Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity API Proposal

github.com

Post reply on HN
Print view View original

101–110 of 460 posts

Re: Web Environment Integrity API Proposal

#101

Post by qingcharles »

tentacleuno wrote: post #13
saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1]. I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do…

I'm holding out hope for Ladybird to save us all one day:

https://awesomekling.github.io/Ladybird-a-new-cross-platform...

Re: Web Environment Integrity API Proposal

#102

Post by teddyh »

pmlnr wrote: post #8

Soon there will be a Plaza Web, for which you'll need an approved device for, like a Chromecast with Google TV, and the Old Web of communities, enthusiasts, and the like.

Called it:

https://news.ycombinator.com/item?id=31835121>

https://news.ycombinator.com/item?id=33210846>

Re: Web Environment Integrity API Proposal

#103

Post by dahwolf »

The chess pieces for the end-to-end unblockable ad machine are in place.

You'll have the cynically named "Privacy sandbox" that builds tracking directly into the browser. You curtail ad blockers by capping browser extensions. And then you allow access only to "attested" clients. Inescapable tracking and unblockable ads. And you'll get to see ever more of them over time.

If this isn't evil enough in itself, the way Google presents these initiatives in grossly misleading ways makes my blood boil.

Fuck "Be as evil as possible" Google. Absolutely pathetic company. I'm so done with them.

Re: Web Environment Integrity API Proposal

#104

Post by 66fm472tjy7 »

I am not optimistic that the de-facto end of general computation can be prevented, or that there will even be noteworthy opposition.

There are so many powerful interests that stand to gain from preventing e.g. ad-blocking and content capture. Thanks to Windows 11 requiring TPM, it is just a matter of time until hardware support for remote attestation is ubiquitous even on desktop computers.

Meanwhile, our (including myself) attention is (perhaps justifiably to some extent) on the latest news about $EXISTENTIAL_THREAT and how $THE_OTHER_SIDE did $EVIL_THING fed to us by the algorithm. Organizations that used to effectively fight threats to freedom like this (FSF, pirate parties, CCC, EFF, etc) have lost a lot of their support/influence and clarity of purpose over the last decade.

Re: Web Environment Integrity API Proposal

#105

Post by apostacy »

ahahahahah wrote: post #27
tentacleuno wrote: post #21

Earlier quoted context omitted.

I still remember the controversy surrounding EME, a LOT of people came out against it (including the EFF[0]); despite that, they still triumphed on[1]. [0]: https://www.eff.org/press/releases/eff-makes-formal-objectio... [1]: https://github.com/w3c/encrypted-media

And thank god for that, otherwise we'd still need to support flash to use most popular websites.

Good. DRM should be external to the browser, not integrated into it.

DRM is mostly security theater anyway. Until a few years ago, the Spotify client just left unencrypted mp3s cached locally. And they stopped DRMing music over a decade ago. People are willing to pay a reasonable price for first party content.

If a company insist on DRM, then they should be on their own.

If we make it too easy, then they will just use it everywhere.

Re: Web Environment Integrity API Proposal

#106

Post by apostacy »

riffraff wrote: post #37
tapoxi wrote: post #15

Earlier quoted context omitted.

I mean Firefox caved to support EME. This isn't the early days of the web anymore either, the enthusiasts are a small minority of global web traffic that this will probably succeed even with a large scale boycott.

I think in this case Firefox is in a different position: if it didn't support EME netflix wouldn't work. But in this case it could report "sure, this is a real user alright" by being its own attester, can't it?

So what if Netflix doesn't work?? That is the choice of Netflix. Big content will always want more control. Firefox will never be able to keep up. They will just do a mediocre job of working against their users.

Microsoft and Real Player pushed hard for an integrated ActiveX based DRM ecosystem over a decade ago. I'm so glad that Mozilla flatly refused to entertain such idiocy. I sure wish that Mozilla still existed.

Mozilla is now just a "pick me" [1] organization to big content. They should own being a browser that caters to users, not platforms. Because they will end up with nothing.

[1]: https://www.urbandictionary.com/define.php?term=Pick%20me

Re: Web Environment Integrity API Proposal

#107

Post by flangola7 »

apostacy wrote: post #105
ahahahahah wrote: post #27

Earlier quoted context omitted.

And thank god for that, otherwise we'd still need to support flash to use most popular websites.

Good. DRM should be external to the browser, not integrated into it. DRM is mostly security theater anyway. Until a few years ago, the Spotify client just left unencrypted mp3s cached locally. And they stopped DRMing music over a decade ago. People are willing to pay a reasonable price for first party content. If a company insist on DRM, then they should be on their own. If we make it too easy, then they will just us…

Spotify will not load in a browser without a DRM plugin

Re: Web Environment Integrity API Proposal

#108

Post by apostacy »

veave wrote: post #38
tentacleuno wrote: post #33

Earlier quoted context omitted.

EME is for DRM'ing media. I don't see how that pertains to Flash. WebAssembly exists as a replacement now, too.

If browsers didn't natively support DRM then they would have to come up with external extensions (such as Flash) to support DRM. DRM isn't going away.

DRM should be inconvenient and expensive. There have always been ways to implement DRM security theater for the comfort of content providers in board rooms.

The media ecosystem is not going to be enhanced by making DRM more restrictive. Netflix could completely deactivate all DRM today, and it would change nothing.

Apple completely abandoned their "FairPlay" iTunes music DRM because it became evident that it was not needed.

Re: Web Environment Integrity API Proposal

#109

Post by saurik »

madeofpalk wrote: post #60
saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

> and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) Interesting that fixing "how to center a div" is considered harmful, but WebSerialPort is actually very good? > The result: there is now effectively one dominating web browser run by an ad company who nigh unto contr…

> Interesting that fixing "how to center a div" is considered harmful, but WebSerialPort is actually very good?

It is certainly "interesting", but "true" nonetheless: one determined person--think Fabrice Ballard if you want an example--is in a great position to throw together a web browser and even implement ALL of the crazy API wrapper specs, but when if they aren't you simply don't need most of them to browse any given website.

But, as it stands, my only a-few-year-old copy of Safari can barely even browse the web anymore as it is missing some new corner case of CSS or web components or whatever and I just get blank screens a lot; the result: people have burned years of large teams into trying to maintain implementations of HTML/CSS and have given up.

The web should really just be a handful of really core specs for getting platform access--which of course have innovated over the years so you'd have all of canvas, WebGL 1/2, and WebGPU, which would take SOME effort but isn't like, INSANE--and then all of the layout should be done end-to-end in libraries.

The world NEEDED to be like this to prevent us from ending up with only a handful of web browsers that can only be maintained by giant companies: it needs to be sufficiently easy to build a web browser that we would end up with a ton of small implementations that would be difficult to move as a unit, forcing progressive enhancement as a permanent norm.

Re: Web Environment Integrity API Proposal

#110

Post by apostacy »

flangola7 wrote: post #107
apostacy wrote: post #105

Earlier quoted context omitted.

Good. DRM should be external to the browser, not integrated into it. DRM is mostly security theater anyway. Until a few years ago, the Spotify client just left unencrypted mp3s cached locally. And they stopped DRMing music over a decade ago. People are willing to pay a reasonable price for first party content. If a company insist on DRM, then they should be on their own. If we make it too easy, then they will just us…

Spotify will not load in a browser without a DRM plugin

Yes, but that is fairly recent! Did anyone even notice? For years, you could siphon every song you listened to and save it locally. But did it affect anything? I did it for a little while, but then found it wasn't worth the trouble.
Post reply on HN