Live data from Hacker News

“Web Environment Integrity”: Locking Down the Web

brave.com

11–20 of 103 posts

Re: “Web Environment Integrity”: Locking Down the Web

#11
post #4

"Brave's browsers" distributions of browsers , there ftfy

FWIW brave genuinely has multiple privacy patches that are useful and can't be done properly with extensions in chrome.

Several of these either can't be done via a js extension to chrome, or can be detected/bypassed. Brave does them in-engine which is the better way to do it.

https://github.com/brave/brave-browser/wiki/Fingerprinting-P...

Re: “Web Environment Integrity”: Locking Down the Web

#12
It's nice that they are changing their marketing on this a bit now that there is a wave to ride and the evils of DRM are coming for them; but, let's not forgot that, at the end of the day, Brave is just another company that makes money on ads :(, and (thereby) has most of the same anti-user incentives.

So, sure... they clearly don't want to be prevented from blocking other peoples' ads (a big part of their pitch); but, blocking their ads while still getting paid--which is, of course, extremely easy to pull off on an unrestricted computer--is an existential threat to their only actual revenue stream which they want to protect against.

The ramification: Brave's product managers--and even Brendan Eich himself (whom all of the later quotes I have in this comment were taken from, directly or indirectly)--have often talked about using the very same remote attestation technology to protect their SDK and even their browser for the same reasons as Google.

https://www.reddit.com/r/BATProject/comments/bw6sek/

https://www.reddit.com/r/BATProject/comments/b7rwbx/

> 1/ native C++/Rust code, no JS tags on page that have zero integrity. That means ability to use SGX/TrustZone to check integrity and develop private user score from all sensor inputs in the enclave; ...

> We already have to deal w/ fraud. That is inherent in any system with users and revenue shares or grants. We do it better via C++ and (under way) SGX or TrustZone integrity checking + OS sensor APIs, vs today’s antifraud scripts that are routinely fooled.

> What Brave offers that's far better than today's joke of an antifraud system for ads is as follows: 1/ integrity-checked open source native code, which cannot be fooled by other JS on page; ... (1) requires SGX or ARM equivalent, widespread on mobile.

https://www.reddit.com/r/BATProject/comments/

https://www.reddit.com/r/BATProject/comments/97trex/comment/...

> Part of the roadmap (details in update) is a BAT SDK. Obviously it would be open source, but more: we would require Secure Remote Attestation (Intel SGX broken but ARM TrustZone as used by Trustonic may be ok) to prove integrity of the SDK code in app.

Re: “Web Environment Integrity”: Locking Down the Web

#13
post #9

Earlier quoted context omitted.

Seems like a biased opinion. Brave and their products innovate a LOT. Browser, (good) search engine, crypto as a way to keep websites profitable, etc.

[flagged]

This might be the most "Hacker News" comment I've ever read. Whether or not I agree with the way Brave goes about their business, I'm not going to deny they are trying new things which is the definition of innovation.

Re: “Web Environment Integrity”: Locking Down the Web

#14

What is Brave going to do when the code for WEI becomes load bearing in the chromium code base? Still excuse after excuse after excuse to just not use Firefox. I literally don't care if you have to hold up your nose, there's only one actual alternative browser engine, and it's a matter of survival for anyone who doesn't want the whole internet controlled by google. It could be half as fast (it isn't) and use twice as…

Honestly modern Firefox works better than Chrome for me at everything - better memory management - faster loading times - better extension support.

Re: “Web Environment Integrity”: Locking Down the Web

#15

I personally think the upsides of WebBundles are huge. There's nothing that would stop the browser from being able to filter & ignore content coming from in a WebBundle, so I'm not sure what Brave's greivance is here. The adserving topic is complicated as heck, but everyone seems to acknowledge big change is necessary & Google and Firefox both have proposals to radically overhaul the system while enhancing user priva…

I don’t mean to be an apologist here, but Google’s vs Apple’s intention seem crystal clear.

Google is trying to make it impossible not to see the ads it’s selling. Apple’s intent seems to be lock down the Apple platform…? I know Apple is blatantly abusive in lots of spaces, but Chrome is a super-majority of the browsers in use. It’s an odd take to spin this into “they started it” finger pointing.

The reason Chrome is getting all the hate is that Google finally realized its power, position, and needs and became self-serving. Apple is just a lesser demigod is this fight.

Re: “Web Environment Integrity”: Locking Down the Web

#16

I personally think the upsides of WebBundles are huge. There's nothing that would stop the browser from being able to filter & ignore content coming from in a WebBundle, so I'm not sure what Brave's greivance is here. The adserving topic is complicated as heck, but everyone seems to acknowledge big change is necessary & Google and Firefox both have proposals to radically overhaul the system while enhancing user priva…

I don’t mean to be an apologist here, but Google’s vs Apple’s intention seem crystal clear. Google is trying to make it impossible not to see the ads it’s selling. Apple’s intent seems to be lock down the Apple platform…? I know Apple is blatantly abusive in lots of spaces, but Chrome is a super-majority of the browsers in use. It’s an odd take to spin this into “they started it” finger pointing. The reason Chrome is…

[deleted]

Re: “Web Environment Integrity”: Locking Down the Web

#17

What is Brave going to do when the code for WEI becomes load bearing in the chromium code base? Still excuse after excuse after excuse to just not use Firefox. I literally don't care if you have to hold up your nose, there's only one actual alternative browser engine, and it's a matter of survival for anyone who doesn't want the whole internet controlled by google. It could be half as fast (it isn't) and use twice as…

The excuse is always that Gecko is harder to integrate... but at what point is maintaining all these patches harder?

Re: “Web Environment Integrity”: Locking Down the Web

#18
post #5

Hard to listen to anything from a company that constantly: 1) Doesn’t innovate on anything, social media accounts are plagued with pointing fingers at others while using a Chromium fork themselves, ignorance at its finest. 2) Has been accused of selling copyrighted data for AI training and has not made a public statement. 3) Has a history of making stupid decisions and only apologizing when a big news outlet calls th…

Seems like a biased opinion. Brave and their products innovate a LOT. Browser, (good) search engine, crypto as a way to keep websites profitable, etc.

I’m not sure their crypto had the objective to keep websites profitable. It looks more like a good hack to get rich by obtaining classic money with the sell of random numbers. But I’m not an expert in scams.

Re: “Web Environment Integrity”: Locking Down the Web

#19

What is Brave going to do when the code for WEI becomes load bearing in the chromium code base? Still excuse after excuse after excuse to just not use Firefox. I literally don't care if you have to hold up your nose, there's only one actual alternative browser engine, and it's a matter of survival for anyone who doesn't want the whole internet controlled by google. It could be half as fast (it isn't) and use twice as…

It won't matter, if WEI catches on Firefox will be in the same boat. Any non-WEI browser is equal in terms of protesting it. The threat is sites will lose their users if they start requiring it. If anything Chrome derivatives that patch it out but still pretend to be Chrome are even worse for website operators that want to use it.

There's lots of reasons to use FF, this isn't one of them.

Re: “Web Environment Integrity”: Locking Down the Web

#20
post #9

Earlier quoted context omitted.

[flagged]

This might be the most "Hacker News" comment I've ever read. Whether or not I agree with the way Brave goes about their business, I'm not going to deny they are trying new things which is the definition of innovation.

Well, neither of the things I mentioned are hard to look up. I even worded them specifically to make it easier to instantly find a source, I just happen to be away from my PC right now or I would have linked the sources myself.

I have not seen any innovation from them so far, sorry to say. They are using a pre-existing browser engine, they are lawyered up and don’t respond to public callouts, and they have a history of doing dumb shit that had their CEO cave and apologise for a “mistake”.

If this is opinion then I think you need to look up what that word really means…

Post reply on HN