Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

Politicians would never break up Standard Oil or Bell Telephone either.

Another piece of evidence that consumers should not put blind trust in any company. Looking at Apple users here.

> There’s reasoning if you can actually see what’s happening.

You can't see what's happening though, because JP Morgan "mistakenly" deleted 47 million emails. [0] Their fine for that came to about 12 minutes worth of revenue.

They "failed" to keep records, firm-wide, right to the top. [1] Again, their punishment was at the "cost of doing business" level.

We're talking about the bank that financed and enabled Epstein here [2].

There are other ways to provide liquidity without relying on these ghoulish overlords who manipulate global markets [3] and finance blackmail operations.

0 - https://www.reuters.com/legal/jpmorgan-chase-is-fined-by-sec...

1 - https://www.sec.gov/news/press-release/2021-262

2 - https://trendingpoliticsnews.com/breaking-attorney-general-t...

3 - https://www.cftc.gov/PressRoom/PressReleases/8260-20

> DRM is not about access or not (that can and is being done with simple authenticated content). DRM is about what you can do with SPECIFIC contents. The MANAGE part in DRM.

Sure, if you redefine DRM to mean whatever you want it to mean, this is not DRM. I'm not even sure what authentication has to do with it if you prevent access to your website before I even got a chance to see it.

> Netflix requiring you to login to view a movie is not DRM.

Not sure where you came up with this strawman, I said nothing about requiring you to log in.

I said "access content on a device and software stack of their choice.", so for example, limiting streaming quality to 720p on Linux, or blocking a user using FireFox, or blocking a user on Linux, or blocking a user with a custom kernel, or blocking a user without a TPM.

> Nothing in this proposal gives publishers those means

It gives them the means to discriminate based on hardware and software, for example by only trusting a single attestor of their choosing which only gives a trusted signal for whatever passes their hardware or software criteria.

As an example, Google may decide that as a requirement to having their ads on your website, you must only trust a single attestor - "Google Play" (as named in the proposal), because otherwise you may be trusting an attestor that facilitates ad fraud, and we can't have that. Google naturally only treats devices running Chrome as trusted, how can they trust anything else that they don't own?

Naturally, the same applies to their own websites, can't have you using FireFox to send people CP via gmail, right?

Do you want your website to be protected from bots via Google's reCaptcha? I'm sure they know how to decide which access attempt belongs to a valid user or not. And they'll be happy to cooperate with Cloudfront to make sure everyone online is equally safe.

Obviously, it is also on Google to protect users from websites that host botted content, so if you want to appear on search results and don't want the browser to give a scary warning when accessing your website, be sure to only trust the trustworthy attestor.

And let's not get started on what happens if you want to take payment from users while "mitigating fraud"...

> (beyond what is currently available)

Right, the justification to do more evil is that we already do some evil, I'm convinced.

> Verifying the authenticity of a device in this case is a generic "trusted/not trusted" not "OK for movie 123/KO for skipping on movie 456"

In just this specific example you prove yourself wrong. You can use the generic "trusted/not trusted" signal to decide "movie 123 is OK for not trusted, but movie 456 we will restrict to trusted only".

It reminds me of https://en.wikipedia.org/wiki/Intel_Management_Engine. They wanted to control your computer. Palladium, and other features also is about control. Remote attestation is about control. Embrace extend extinguish was about control and money.

Since inception nobody said that IME was for the user. Nobody said that Palladium is for the user. Google arguments are all propaganda. Nicey nicey words for the people.

Judging about the amount of recent pressure on open source, and encryption we are already toasted. Cyber resilience act, earn it act, patriot act, restrict act. It is all written using nice words, but I am interested in effect. It is all about crypto wars, and taking possession of your computer. About limiting anonymity and privacy using only arguments against it.

Big companies already have monopoly. They can already shadow ban, ban users, decrease reach of comments, track users using fingerprinting, cookies etc. They can decide what is acceptable, what is not, what is a social norm, what is not, what is a conspiracy theory, and not. Why do they need also breaking the encryption, or force signed software? Why they require more control? Because they can. Corporations lobby for more power, they receive more power. Where is the limit? Government also only benefits from corporations accumulating more powah.

I do not understand how people may think about how 'good' these things will bring, because on the scales there is something really terrifying - a Government that can spy on you without any problems, where you cannot hide. Through surveillance laundering, where government buys user data. Through censorship where government can moderate anything it wants to through hidden portals for the government [1]. Maybe the problem is that the western world never really experience communism.

[1] https://reclaimthenet.org/new-zealand-government-facebook-co...

By the way. I understand the difference between moderation and censorship