Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity API Proposal

github.com

Post reply on HN
Print view View original

161–170 of 460 posts

Re: Web Environment Integrity API Proposal

#161

Post by JBiserkov »

stainablesteel wrote: post #155
kibwen wrote: post #72

It's time to break Google up. They're the AT&T and Standard Oil of our generation. Make Ads, YouTube, Search, Cloud, Chrome, etc. all independent companies. Demand that antitrust regulators do their damn jobs for a change.

counterargument: let's say the us gets in a real war with china, a massive conglomerate like google would probably make massive contributions to cyber/technological warfare that the individual pieces would have a hard time doing i agree they should be broken up, but it might be the wrong time for it.

So what you are saying is we should break up the US so they don't get in a real war with China?!

Re: Web Environment Integrity API Proposal

#162

Post by politelemon »

> Attesters will be required to offer their service under the same conditions to any browser who wishes to use it and meets certain baseline requirements. This leads to any browser running on the given OS platform having the same access to the technology, but we still have the risks that 1) some websites might exclude some operating systems, and 2) if the platform identity of the application that requested the attestation is included, some websites might exclude some browsers.

I feel this is the bit that's going to be hand waved away for the sake of convenience.

Re: Web Environment Integrity API Proposal

#163

Post by Aeolun »

TheAceOfHearts wrote: post #6

This seems like a step closer to killing the open web. "Sorry, you can only access this website using this specific device with a browser compiled by Big Tech, it's for your own good." Not surprising that this is all coming from Google, the world's biggest adtech company.

This is already happening. It’s just mildly harder now. Try opening Teams in Firefox or Safari.

Re: Web Environment Integrity API Proposal

#164

Post by lucideer »

andrethegiant wrote: post #100
leodriesch wrote: post #17

Earlier quoted context omitted.

They seem to have closed down comments on it, I'm seeing > An owner of this repository has limited the ability to comment to users that have contributed to this repository in the past.

> I’m giving everyone a heads up that I’m limiting comments to contributors over the weekend so that I can try to take a breath away from GitHub. I will reopen them after the weekend https://github.com/RupertBenWiser/Web-Environment-Integrity/...

Does it disturb anyone else that this is (a) in a personal namespace & (b) reason given for closing discourse being a single individual's need to disconnect from work at the weekend, when that person is employed by a large corp to maintain this spec which they are implementing in their product?

Surely Google as an org, if they're behind this, or at least a standards bodies own org namespace should both own this project, and also decision making around discourse, with any individual employees being free to leave the project un-answered outside of working hours?

This isn't some open source passion project someone's doing in their off time...

Re: Web Environment Integrity API Proposal

#165

Post by saurik »

chrisco255 wrote: post #152
saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

Do you have a quote from Eich saying that because you've provided no source.

> you've provided no source.

Yeah: it isn't shocking and can be quickly found using Google (as I just did now). (I have provided some extra links but am only quoting Brendan Eich as you seemed particularly interested in him saying the words himself rather than his team.)

https://www.reddit.com/r/BATProject/comments/bw6sek/

https://www.reddit.com/r/BATProject/comments/b7rwbx/

> 1/ native C++/Rust code, no JS tags on page that have zero integrity. That means ability to use SGX/TrustZone to check integrity and develop private user score from all sensor inputs in the enclave; ...

> We already have to deal w/ fraud. That is inherent in any system with users and revenue shares or grants. We do it better via C++ and (under way) SGX or TrustZone integrity checking + OS sensor APIs, vs today’s antifraud scripts that are routinely fooled.

> What Brave offers that's far better than today's joke of an antifraud system for ads is as follows: 1/ integrity-checked open source native code, which cannot be fooled by other JS on page; ... (1) requires SGX or ARM equivalent, widespread on mobile.

They are also building an SDK and talk about using this tech to ensure the ads presented by their SDK in someone else's app are legitimate.

https://www.reddit.com/r/BATProject/comments/9yys6b/

https://www.reddit.com/r/BATProject/comments/97trex/comment/...

> Part of the roadmap (details in update) is a BAT SDK. Obviously it would be open source, but more: we would require Secure Remote Attestation (Intel SGX broken but ARM TrustZone as used by Trustonic may be ok) to prove integrity of the SDK code in app.

Again: the very tech they are excited about to make their ad-based business model work against people cheating and blocking their ads is the same tech that Google is going to use to make their ad-based business model work against Brave cheating and blocking their ads ;P.

Re: Web Environment Integrity API Proposal

#166

Post by dgb23 »

wmf wrote: post #50
sergiomattei wrote: post #24

Proposals like this demonstrate the utter failure of our ethics education in computer science. In a field facing increasingly harder ethical questions every day, it’s important to start empowering our engineers to say “no” to ethically bankrupt things like this.

You might be disappointed. Ethics training can't force people with different political viewpoints to conform to yours; in fact it gives them better tools to explain their views.

You mean rhetoric?

Re: Web Environment Integrity API Proposal

#167

Post by blibble »

stainablesteel wrote: post #155
kibwen wrote: post #72

It's time to break Google up. They're the AT&T and Standard Oil of our generation. Make Ads, YouTube, Search, Cloud, Chrome, etc. all independent companies. Demand that antitrust regulators do their damn jobs for a change.

counterargument: let's say the us gets in a real war with china, a massive conglomerate like google would probably make massive contributions to cyber/technological warfare that the individual pieces would have a hard time doing i agree they should be broken up, but it might be the wrong time for it.

what are Google going to do to China?

throw ads at them?

Re: Web Environment Integrity API Proposal

#168

Post by mardifoufs »

stainablesteel wrote: post #155
kibwen wrote: post #72

It's time to break Google up. They're the AT&T and Standard Oil of our generation. Make Ads, YouTube, Search, Cloud, Chrome, etc. all independent companies. Demand that antitrust regulators do their damn jobs for a change.

counterargument: let's say the us gets in a real war with china, a massive conglomerate like google would probably make massive contributions to cyber/technological warfare that the individual pieces would have a hard time doing i agree they should be broken up, but it might be the wrong time for it.

Google can intercept nuclear ICBMs? Because if they can't, nothing they do would really matter in a real war against China.

(And saying that actually "it would probably not escalate that far in a real war because... It just won't! " might be a common argument these days amongst war mongering lunatics to make war with China or Russia sound less batshit insane, but it's not an actual argument. It's just run of the mill "this time it's different!" cope that has been said before every blood bath. )

Re: Web Environment Integrity API Proposal

#170

Post by aledalgrande »

drbawb wrote: post #92
h4x0rr wrote: post #36

Earlier quoted context omitted.

What about Safari? It has significant market share. Seems like our best bet now

I doubt Apple will be our savior here. Apple is in a great position to implement this spec: their secure enclave and the systems they've developed around it are practically the state of the art. Also Apple is in bed w/ traditional media. (Apple News, Apple TV, iTunes, etc.) Microsoft has been doing the same[1] for years w/ Pluton on the Xbox to protect their IP. Google has been doing this on Android using, dm-verity,…

> Also Apple is in bed w/ traditional media.

True. Try to screenshot anything from Apple TV+ content. You'll get a black image.

Post reply on HN