Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web • Hacker News Board

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#171

Post by mistrial9 » Tue, Jul 25, 2023, 1:31 AM UTC

kelnos wrote: post #63

mabbo wrote: post #32

> Exactly how the rest of the world feels about this is not necessarily relevant, though. Google owns the world's most popular web browser, the world's largest advertising network, the world's biggest search engine, the world's most popular operating system, and some of the world's most popular websites. So really, Google can do whatever it wants. This is the point that company breakups start to make a lot of sense.…

> When Google can do something that every one of it's users hates I don't think this is remotely the case. Quite a few tech-savvy people I know (some of them software developers) use Chrome and mostly don't care about whatever Google does with it. I mention "manifest v3" and get a blank stare. I talk about advertising and ad blockers, and most people don't care, with some of them not even using ad blockers. We really…

this argument is inadequate because it only examines and explains one side of a multi-part system. The users of consumer electronics as a mass at a point in time is not sufficient, even if well described, to explain important changes of the system over time.

When you talk about communications technology adopted at a societal scale, changes in norms and routine have ripple effects. Most certainly one of those is a change in asymmetric power relations by central communications companies, versus the user of their systems who get strictly limited information views of what is happening with their phone calls or emails.

When you have asymmetric power relations with market advantage and secondly literal surveillance at stake, a unilateral change in the service agreement is not a small "oh well" matter.

This single statement "people do not care" does not show all the players, and most especially does not show the players making decisions, the management of the companies making more money or new revenues with new decisions.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#172

Post by worrycue » Tue, Jul 25, 2023, 1:34 AM UTC

alex7734 wrote: post #157

kelnos wrote: post #63

Earlier quoted context omitted.

> When Google can do something that every one of it's users hates I don't think this is remotely the case. Quite a few tech-savvy people I know (some of them software developers) use Chrome and mostly don't care about whatever Google does with it. I mention "manifest v3" and get a blank stare. I talk about advertising and ad blockers, and most people don't care, with some of them not even using ad blockers. We really…

> after all, Firefox is a perfectly viable alternative to Chrome that very few people use I don't use Firefox because it's slower than Chrome and because their behavior regarding limiting which extensions are available in phones, requiring signed extensions, Firefox Pocket, ads in new tab page, etc, does not exactly give me confidence that Mozilla truly has my interests in mind. In fact I bet they'll implement the ni…

It’s actually pretty fast now after the bug with Windows Defender was fixed. You should give the latest a try.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#173

Post by userbinator » Tue, Jul 25, 2023, 1:35 AM UTC

TylerE wrote: post #154

userbinator wrote: post #131

It's great to see this getting more attention. User-agent discrimination (i.e. "go away if you're not using the latest version of Chrome") needs to become illegal. As long as I'm not overloading your service or similar, what hardware or software I use must not be restricted. The same goes for other deliberate obstacles to accessibility and interoperability --- creating a "standard" that's so complex and churned frequ…

Why shouldn't the owner/operator of a website be able to decide who to sling bits to? How is this, conceptually, any different from sites that used to block IE out of spite?

How is this, conceptually, any different from sites that used to block IE out of spite?

I don't agree with doing that either, but whereas things like changing UA headers/page-rewriting proxies would easily get around that sort of discrimination, this is now cryptographically secure.

Governments are scared of encryption because it could be used against them. The population should've realised the same could also apply to them, because it is now actually happening.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#174

Post by flyinghamster » Tue, Jul 25, 2023, 1:36 AM UTC

px43 wrote: post #118

LispSporks22 wrote: post #15

They're going to prevent me from running an adblocker in this "web integrity" environment, aren't they.

That makes zero sense. If they ever did that they would lose all their market share overnight, and they know that. Google has always been good about letting people have full control over their devices, despite building incredibly locked down UX. It would be trivial for them to build a Chromebook, or Android phone, or browser that you can't flip into dev mode, but they've never done that, even though many of their com…

It will be, as always, incrementalism. Tweak this little requirement here, then maybe two versions down the road lock this down, then a couple years later bring the hammer down before anyone can react. "Move fast and break things..."

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#175

Post by gochi » Tue, Jul 25, 2023, 1:37 AM UTC

asadotzler wrote: post #160

I've been reading HN since its birth and have been in the browser game for 25 years. HN, as a collective, shit all over Firefox and Mozilla for a decade while Google, who was never going to to anything but this, did just this. Good job.

You mean the same browser getting paid by Google to maintain it as the default search engine? The same organization that relies on those payments as majority of income?

This isn't to shit all over Mozilla, this is to highlight that browser choice is irrelevant here, this is not a "war" won by installing another program.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#176

Post by userbinator » Tue, Jul 25, 2023, 1:41 AM UTC

whatshisface wrote: post #148

px43 wrote: post #118

Earlier quoted context omitted.

That makes zero sense. If they ever did that they would lose all their market share overnight, and they know that. Google has always been good about letting people have full control over their devices, despite building incredibly locked down UX. It would be trivial for them to build a Chromebook, or Android phone, or browser that you can't flip into dev mode, but they've never done that, even though many of their com…

That is what would happen if they made adblocking impossible in chrome today , minus all the people who don't use AdBlock and happen to be numerous enough to be Google's entire business. In a world with attestation, you can't browse any website unless you are using Chrome or another attested browser. The New York Times would refuse to serve content to unattested user agents. That is what would make everyone use Chrom…

The scariest part is that it's not just the browser --- remote attestation goes right down to the hardware with things like the TPM, so if even one piece of your software is not "approved", you'll be locked out.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#177

Post by dceddia » Tue, Jul 25, 2023, 1:42 AM UTC

rpdillon wrote: post #83

I've been thinking about this for a few days but just realized that this is a complete end run around all web scraping in general. All 'adversarial compatibility' from projects like Nitter, Teddit, Invidious, and youtube-dl go out the window. Any archive site (archive.org, archive.ph, etc.) can be blocked by sites requiring attestation. And just like the book industry was terrified of piracy and were 'rescued' by Kin…

Yeah, exactly this, and on top of that, it also conveniently for Google makes it impossible or wildly expensive to build an index of the web if most of it is behind this attestation stuff.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#178

Post by userbinator » Tue, Jul 25, 2023, 1:44 AM UTC

crote wrote: post #91

codedokode wrote: post #47

> Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data. There is no value in this "attestation" for me as a user. I want to be able to do whatever I want with the browser (for example, remove ads or block access to canvas and webgl) and I want sites to be unable to know this. And probably this attestation will provide a…

Ehhh, it depends. In theory one could imagine a scenario like a bank website refusing to be accessed unless the entire OS & browser stack pass attestation - as that would rule out things like keyloggers, malicious browser extensions, and session hijacking. In practice it'll just be used to lock down content and force unskippable ads on users, of course.

one could imagine a scenario like a bank website refusing to be accessed unless the entire OS & browser stack pass attestation - as that would rule out things like keyloggers, malicious browser extensions, and session hijacking.

The important part is that "malicious" isn't up to you to decide anymore; if you have any "unapproved" software that acts in your interests and not others', this could theoretically be used to lock you out too.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#179

Post by Dalewyn » Tue, Jul 25, 2023, 1:45 AM UTC

kelnos wrote: post #63

mabbo wrote: post #32

> Exactly how the rest of the world feels about this is not necessarily relevant, though. Google owns the world's most popular web browser, the world's largest advertising network, the world's biggest search engine, the world's most popular operating system, and some of the world's most popular websites. So really, Google can do whatever it wants. This is the point that company breakups start to make a lot of sense.…

> When Google can do something that every one of it's users hates I don't think this is remotely the case. Quite a few tech-savvy people I know (some of them software developers) use Chrome and mostly don't care about whatever Google does with it. I mention "manifest v3" and get a blank stare. I talk about advertising and ad blockers, and most people don't care, with some of them not even using ad blockers. We really…

>Firefox is a perfectly viable alternative to Chrome that very few people use.

The problem is that it isn't.

Do you know why Firefox managed to usurp IE6 in the first place? Because it won the adoption and appeal of tech enthusiasts and professionals. Mom and pop (read: the general population) switched to Firefox from IE6 because their tech nerd kids installed it for them, and the enterprise largely moved off of IE6 dependence because the general population moved off.

But the Firefox today is not the Firefox that defeated IE6. Mozilla steadily eroded and destroyed every single thing tech enthusiasts and professionals loved about Firefox, to the point it practically became just a Chrome ripoff. At that point, why bother? Chrome's right there, the real deal.

Not to mention Mozilla happily takes money from Google with no shame at all so their CEO can get her fat paychecks.

Firefox is not a viable alternative, Firefox is literally controlled opposition to pedantically argue Chrome is not a monopoly. Not even the Intel and AMD x86 duopoly is this blatant.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#180

Post by danShumway » Tue, Jul 25, 2023, 1:46 AM UTC

alex7734 wrote: post #157

kelnos wrote: post #63

Earlier quoted context omitted.

> When Google can do something that every one of it's users hates I don't think this is remotely the case. Quite a few tech-savvy people I know (some of them software developers) use Chrome and mostly don't care about whatever Google does with it. I mention "manifest v3" and get a blank stare. I talk about advertising and ad blockers, and most people don't care, with some of them not even using ad blockers. We really…

> after all, Firefox is a perfectly viable alternative to Chrome that very few people use I don't use Firefox because it's slower than Chrome and because their behavior regarding limiting which extensions are available in phones, requiring signed extensions, Firefox Pocket, ads in new tab page, etc, does not exactly give me confidence that Mozilla truly has my interests in mind. In fact I bet they'll implement the ni…

uBlock Origin doesn't work on mobile Chrome. I don't understand this perspective. At the very least you would want to use an alternative Chromium browser on Android, even if you weren't willing to install Firefox. You're upset about not being able to run every extension and so you're running none of them?

Look, I will absolutely criticize Mozilla for some of its policies. Pretty much every issue you've raised there is spot-on, in fact I'll go a step further and remind everyone that Pocket was kind of supposed to be Open Source by now, and it still isn't.

But it's cutting off your nose to spite your face to use Chrome. Google is less receptive to criticism than Mozilla is, has worse extension APIs and is more restrictive of how extensions get installed, has worse privacy features, allows for no extensions on phones, is more directly tied into an advertising network, and is actively trying to make the web worse.

Use Firefox.

I am not telling you to be complacent or to ignore Mozilla's problems, I am telling you not to lend support to the browser that is actively trying to make the web worse. We're all very happy for you that you're very principled about not just picking the better of two bad options. We're happy that you have those standards. But we're less thrilled about your policy of picking the worst of two bad options. At the very heckin least you're not even going to use a Chromium fork? You're just going to make the worst browser choice you can make for the Open web?