external regulations, different insurance costs, etc.). It is unsurprising that these fewer but generally deep-pocketed entities have an outsized influence on the market compared to more numerous but less moneyed end users. If you refuse to serve the former, you may quickly find yourself out of business.
- deleted 2y ago
  [deleted]
- EasyMark 2y ago
  Then they could have made Mv3 an option to turn on by sysadmins who lock down their browsers. If you aren’t locking down your users browsers then that’s on you. I mean at worst they could have made mv2 opt-in and most people would have highly curtailed their complaints of “I’ll jump ship to _____________” . People don’t like it when features are removed especially when there are viable alternatives like, adding a special tier of review to get mv2 approval for your extension, opt-in/out as discussed, easy access by sysadmins to turn it on/off. Instead google pulled a bully “so, pencil-neck, what are you gonna do about it?” instead. They are tone-deaf and see themselves as the new 800lb silverback on the block.
  - 2y ago
Cthulhu_ 2y ago
I get why they built in all of those protections; the vast majority of tech users are not knowledgeable about the details of the stuff they use. And I think a big chunk of those that are, overestimate their own abilities, knowledge, and control. They all need to be protected against themselves. That said, I don't like that the choice is being taken away. If you do want to tinker at that level with the technology you own, you should be given the choice. By all means make it not obvious how to get there - like, have people reboot their computers while playing Twister on their keyboards with interesting key combos, but give them the option.
Arch-TK 2y ago
The technologies themselves are mostly a good idea. The problem is that the companies designing them also like to abuse them. Take, for example, hardware attestation on android. There's not really any serious issue with this feature, it can be used to ensure your device is not compromised. This is for example how GrapheneOS enables its use with the auditor application. But, on the other hand, Google abuses the feature to ensure that you are running a google signed OS if you want to use Google Pay. Meanwhile you can use banking apps which also use hardware attestation (although, from their perspective, they don't use enough of it to ensure it isn't being spoofed, and even then...) without any problem on GOS. Moreover, before Google Pay completely killed all of its competition, it was possible to even find third party banks which would provide you with the ability to pay with your phone without using google pay. Likewise, secure boot is a great concept if you want to be more sure about the integrity of your laptop throughout its lifetime. But some companies have abused it to force you to use Windows. If you want to set up your own signing keys for secure boot, you end up having to deal with poorly managed UEFI keys from third parties which weaken the security of your machine. The feature, as it's implemented, is rarely designed with helping end user's secure their machines. But the core of the design is fine. I think limiting root on a phone is also a really good idea, the issue is that Google likes to give themselves and their "system apps" special privileges. If APIs were exposed to allow you to bless your own applications with the right permissions, you would probably not care so much about root restrictions. So all in all, fundamentally, most of these features are fine. They're genuinely great for security. But the main problem is how they're abuse by the companies in control and how little effort is put into allowing power-users to use those features for their own benefit.
- freedomben 2y ago
  No disagreement here, although if past experience has proven anything I think it's that companies will abuse whatever "security features" they can to accomplish their objectives. It reminds me a lot of the old adage, "the same wall can keep people in just like it can keep people out." When the OS is fundamentally in the user's control, they are limited in what they can do, but when the OS disregards it's owners preferences/desires and enforces it's creators desires. Minor thing actually: > If APIs were exposed to allow you to bless your own applications with the right permissions, you would probably not care so much about root restrictions. I absolutely agree with this in theory, but in practice I'm not sure it would ever work because they just aren't going to put in the work to build and maintain APIs for things they don't care about, and there would be a very long tail of things to do (and sometimes those things are legitimately a lot of work). Call recording being a classic example. But all in all, I very much agree. I love those features when they are in my control on my devices. Biggest issue is, they virtually never are and the number of occurences is trending down. Anyway,
kuhsaft 2y ago
> To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. That was a world where the user base was much more limited and devices were less capable. Now we have children, grandparents, educated, and uneducated users with access to web connected devices. These devices now contain everything about you. Compromise of a device can destroy someone’s life. Not only that, but compromise of a device can cause collateral damage to other devices on the same network. We now have to cater to every user. Not just to the technologically adept. Look at what people believe on social media. The bar is so low to con people into compromising their device.
- jauntywundrkind 2y ago
  Still a shit poor pathetic excuse to screw over the userscript/grease monkey users. The browser is called a user agent, but this shift to absolute security no matter what, no say about it is a shift to native apps, is a shift to the developer is in control, is a shift to this being Google and the sites browser, not ours, and that being done unilaterally with nearly no opt outs is the sort of mega tectonic shift that ruins this magical special unique place in software where users had some say in what was happening. We cannot pander to imagined ever worsening users forever. It feels like the things being done in the name of security are really building an immense prison. The work being done to allow verified age and identity checking ranks up there highly in the this corals humanity, area, not giving us agency.
  - kuhsaft 2y ago
    > Still a shit poor pathetic excuse to screw over the userscript/grease monkey users. Tampermonkey still works fine with MV3 > We cannot pander to imagined ever worsening users forever. The most popular software/hardware will always pander to the most users. That’s why they’re the most popular. You can’t complain about the most popular option pandering to the most users. Well, you can complain, but you might be in the minority of the users. > It feels like the things being done in the name of security are really building an immense prison. I get that, but we are running so much untrusted code on our machines now. Applications that use thousands of dependencies with the hope that someone spots a bad actor.
pipo234 2y ago
> To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. I recently quit my job, developing among others the means to "protect" media using DRM. While this was not a primary motivation, I'm glad to somewhat clean my hands. The technology (dubbed Common Encryption) is a bunch of smoke and mirrors that a childishly easy to hack around. Yet clearly aimed against good faith consumers.
- immibis 2y ago
  That's a good job - people who don't like DRM (you) get more money, and the bad DRM is a distraction that delays the implementation of good DRM.
  - account42 2y ago
    On the other hand, even weak DRM trains users to accept it while power users are less likely to rally against it if they can find workarounds for themselves. So you don't really end up delaying the implementation of good DRM but helping prime its acceptance.
shadowgovt 2y ago
Their incentive is really to make the Chrome Web Store a tractable problem with minimal human effort. That's about 75% of the incentive. You can't actually make any guarantees at the CWS level regarding safety of audited code if the API allows audited code to execute non-audited code. > To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. May I be blunt? I grew up in it, so yes. I am. I was there for the Windows virus wildfires. I was there for the malware distribution schemes. I was there for the first wave of enshittification. For the dotcom crash. For the spam wars. For the search engines that didn't work. For the JavaScript injection attacks. For the world where "nobody knew you were a dog" as long as you didn't talk like yourself. I couldn't trust most of my relatives to use a computer the way we had to use them in the late '90s / early aughts. That's not a problem now. For all its flaws, the modern system is cleaner, simpler, faster, and better for end users and no longer requires them to be super-nerds (and meanwhile, open and malleable devices are still there for the super-nerds to play with and work with). This was the goal---to make computers something that benefit everyone, not just the technorati and the priest-class. May the past become a foreign country, hard for the modern mind to comprehend. May it always be so.
userbinator 2y ago
I think it's part of a much bigger trend in tech in general but also in Google: Removing user control. When you look at the "security" things they are doing, many of them have a common philosophy underpinning them that the user (aka device owner) is a security threat and must be protected against. IMHO that's actually part of an even bigger societal trend. "You will own nothing and be happy." The ones in power want to control everyone and turn them into mindless sheeple to be exploited and milked. It's not just tech. There's another comment around here that mentions features being requested by large corporations and governments.
cookiengineer 2y ago
You should stop seeing the Browser as a software as a program that's controlled by the user. This idea was over when Microsoft started to display ads in the file manager program (explorer). The modern Web Browser is an advertisement terminal. If Google would manage to eliminate having to serve content, they would certainly do it.
akira2501 2y ago
> and it's (partly) your fault Punching down into a brutal labor environment instead of punching up into a Congress which was blatently bought off to foment this outcome? Odd choice.

justanotheratom 2y ago

yes, iOS now restricts Apps from getting blanket access to their contacts, photos, and even clipboard. On the one hand, it does protect the user from malicious Apps that trick users into giving blanket access. On the other hand, they could have atleast done it like location access - where user still has an option to give blanket access. It is not fair that Siri is the only one that can access these things now.

moi2388 2y ago
It can. You can still give apps access to all of it with a single press. And manifest v3 makes things a bit more tedious but not impossible. There are other adblockers which still function just fine
kstrauser 2y ago
That's literally how iOS works today. If I go into Settings > Privacy & Security > Photos, I can give apps None, Limited Access, or Full Access. Same with Contacts, same with the clipboard (where the per-app choices are Ask, Deny, or Allow). > It is not fair that Siri is the only one that can access these things now. That would be true if it was, but it isn't.

kbolino 2y ago

It is important, I think, to understand that personal computing is just one part of the picture. "Enterprise" environments (governments, businesses, large organizations, etc.) have demanded many of these "features" even before Google started implementing them. Your workplace, by and large, does not want you, the replaceable person who happens to be sitting at the keyboard, to be in full control of the device that they own and which is connected to their network. Often this is made more explicit by the device just being a "thin client" or other totally locked down narrow viewport to some other computer you can't even touch. It sucks and the general trend of workplaces trusting their employees less and less has been demeaning and degenerative to the point of often fostering self-fulfilling prophecies of mistrust (don't trust anyone => get untrustworthy people => bad things happen => don't trust anyone => ...). However, it is important to also understand that the employee is not the only stakeholder. Government agencies answer to legislators, nonprofit management answer to donors, corporate management answer to investors, etc. There are layers of compliance that must be considered as well (internal policies, external regulations, different insurance costs, etc.). It is unsurprising that these fewer but generally deep-pocketed entities have an outsized influence on the market compared to more numerous but less moneyed end users. If you refuse to serve the former, you may quickly find yourself out of business.

deleted 2y ago
[deleted]
EasyMark 2y ago
Then they could have made Mv3 an option to turn on by sysadmins who lock down their browsers. If you aren’t locking down your users browsers then that’s on you. I mean at worst they could have made mv2 opt-in and most people would have highly curtailed their complaints of “I’ll jump ship to _____________” . People don’t like it when features are removed especially when there are viable alternatives like, adding a special tier of review to get mv2 approval for your extension, opt-in/out as discussed, easy access by sysadmins to turn it on/off. Instead google pulled a bully “so, pencil-neck, what are you gonna do about it?” instead. They are tone-deaf and see themselves as the new 800lb silverback on the block.
- 2y ago

Cthulhu_ 2y ago

I get why they built in all of those protections; the vast majority of tech users are not knowledgeable about the details of the stuff they use. And I think a big chunk of those that are, overestimate their own abilities, knowledge, and control. They all need to be protected against themselves. That said, I don't like that the choice is being taken away. If you do want to tinker at that level with the technology you own, you should be given the choice. By all means make it not obvious how to get there - like, have people reboot their computers while playing Twister on their keyboards with interesting key combos, but give them the option.

Arch-TK 2y ago

The technologies themselves are mostly a good idea. The problem is that the companies designing them also like to abuse them. Take, for example, hardware attestation on android. There's not really any serious issue with this feature, it can be used to ensure your device is not compromised. This is for example how GrapheneOS enables its use with the auditor application. But, on the other hand, Google abuses the feature to ensure that you are running a google signed OS if you want to use Google Pay. Meanwhile you can use banking apps which also use hardware attestation (although, from their perspective, they don't use enough of it to ensure it isn't being spoofed, and even then...) without any problem on GOS. Moreover, before Google Pay completely killed all of its competition, it was possible to even find third party banks which would provide you with the ability to pay with your phone without using google pay. Likewise, secure boot is a great concept if you want to be more sure about the integrity of your laptop throughout its lifetime. But some companies have abused it to force you to use Windows. If you want to set up your own signing keys for secure boot, you end up having to deal with poorly managed UEFI keys from third parties which weaken the security of your machine. The feature, as it's implemented, is rarely designed with helping end user's secure their machines. But the core of the design is fine. I think limiting root on a phone is also a really good idea, the issue is that Google likes to give themselves and their "system apps" special privileges. If APIs were exposed to allow you to bless your own applications with the right permissions, you would probably not care so much about root restrictions. So all in all, fundamentally, most of these features are fine. They're genuinely great for security. But the main problem is how they're abuse by the companies in control and how little effort is put into allowing power-users to use those features for their own benefit.

freedomben 2y ago
No disagreement here, although if past experience has proven anything I think it's that companies will abuse whatever "security features" they can to accomplish their objectives. It reminds me a lot of the old adage, "the same wall can keep people in just like it can keep people out." When the OS is fundamentally in the user's control, they are limited in what they can do, but when the OS disregards it's owners preferences/desires and enforces it's creators desires. Minor thing actually: > If APIs were exposed to allow you to bless your own applications with the right permissions, you would probably not care so much about root restrictions. I absolutely agree with this in theory, but in practice I'm not sure it would ever work because they just aren't going to put in the work to build and maintain APIs for things they don't care about, and there would be a very long tail of things to do (and sometimes those things are legitimately a lot of work). Call recording being a classic example. But all in all, I very much agree. I love those features when they are in my control on my devices. Biggest issue is, they virtually never are and the number of occurences is trending down. Anyway,

kuhsaft 2y ago

> To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. That was a world where the user base was much more limited and devices were less capable. Now we have children, grandparents, educated, and uneducated users with access to web connected devices. These devices now contain everything about you. Compromise of a device can destroy someone’s life. Not only that, but compromise of a device can cause collateral damage to other devices on the same network. We now have to cater to every user. Not just to the technologically adept. Look at what people believe on social media. The bar is so low to con people into compromising their device.

jauntywundrkind 2y ago
Still a shit poor pathetic excuse to screw over the userscript/grease monkey users. The browser is called a user agent, but this shift to absolute security no matter what, no say about it is a shift to native apps, is a shift to the developer is in control, is a shift to this being Google and the sites browser, not ours, and that being done unilaterally with nearly no opt outs is the sort of mega tectonic shift that ruins this magical special unique place in software where users had some say in what was happening. We cannot pander to imagined ever worsening users forever. It feels like the things being done in the name of security are really building an immense prison. The work being done to allow verified age and identity checking ranks up there highly in the this corals humanity, area, not giving us agency.
- kuhsaft 2y ago
  > Still a shit poor pathetic excuse to screw over the userscript/grease monkey users. Tampermonkey still works fine with MV3 > We cannot pander to imagined ever worsening users forever. The most popular software/hardware will always pander to the most users. That’s why they’re the most popular. You can’t complain about the most popular option pandering to the most users. Well, you can complain, but you might be in the minority of the users. > It feels like the things being done in the name of security are really building an immense prison. I get that, but we are running so much untrusted code on our machines now. Applications that use thousands of dependencies with the hope that someone spots a bad actor.

pipo234 2y ago

> To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. I recently quit my job, developing among others the means to "protect" media using DRM. While this was not a primary motivation, I'm glad to somewhat clean my hands. The technology (dubbed Common Encryption) is a bunch of smoke and mirrors that a childishly easy to hack around. Yet clearly aimed against good faith consumers.

immibis 2y ago
That's a good job - people who don't like DRM (you) get more money, and the bad DRM is a distraction that delays the implementation of good DRM.
- account42 2y ago
  On the other hand, even weak DRM trains users to accept it while power users are less likely to rally against it if they can find workarounds for themselves. So you don't really end up delaying the implementation of good DRM but helping prime its acceptance.

shadowgovt 2y ago

Their incentive is really to make the Chrome Web Store a tractable problem with minimal human effort. That's about 75% of the incentive. You can't actually make any guarantees at the CWS level regarding safety of audited code if the API allows audited code to execute non-audited code. > To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. May I be blunt? I grew up in it, so yes. I am. I was there for the Windows virus wildfires. I was there for the malware distribution schemes. I was there for the first wave of enshittification. For the dotcom crash. For the spam wars. For the search engines that didn't work. For the JavaScript injection attacks. For the world where "nobody knew you were a dog" as long as you didn't talk like yourself. I couldn't trust most of my relatives to use a computer the way we had to use them in the late '90s / early aughts. That's not a problem now. For all its flaws, the modern system is cleaner, simpler, faster, and better for end users and no longer requires them to be super-nerds (and meanwhile, open and malleable devices are still there for the super-nerds to play with and work with). This was the goal---to make computers something that benefit everyone, not just the technorati and the priest-class. May the past become a foreign country, hard for the modern mind to comprehend. May it always be so.

userbinator 2y ago

I think it's part of a much bigger trend in tech in general but also in Google: Removing user control. When you look at the "security" things they are doing, many of them have a common philosophy underpinning them that the user (aka device owner) is a security threat and must be protected against. IMHO that's actually part of an even bigger societal trend. "You will own nothing and be happy." The ones in power want to control everyone and turn them into mindless sheeple to be exploited and milked. It's not just tech. There's another comment around here that mentions features being requested by large corporations and governments.

cookiengineer 2y ago

You should stop seeing the Browser as a software as a program that's controlled by the user. This idea was over when Microsoft started to display ads in the file manager program (explorer). The modern Web Browser is an advertisement terminal. If Google would manage to eliminate having to serve content, they would certainly do it.

akira2501 2y ago

> and it's (partly) your fault Punching down into a brutal labor environment instead of punching up into a Congress which was blatently bought off to foment this outcome? Odd choice.