Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity API Proposal

github.com

Post reply on HN
Print view View original

121–130 of 460 posts

Re: Web Environment Integrity API Proposal

#121

Post by gizmo686 »

t0astbread wrote: post #95
pmlnr wrote: post #29

Earlier quoted context omitted.

> how do we protest this The proposal for Chrome, you don't, because there's no stopping it. See DRM, Secure Boot, all the rest of the shitshow pursuing "trusted environment". It'll never happen, but CEOs won't accept reality. You can, however, embrace the rest: eg. keep serving your own content on http (along with https), gopher for retro compatibility, and because they are less prone to break. Keep using your curre…

Generally agree but I don't think Secure Boot falls in this category unless the keys are locked in firmware (and in that case the firmware is the problem). Root passwords aren't evil either just because they can be withdrawn from the user.

Secure Boot is often conflated with Measured Boot.

Measured Boot is essential for any attestation based scheme.

Re: Web Environment Integrity API Proposal

#122

Post by motbus3 »

spystath wrote: post #20
tentacleuno wrote: post #13

Earlier quoted context omitted.

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1]. I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do…

> how do we protest this? You do not and you cannot. It was written in stone once Chrome dominated the browser market. What Chrome (Google) wants, Chrome (Google) gets. Despite all the good engineering Google wants to sell ads, that's all there is to it. And the result is this proposal. > The saving grace here might be that Firefox won't implement the proposal. It's irrelevant and we are an irrelevant minority. Unles…

You can by not using Google products. Change the search for ddg or kagi. Change your email for proton. Use Dropbox instead. Remove Chrome, live with iceweasel or Firefox.

It is not like you'll be loosing much. This is the time to change, while we still have other players in the market.

Re: Web Environment Integrity API Proposal

#123

Post by troupo »

quenix wrote: post #59

What's strange to me is that the main author of the spec -- Ben Wiser -- seems to be against closed, wall-garden paradigms as he has written in a blog post "I just spent £700 to have my own app on my iPhone" [1]. In the post, he laments the state of the App Store monopoly on iOS and ponders returning to Android for the app installation freedom. How can he reconciliate these views with this spec, which he is the main…

> How can he reconciliate these views with this spec, which he is the main author of? Surely Ben sees the parallels?

It's easy: he works for Google. Every single public-ish web developer and/or devrel from Google will spend inordinate amounts of time lambasting Apple, writing eaassays on how Apple cripples the web etc.

While Google has broken the web so badly that Apple would need several decades to come anywhere close.

Note: the moment they leave Google, they may slightly change their tune and criticise Google a bit. For an example, see Alex Russel of web components when he went to work at Microsoft after spending a decade making sure that web browsers are turly unimplementable: https://infrequently.org/2021/07/hobsons-browser/

Re: Web Environment Integrity API Proposal

#124

Post by wmf »

riffraff wrote: post #37
tapoxi wrote: post #15

Earlier quoted context omitted.

I mean Firefox caved to support EME. This isn't the early days of the web anymore either, the enthusiasts are a small minority of global web traffic that this will probably succeed even with a large scale boycott.

I think in this case Firefox is in a different position: if it didn't support EME netflix wouldn't work. But in this case it could report "sure, this is a real user alright" by being its own attester, can't it?

If Firefox lies, sites will refuse to load in Firefox.

Re: Web Environment Integrity API Proposal

#125

Post by saurik »

troupo wrote: post #115
saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

> we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browser as possible. "powerful-but-easy-to-code APIs for OS-level access" are actual hard-to-implement-right functionality that is often pushed to browsers with very little discussion or considerations.

But the chance of a web page actually needing that functionality to render at all is rare for hopefully-obvious reasons. The status quo is that progressive enhancement is dead: a few-year old copy of Safari can now simply not browse much of the web anymore because it is missing some corner case of CSS or web components or whatever: I often am stuck at loading spinners or are simply thrown into a blank page... the best case is a client-side rendered 500 error on many pages.

It was critical for the web to be easy to implement the core of for a small team or even a single concerted god-tier developer--imagine Fabrice Ballard--and the current spec has failed so hard at this that even tech megacorps have thrown in the towel. People get upset about WebUSB... but that's not the API surface that is causing us issues. If I had to single-handedly implement all of canvas/WebGL/WebGPU and JavaScript/WebAssembly I could pull it off (noting I used to be a video game engine developer).

Re: Web Environment Integrity API Proposal

#126

Post by jabbany »

freeone3000 wrote: post #112
jabbany wrote: post #25

Earlier quoted context omitted.

It's signed? Sure you can fake the results of an attestation in your fork, but your fork would be using your own key to sign the response, a key that the site can reject.

Ah, we’ll also have to extract the key from chrome. It’s no worse than WideVine.

Has that been extracted already? I have to admit I'm behind on the current state of browser DRM...

Also I wonder if in the future this would require attestation of the entire chain: secure UEFI validated by key burned in CPU, validates secure boot os that prevents "hacking tools", which validates secure Chrome, which attests secure websites...

Truly royally screwed at that point...

Re: Web Environment Integrity API Proposal

#127

Post by wmf »

apostacy wrote: post #117
enumjorge wrote: post #54

Earlier quoted context omitted.

> The saving grace here might be that Firefox won't implement the proposal. As others have said, FF doesn't have a lot of leverage left to influence those type of decisions, but Safari might. Not sure what their position is on this proposal. The one pager has a section on stakeholder feedback [0], but doesn't name them for some reason. [0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

Looking at it in terms of leverage and market-share is a huge mistake that Mozilla keeps making. Mozilla doesn't have a platform like Google does. What exactly is Mozilla even competing for? Popularity? They should hunker down and make the best browser they can, implementing their best web. It worked 20 years ago, and in many ways the circumstances are the same. We have tech monopolies proposing ludicrous "content se…

What exactly is Mozilla even competing for? Popularity?

Mozilla's revenue is proportional to usage so they need enough users to cover their development costs.

Re: Web Environment Integrity API Proposal

#128

Post by Buttons840 »

pmlnr wrote: post #75
ploum wrote: post #70

Earlier quoted context omitted.

Yes. The solution is very simple: uninstall Chrome and Chromium. We are the people with the most influence on the tech. We are prescriptors. We are legion. – Yes but Chrome is a tad faster and I have my bookmarks and my favorites extension and blablablabla… — Then you are the root cause of the problem. If you are not ready to sacrifice an ounce of comfort to save the web, then you are the one killing the web. Simple:…

> There are plenty of alternatives Yeah, not for long. Go back and read the proposed changes.

Please explain what you mean. It sounds like you have an important point that can only be found if people sit and carefully read several pages. Important points deserve to be stated more plainly.

Re: Web Environment Integrity API Proposal

#129

Post by saurik »

cesarb wrote: post #55
saurik wrote: post #10

Earlier quoted context omitted.

It was also dangerous for your PC: as soon as people ceded the ability to led their parties control what we run on our devices--such as by "only firmware signed by Apple can run on my phone"--we lost this war.

> It was also dangerous for your PC: as soon as people ceded the ability to led their parties control what we run on our devices--such as by "only firmware signed by Apple can run on my phone"--we lost this war. If that's how "we lost this war", then it was lost before it even started. Even before Apple released their phones, it was already the case that phone firmware came only from the phone manufacturer. That is:…

I mean, those were by and large fixed function devices and while phone calls are certainly a form of communication they aren't really networked devices. And... while it was technically possible to update the software on them, most people never did.

There were only a scant handful of years where there even existed phones where this could matter... but now this same mentality is being applied to every new category of device--all of which acting as general computing devices--based on these precedents.

Re: Web Environment Integrity API Proposal

#130

Post by [deleted] »

madeofpalk wrote: post #71
jabbany wrote: post #45

Earlier quoted context omitted.

Step 1: Sites require a "secure" (read proprietary) browser like "Google Chrome", "Microsoft Edge", "Safari" or refuse to operate. Step 2: "Secure" browsers change the behavior of their implementation of the Content Blocker API so an industry-accepted "secure" site lile Google Ads can opt-out of being blocked ("You wouldn't want a misconfigured content blocker to accidentally break a verified secure site right?") Ste…

I don't understand how the Apple that introduced their Content Blocker APIs would choose to invest into this API to kneecap their own content blockers?

[deleted]
Post reply on HN