Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

techdirt.com

Post reply on HN
Print view View original

331–340 of 427 posts

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#331

Post by raxxorraxor »

IshKebab wrote: post #35
colordrops wrote: post #11

Earlier quoted context omitted.

crazy that they just unashamedly removed it.

I doubt their motivation was "now we want to be evil". Probably more like "evil isn't actually well defined and people keep pointing to this and having dumb arguments about it".

While it can easily be criticised in encouraging black and white patterns, people that have an intellectual problem with the definitions are mostly smartasses and very often actually do "evil" shit, as defined as self-serving to the disadvantages of all others.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#332

Post by yencabulator »

vel0city wrote: post #319
yjftsjthsd-h wrote: post #303

Earlier quoted context omitted.

There's always bundling a web browser with their OS and giving it an unfair advantage over all other browsers, aka the exact thing they were sued for last time .

ChromeOS bundles its own browser and goes even further in preventing people from installing their own than Windows. Imagine if on the first boot of ChromeOS it asks if you want to use Chrome, Edge, Safari, or Firefox.

In related news, ChromeOS is separating the GUI shell from the browser: https://news.ycombinator.com/item?id=36977107

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#333

Post by dns_snek »

meragrin_ wrote: post #313
helen___keller wrote: post #280

Earlier quoted context omitted.

> it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them. On the contrary, my main issue is that they identify one of the primary issues and fail to address it. The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with W…

> The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” You know they can do that right now, right? They aren't doing it. Will more do it because it is simpler now? Sure. Will it put "an end to the open web"? Nope…

"We will abuse this but you should stop complaining because we sorely need this to pad the profit margins for our investors."

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#334

Post by wzdd »

recursive4 wrote: post #299
wzdd wrote: post #266

Earlier quoted context omitted.

I don't think this is a good analogy. The WEI proposal is different to anti-virus in many ways. The fundamental ones are: 1) WEI doesn't attest that your device isn't running malware, it attests that your device is running a particular set of software -- it is a positive filter, rather than a negative one. This means that you can't run your own software (if it's part of the WEI trust chain), even if you know it's not…

1. Running a particular set of software _correctly_ i.e. the positive filter is positive insofar as the negative filter is negative. This logic applies to anti-virus if you predicate it's negative filtering on a positive filter that the problem itself hasn't been backdoored (which we arguably do as part of our intuitive trust model). I disagree with your characterization of metal detectors defining success on approva…

Your metal detector "that seems practically difficult" is exactly the issue: WEI does create a implicit whitelist (I believe the preferred term is allowlist). WEI will attest anything, but if you want it to be useful you have to already have some idea of what attestations you're going to trust.

Keeping a continuously-updated list of all attestations you're interested in trusting does indeed sound practically difficult. So it's quite likely that most sites will only trust attestations from Google about unmodified Google-supplied software (and perhaps some of the larger third parties).

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#335

Post by troyvit »

samwillis wrote: post #49
Animats wrote: post #17

It's time to start lobbying hard for an antitrust breakup of Google. This DRM plan, as abuse of a monopoly position, provides more political coverage for a forced breakup. It's pretty clear how to break up Alphabet, because it grew mostly by acquisition. - Google - search, ads on search pages and nothing more. - DoubleClick - third party ads on other sites. - Analytics - services to web sites. - Cloud - the money-los…

This may seem like a good idea but so much of Google's power comes from the Search + Search Ads monopoly. That is where they are anticompetitive to the max, that is where a change needs to happen. Splitting everything else off doesn't solve the core problem. Within Search + Search Ads you have a platform where Google are/have: - the sole vendor of a digital asset - ads - the sole marketplace for that asset - a closed…

I feel like if you broke up the browser from search then the elimination of third party cookies will magically fall off the table because you break the browser's integration with the engine and the ad platform which made that elimination profitable for Alphabet (and a knife in the lungs for "open web" advertisers).

I hate web advertising but it's the model we've got so bear with me.

Once third party cookies are back on the table it helps level the playing field. Programmatic advertising becomes profitable again and all those small players can get back to competing. Only this time they're just competing with each other and doubleclick.

Maybe momentum carries forward and third party cookies are eliminated anyway (such faith in humanity). If that's the case then once again the playing field levels a bit more and everybody is working with the same blinders on.

Search will still be awful because of google.com's market share and its enablement of click bait and echo chambers, but search will always be awful and five years from now everybody will have their own LLM instead of search anyway (and five years after that LLMs will suck because there's no new data to train against but that's another rant).

Analytics will change a lot. Google not legally being able to integrate the data it scrapes from GA into its own products means that there's a lot less of a reason to stick just with their ecosystem. They'll still lag behind as far as privacy goes, so third party analytics providers will actually be able to get their toes in the door.

Anyway like you I agree that a breakup probably isn't going to happen. Most of the people who would legislate a break-up don't even understand the internet or what alphabet is, or what google does.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#336

Post by daurentius523 »

cowl wrote: post #153
dns_snek wrote: post #139

Earlier quoted context omitted.

> It seems Everyone is taking for granted the claim that this is about DRM. The claim is that websites (not Google) will use this signal to allow or deny access but this is already possible with various means. How about you offer a reasonable opposing viewpoint? It's hard to see this, at best, as anything other than an extremely naive viewpoint. Every feature that can be used to lock down content and/or spy on users,…

> How about you offer a reasonable opposing viewpoint Read the proposal: https://github.com/RupertBenWiser/Web-Environment-Integrity/... >That's settled then. Full filesystem, location, camera, and microphone access should therefore come on by default without a permission dialog. Why not bring back Java and Flash while we're at it! It's not the browser vendor's fault that websites are misusing it. Now who is arguing…

"anyone can become an "attester"" - and no site has to respect that. Read between the lines - using TLS as example: I can attest that my site is my by being self-certified but no browser will accept that - as my certificate is not "attested" by browser or OS.

The WEI attester is exactly same - if site decides that it trust only Google, Apple and Microsoft - you do not have any way to access the site if you don't have attestation from that group, period.

"Opera would need to trust Linux" - Again I need to stress out to anyone who doesn't understand anything about Linux - Linux is not single uniform OS - it is bunch of distributions (OSes) that agree on some common API (not always) to produce more or less something that seems to be single OS for application (often not really) - binary compatibility is not a thing to this degree that linux has many (again no uniformity) separate solutions to make closed source binaries to work.

In reality trying to attest "that binary is not modified" on Linux is simply fallacious or outright misguided on basic idea - leaving aside distros that do not ship binaries (Gentoo) many ship often modified versions of software. And Users may modify software as they see fit - so there is literary no way that you can attest Linux.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#337

Post by OhMeadhbh »

Lol. I think I was a part of this story. In the early 2000s, I was one of those faceless, nameless government people who were complaining to MSFT that their software was insecure compared to Solaris or even ConvexOS. I KNOW I am not the only one to have done this, but we gave them a copy of the rainbow books at a meeting and asked them to read them. MAC (Mandatory Access Control) isn't the be-all/end-all of computer security in general, but it IS a good model for government computers in the 1990s. Plenty of people understood the Bell-Lapadula model, all our machines were self-managed behind locked doors and we could afford a small army of sysadmins and infosec people.

I've talked about interviewing as the Office Security Architect in 2003, but the job that got me talking to MSFT was one in what was going to become NGSCB, bits of which were eventually rolled into Windows Vista. My interview for that team was scuttled when I talked with their senior tech person who asked me... "Oh. I see you have experience in Crypto(graphy), then you clearly know how to tractably factor a 2000 bit number." I admitted that I was still under the impression that it was a difficult problem, but he assured me that all you had to do was print it out in binary and apply a particular regular expression to it. When I pointed out that primality testing and factoring are different things the interview went south. I later found out this was some sort of MIT shibboleth and I was supposed to respond with some comment about the compilers class.

In any event... It always seemed odd to me that NGSCB tried to make MAC a mainstream feature, but I wasn't really thinking about DRM. Like I said, if you're a big organization and can properly manage the classification problem, and have info security peeps who are cleared and trusted, MAC (as embodied in any of the C2 Unices from the 90s, NGSCB or SE Linux) can be useful. But yeah, the only reason you would want this on a consumer machine is to prevent the "owner" from doing something with downloaded media the person who produced the media doesn't want you to do (aka DRM.)

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#338

Post by helen___keller »

meragrin_ wrote: post #313
helen___keller wrote: post #280

Earlier quoted context omitted.

> it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them. On the contrary, my main issue is that they identify one of the primary issues and fail to address it. The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with W…

> The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” You know they can do that right now, right? They aren't doing it. Will more do it because it is simpler now? Sure. Will it put "an end to the open web"? Nope…

I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested.

More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem.

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#339

Post by sebastialonso »

gmerc wrote: post #267

It turns out that when the growth stops, companies show their real face. The reason everyone in the world is praying infinite growth is this dynamic, people, companies are alike. You want to know if someone is truly a nice person - put them into a now growth situation for a while. Before that, it’s all talk.

But is this a practical argument in any sense of the word? Don't have a reason to think you're a bad person, but if I abandon you in an island with weaker people, there's a high chance you'll end up eating them to survive. But you're not a bag person. In other words, there's a limit of what you can do in any context, and those limits are imposed by the context.

Maybe it's easier to stop projecting our ideas of what "ought to be" into entities who inhabit a system in which those ideas don't have value, like for-profit businesses, no?

Re: Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

#340

Post by charcircuit »

wzdd wrote: post #328
charcircuit wrote: post #322

Earlier quoted context omitted.

>In summary, this is fundamentally different because it takes away your control of your own device. No, it allows a business to deny to you if you can't attest to the security of your device. You are still free to do whatever you want on your own device. If a business had an office that required you to unlock a door, but it also had a pickable lock that wouldn't be great security. It allows people to lie about having…

I'm sorry, but the idea that it's about allowing me to attest to the security of my device is not correct. I can make all the attestations I like about the security of my device, but if they're not backed by a confirmation from Google then it's quite likely that nobody will care. The issue is that making modifications to anything in the chain of trust requires approval from a trusted third party.

>the idea that it's about allowing me to attest to the security of my device is not correct

I was oversimplifying. A service doesn't have to trust every attestation and a service does not need to do anything with the attestation if it doesn't want to.

>The issue is that making modifications to anything in the chain of trust requires approval from a trusted third party.

That is by design because it means untrusted people can't make changes while remaining trusted.

Post reply on HN