Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So, you don't like a web platform proposal

blog.yoav.ws

Post reply on HN
Print view View original

41–50 of 114 posts

Re: So, you don't like a web platform proposal

#41

Post by jdiez17 »

mattlondon wrote: post #25
rtpg wrote: post #15

Since this is here and there is a point made about discussing the technical merits of [0]... can someone explain to me how the WEI stuff isn't easily "faked" by scrapers and the like? I could see this being used in a similar way to user agents (sometimes helpful when working on bugs and fixing them on minor platforms!), but I'm really struggling to see the overall value-add here. I get the politics aspect of it (I th…

I believe the idea is that an independent third party will cryptographically sign something to attest that the client is legit. So you can't fake that unless you have the third party's private key. If course the question is then, how does the attestation third party ensure you are sending it real information? I've not bothered to read the proposal because I don't care, but I suspect it will require client-side plugin…

> how does the attestation third party ensure you are sending it real information?

The WEI standard does not prescribe this, as far as I can tell. One way to do this would be to use something like Secure Boot (broadly speaking), which can make "independent" measurements of what is being executed and sign that with a private key that never leaves (something like) a TPM.

Re: So, you don't like a web platform proposal

#42

Post by creatonez »

jiggawatts wrote: post #22
sgammon wrote: post #12

Earlier quoted context omitted.

Can't you sign your own certificates? Whether people trust those is a different story. WAI is different because it breaks abstraction by asserting based on details which are otherwise invisible to the server.

> Can't you sign your own certificates? Self-signed certificates are banned in HTTP/2 onwards, which is really irritating when it is used for internal server-to-server communications. You have to set up a Root CA certificate and use that to sign a second certificate. It's the same thing but with extra steps.

Huh? Self-signed certificates work with HTTP/2 in every browser I've tried it in, it just uses the usual trust-on-first-use system where you have to click past a warning.

Re: So, you don't like a web platform proposal

#43

Post by yoavweiss_ »

Blog post author here.

A few clarifications:

* I am not a contributor to the repo, and stepped in as chair on the repo after writing this, to help the engineers contributing to it deal with clear spam & abuse cases. I wrote this post with WEI in mind, but nothing about it is specific to this proposal, and could've been applied to multiple past proposals (and probably future ones), either from Google or from other standards participants.

* Political/ecosystem arguments are technical arguments. See https://blog.yoav.ws/posts/web_platform_change_you_do_not_li...

* If you're objecting to the goals of the proposal [1], it'd serve you better to outline which goals are objectionable and why. Mozilla folks did a good job at articulating that in https://github.com/mozilla/standards-positions/issues/852#is...

A couple of things I should've included in that post and didn't:

* It's important to actually read and understand the proposal before objecting to it. For example, WEI has nothing to do with ad-blockers or DRM (in the sense that the content itself is not restricted, unlike EME). It does have real eco-system risks that the proposal would need to address before moving forward. Objecting to the latter makes sense. Objecting to the former is easy to dismiss as a misunderstanding.

* At the end of the day, in the case of Chromium, your goal is not necessarily to convince the proposal's proponents, but the API owners [2], many of whom are not Google employees.

[1] https://github.com/RupertBenWiser/Web-Environment-Integrity/... [2] https://blog.chromium.org/2019/11/intent-to-explain-demystif...

P.S. I'd love to discuss this with y'all like professional adults. Can we do that?

Re: So, you don't like a web platform proposal

#44

Post by FridgeSeal »

goku12 wrote: post #33
charcircuit wrote: post #18

Earlier quoted context omitted.

>The piece where the author suggests focusing on "technical arguments" when the issue at hand is fundamentally political is frankly laughable It is essentially just asking for constructive feedback. When people just say not to do it, insult the author, or make assumptions about the proposal that aren't true the comments are not actionable. Even if an issue is political you can still make a constructive argument on th…

Here's how they respond to 'constructive arguments': https://news.ycombinator.com/item?id=36855429 . Especially this part: https://danshumway.com/blog/chrome-autoplay/

From the first link:

> according to Google there's no such thing as a harmful feature and Google's approach is never wrong; it just might need refining

This is some grade-A toxic behaviour from google. It gives the same vibes as the infuriatingly phrased: “oh sweetly you just don’t understand”

Re: So, you don't like a web platform proposal

#45

Post by fsniper »

scrollaway wrote: post #21
charcircuit wrote: post #18

Earlier quoted context omitted.

>The piece where the author suggests focusing on "technical arguments" when the issue at hand is fundamentally political is frankly laughable It is essentially just asking for constructive feedback. When people just say not to do it, insult the author, or make assumptions about the proposal that aren't true the comments are not actionable. Even if an issue is political you can still make a constructive argument on th…

It’s asking for feedback the author knows how to deal with (and disregard). You know, if your government body of choice came up with a terrible idea in a draft bill and enraged the population, it would not be appropriate for them to go on TV and say “the population should offer constructive criticism in the form of legal arguments”. So what the fuck is this guy saying exactly, that you feel is a valid approach to han…

Exactly "give constructive and technical feedback" means "we will make this thing, either give feedback that would add to it in s technical way or shut up"

Re: So, you don't like a web platform proposal

#46

Post by sgammon »

jiggawatts wrote: post #22
sgammon wrote: post #12

Earlier quoted context omitted.

Can't you sign your own certificates? Whether people trust those is a different story. WAI is different because it breaks abstraction by asserting based on details which are otherwise invisible to the server.

> Can't you sign your own certificates? Self-signed certificates are banned in HTTP/2 onwards, which is really irritating when it is used for internal server-to-server communications. You have to set up a Root CA certificate and use that to sign a second certificate. It's the same thing but with extra steps.

That's still self-signing. So the extra steps are immaterial to the point.

Re: So, you don't like a web platform proposal

#47

Post by ashley93 »

yoavweiss_ wrote: post #43

Blog post author here. A few clarifications: * I am not a contributor to the repo, and stepped in as chair on the repo after writing this, to help the engineers contributing to it deal with clear spam & abuse cases. I wrote this post with WEI in mind, but nothing about it is specific to this proposal, and could've been applied to multiple past proposals (and probably future ones), either from Google or from other sta…

Your P.S. really shows that you are not really acting in good faith here. It might be good to take a step back and think about the reaction people are having. Consider the possibility that the problem might not be that the whole rest of the world is acting like toddlers, but rather that there is something fundamentally and objectively problematic with WEI and that the community is having a very strong negative reaction to it for some good reason.

Re: So, you don't like a web platform proposal

#48

Post by sgammon »

yoavweiss_ wrote: post #43

Blog post author here. A few clarifications: * I am not a contributor to the repo, and stepped in as chair on the repo after writing this, to help the engineers contributing to it deal with clear spam & abuse cases. I wrote this post with WEI in mind, but nothing about it is specific to this proposal, and could've been applied to multiple past proposals (and probably future ones), either from Google or from other sta…

> I am not a contributor to the repo, and stepped in as chair on the repo after writing this

Nobody is missing this; you're defending this work. You can't both defend the work itself and place yourself outside of the process as a "chair."

> If you're objecting to the goals of the proposal [1], it'd serve you better to outline which goals are objectionable and why

Many technologists don't have the clout or sometimes the charisma to explain within this rigid framework you have presented why this proposal is such a bad idea. That doesn't mean their feedback should be dismissed outright.

> It's important to actually read and understand the proposal before objecting to it. For example, WEI has nothing to do with ad-blockers or DRM

But it is DRM because it can be used, in effect, like DRM. You are missing the point that most of the community sees this as DRM-like technology, with all of its warts, whether you agree with that conclusion or not.

> At the end of the day, in the case of Chromium, your goal is not necessarily to convince the proposal's proponents, but the API owners

Okay, so, in summary, your points are that the feedback you've read is (1) not yours to address but you are addressing anyway, (2) not valuable within your own value framework (??), and (3) that the opposing viewpoints are misplaced in commenting on the repo which holds the proposal?

> I'd love to discuss this with y'all like professional adults. Can we do that?

Sure, when do you intend to start? Suggesting that opposing viewpoints are "unprofessional" prima-facie doesn't seem like the best way to win hearts and minds.

Edit: Yoav, I'd be happy to respond to you in good faith as I've done here once Hckrnews lets me post it.

Re: So, you don't like a web platform proposal

#50

Post by fsniper »

yoavweiss_ wrote: post #43

Blog post author here. A few clarifications: * I am not a contributor to the repo, and stepped in as chair on the repo after writing this, to help the engineers contributing to it deal with clear spam & abuse cases. I wrote this post with WEI in mind, but nothing about it is specific to this proposal, and could've been applied to multiple past proposals (and probably future ones), either from Google or from other sta…

Do you know why this proposal is over a public repo which is not a part of any official open web group discussion?

Why would anyone with legitimate concerns for unforseen consequences which would occur if the proposal or any descendants of it to turn to a standard would want to be constructive about it? Particularly considering the concern if they want to stop it on the tracks?

Why would you not like to get the legal related feedback, don't the legalities dictate technical constraints? Or do you think this would go on with or without being in the legal?

Post reply on HN