Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For • Hacker News Board

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#161

Post by trogdolon » Thu, Aug 03, 2023, 10:38 AM UTC

cowl wrote: post #153

dns_snek wrote: post #139

Earlier quoted context omitted.

> It seems Everyone is taking for granted the claim that this is about DRM. The claim is that websites (not Google) will use this signal to allow or deny access but this is already possible with various means. How about you offer a reasonable opposing viewpoint? It's hard to see this, at best, as anything other than an extremely naive viewpoint. Every feature that can be used to lock down content and/or spy on users,…

> How about you offer a reasonable opposing viewpoint Read the proposal: https://github.com/RupertBenWiser/Web-Environment-Integrity/... >That's settled then. Full filesystem, location, camera, and microphone access should therefore come on by default without a permission dialog. Why not bring back Java and Flash while we're at it! It's not the browser vendor's fault that websites are misusing it. Now who is arguing…

> if you for example would trust let's say Opera as the attester, Opera would need to trust windows or Linux or Android as the OS attester.

But it's not the user ("you") deciding which attesters to trust - it's website operators. And they will choose to trust only attesters that meaningfully (cryptographically) verify the user's client environment, including the secure boot chain, OS, and browser. Otherwise the attestation can be spoofed, in why case why would they bother using the EnvironmentIntegrity API at all?

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#162

Post by cowl » Thu, Aug 03, 2023, 10:42 AM UTC

Adverblessly wrote: post #156

cowl wrote: post #92

It seems Everyone is taking for granted the claim that this is about DRM. The claim is that websites (not Google) will use this signal to allow or deny access but this is already possible with various means. Google or any other Browser vendor do not have a say on how websites use or misuse features. > There is a tension between utility for anti-fraud use cases requiring deterministic verdicts and high coverage, and t…

You know this is about DRM because that is explicitly the stated goal of this move. Apologies for just repeating a previous post I made about this but: The first goal of the proposal is to > Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device. That is, to give web servers the ability to Digitally restrict (or Manage) a user's Rig…

DRM is not about access or not (that can and is being done with simple authenticated content). DRM is about what you can do with SPECIFIC contents. The MANAGE part in DRM. Netflix requiring you to login to view a movie is not DRM. Netflix offering a way to content owners to specify for example this movie can be seen but not download or this movie can be seen only once or this movie can not be fastforwarded, that is DRM. DRM means Publishers decide how their content gets consumed (on a case by case and publisher by publisher case).

Nothing in this proposal gives publishers those means (beyond what is currently available). Verifying the authenticity of a device in this case is a generic "trusted/not trusted" not "OK for movie 123/KO for skipping on movie 456"

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#163

Post by greyface- » Thu, Aug 03, 2023, 10:47 AM UTC

Animats wrote: post #17

It's time to start lobbying hard for an antitrust breakup of Google. This DRM plan, as abuse of a monopoly position, provides more political coverage for a forced breakup. It's pretty clear how to break up Alphabet, because it grew mostly by acquisition. - Google - search, ads on search pages and nothing more. - DoubleClick - third party ads on other sites. - Analytics - services to web sites. - Cloud - the money-los…

> Cloud [...] sold to [...] Hurricane Electric

I'm a customer of both GCP and HE and this would be a really, really weird merger. Not saying I don't want to see it. :)

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#164

Post by progbits » Thu, Aug 03, 2023, 10:47 AM UTC

NoobPretender wrote: post #143

offices wrote: post #138

Earlier quoted context omitted.

Are there any cool companies left? I think consumers and employees have become more cynical. - OpenAI is already 'evil'. - Apple has staying power but I still wouldn't consider it cool anymore. - Likewise Tesla.

What did OpenAI do? I know they refused to share their proprietary model even though they're called "Open", is this what you're referring to?

https://news.ycombinator.com/item?id=35960125

Regulatory capture attempts to prevent others from releasing actually-open models.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#165

Post by pydry » Thu, Aug 03, 2023, 10:48 AM UTC

samwillis wrote: post #49

Animats wrote: post #17

It's time to start lobbying hard for an antitrust breakup of Google. This DRM plan, as abuse of a monopoly position, provides more political coverage for a forced breakup. It's pretty clear how to break up Alphabet, because it grew mostly by acquisition. - Google - search, ads on search pages and nothing more. - DoubleClick - third party ads on other sites. - Analytics - services to web sites. - Cloud - the money-los…

This may seem like a good idea but so much of Google's power comes from the Search + Search Ads monopoly. That is where they are anticompetitive to the max, that is where a change needs to happen. Splitting everything else off doesn't solve the core problem. Within Search + Search Ads you have a platform where Google are/have: - the sole vendor of a digital asset - ads - the sole marketplace for that asset - a closed…

The ideal breakup would be between search engine and index.

The index should be treated as a utility like water or electric that search engines purchase access to for a regulated fee.

You can then have a thousand competing search engines started in garages with their own ranking algorithms and ads but realistically there are only ever going to be a few indexes. Thats the part that requires enormous data centers and dedicated power stations to run.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#166

Post by majani » Thu, Aug 03, 2023, 10:49 AM UTC

worrycue wrote: post #47

rplnt wrote: post #25

Google might have pretended to stood for something, but they have been an evil corporation since they have been a corporation. That's what corporations do by design. One relevant example is that they've been doing the "only for ie5+" with their services for 10+ years now. They killed most of their browser competition not by having a good product, but by having or buying up good services that they used to force chrome…

That’s not how I remembered it. Chrome really was a good browser and I would argue is still a good browser (for now). IE got displaced by Firefox’s predecessors because MS got caught napping - they disbanded the IE team thinking they have won. Firefox simply got outcompeted by Chrome as Google went crazy making it faster and faster. Firefox fell behind often enough that Chrome managed to take almost all of its market…

Being the better browser helped gain initial momentum in the 2000s with desktop users, but they took the lead once they made Chrome the default browser in Android. The majority of software users don't change their default settings

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#167

Post by tgv » Thu, Aug 03, 2023, 10:50 AM UTC

worrycue wrote: post #134

tgv wrote: post #87

Earlier quoted context omitted.

I think it was clear when they started with Google docs that they were using their browser to get market domination. They offered a free product that people liked, but almost forced them to switch to Chrome. They got entire nations to switch their education tooling to chrome and google docs. Now they keep adding features that enable bad developers to create websites that don't work properly in Firefox and Safari. The…

Google’s web products have always worked with Firefox to my knowledge. Maybe they run a bit faster on Chrome but I don’t recall them ever being broken on Firefox. Perhaps I’m wrong. Can you cite incidents of Google’s stuff not working right on Firefox (or Safari even). Also which features enable developers to create sites that don’t work in Firefox and Safari? (I really don’t know. I’m not a web developer.)

I'm a lifelong FF user, and I had problems with google docs in the beginning. I vaguely remember it was using JS features that FF hadn't implemented yet.

Currently, Chrome has a number of CSS features that Firefox and/or Safari don't support. You can find them at [1]. Some make life a bit easier, and devs use them because they like easy or even because they think everyone should force their browser maker to adapt all those features ASAP.

In an old thread, I explained that my code ignores these features because we want to be compatible with as many users as possible. I got some miffed replies saying we should make our users upgrade. Really.

Then there are also APIs in Chrome that have not been standardized, and some of which should not be in a browser (IMO), like USB access (see [2]). Some of that is an attempt by Google to replace "native" applications by web pages, which would give them even more leverage.

[1] https://caniuse.com/?compare=chrome+115,firefox+116&compareC... [2] https://caniuse.com/?compare=chrome+115,firefox+116&compareC...

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#168

Post by bregma » Thu, Aug 03, 2023, 10:52 AM UTC

midoridensha wrote: post #119

hutzlibu wrote: post #65

Earlier quoted context omitted.

"Microsoft could fund chromium based on their use in Edge. Etc…" Microsoft surely will continue to develope edge. That is my main issue with this thing, because they surely would like to be the one with the dominating browser again and if google has to drop chromium, Microsoft will just overtake it. Antitrust and breakup is not a simple thing to do right.

The problem I see with this idea is that MS doesn't really have much leverage to push Edge on people any more. People aren't just using Windows PCs for their web browsing these days; lots of people are using mobile devices, and many don't even have PCs any more. Google and Apple control the mobile device market (roughly half and half, though it depends on which country you're in too). If a bunch of websites suddenly…

I sometimes have to use Microsoft Teams at work. Microsoft Teams requires Microsoft Edge to run. I was forced to install Microsoft Edge on my Ubuntu machine. Microsoft is pushing its Microsoft Edge product even on GNU/Linux.

There are indeed the end times. I just saw cats lie down with dogs.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#169

Post by dns_snek » Thu, Aug 03, 2023, 10:56 AM UTC

cowl wrote: post #153

dns_snek wrote: post #139

Earlier quoted context omitted.

> It seems Everyone is taking for granted the claim that this is about DRM. The claim is that websites (not Google) will use this signal to allow or deny access but this is already possible with various means. How about you offer a reasonable opposing viewpoint? It's hard to see this, at best, as anything other than an extremely naive viewpoint. Every feature that can be used to lock down content and/or spy on users,…

> How about you offer a reasonable opposing viewpoint Read the proposal: https://github.com/RupertBenWiser/Web-Environment-Integrity/... >That's settled then. Full filesystem, location, camera, and microphone access should therefore come on by default without a permission dialog. Why not bring back Java and Flash while we're at it! It's not the browser vendor's fault that websites are misusing it. Now who is arguing…

> Read the proposal

I have, and that is not a viewpoint unless you wrote the proposal.

> if you have read the proposal, it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them.

The goal of the proposal is strictly incompatible with our freedoms. After all, restricting which devices, environments and software we're allowed to use to visit the website is the entire point of this proposal, is it not?

> again there is no such thing proposed. The "attester" is not specifically Google. anyone can become an "attester". The chain of trust is a chain that trusts tokens not specific "things". if you for example would trust let's say Opera as the attester, Opera would need to trust windows or Linux or Android as the OS attester.

So what? Even if this were true in any practical sense, as a user I have no control over which attesters the website trusts - and they will require attestation from parties that attest that I'm running the latest version of Windows or MacOS with Spyware version 5.49.182 installed, and another party that attests that their ads are visible in my framebuffer.

That won't happen immediately, of course, it would be much too obvious. But introduction of WEI establishes a clear path forward towards that reality. Once WEI is in place, the chain of trust will continuously creep up the stack until everything from the TPM chip up to your framebuffer and display is locked down. They'll slowly boil the frog, like they always do.

> The analogy here is the certificate Authorities. You may very well have a "let's encrypt" attester that democratizes the good parts (certification) without the bad parts (too much information) .

That's a terrible analogy. For one, the only thing TLS server certificates attest to is that I *the user* am connected to the *server* that I intended to connect to.

A better analogy would be mandatory TLS client certificates which would attest that I'm John Doe, underage, registered to reside in a country where the legal drinking age is 18, warning the websites that my juvenile criminal record is spotty. That's what WEI is comparable to, and you'd see a similar level of pushback if that's what was being introduced.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#170

Post by getoffmyyawn » Thu, Aug 03, 2023, 10:56 AM UTC

To me it really seems like it is too late.

I have the strong impression that the vast majority of people simply do not care and mostly don't even want to know.

Most of the people I know are in this group. When they ask why I won't install the latest app they are playing with, they often cut me off before I even finish explaining. They seriously don't care about privacy, lock-in, loss of access to resources, right to repair, etc.

Personally, I'm investing as much time as I can in learning the alternatives: Gemini, Fediverse apps, Linux phones, etc. That combined with having a "mainstream" laptop that is used only for banking and similar life critical services that has nothing else installed and otherwise stays turned off.