Web Environment Integrity API Proposal

>device controlled

A website is limited in what it can do by the browser it runs in.

>unmodifiable

Since responses are generated server side you can not modify what they send you.

>broken on nonaproved hardware

There are existing sites which don't support Linux or don't support mobile devices.

>true neutrality of OS and hardware is incompatible with attestation

Attestation doesn't mean that HTML now renders differently. The User Agent string already allows servers to block OSs.

>There is a zero percent chance that detecting bot traffic for advertisers will not turn into adblocking/automation restrictions over time

Sites can already detect adblocking without attestation. There is no evidence that the precense of an adblocker will be a signal to whether an environment is trustworthy. That is not the purpose of the API.

>given Google's history around adblockers

They have worked to support ad blocker extentions and they have provided a platform to ad blocker extentions. They have banned a malicous adblocker which also committed clickfraud. They have had some anti adblock experiments on YouTube such as limiting the resolution.

>We are far, far past the point where Google deserves the benefit of the doubt on this

I disagree.

>Chromium is already less effective at adblocking than Firefox is today

It works fine for me.

>Manifest V3 is still set to make adblocking worse

No, it won't. You just have to use a different API.

>despite employee claims that these efforts were not intended to harm adblockers

They care about improving the experience of the entire chrome user base. Getting rid of poorly designed APIs is a part of making Chrome better for everyone.

>We're not jumping to conclusions

Yes. You are. Google is trying to make the web more private and secure from the current state the web is in. Look at the reponse to FLOC. Despite increasing user's privacy many people forgot upset because they greedily want the web to cater to only them and not to people who rely on advertising. Similarly with Web DRM people panicked because they didn't want DRM because they only care about themselves and do not care about people who want their content to be protected. There is a theme where people get outraged because they don't understand that there are more people who use the web and have different needs than just them.

Giving people the option to protect their content or the option to use attestation as a signal doesn't prevent some idealized open web from existing. Sites that would like extra security can opt into it.

Almost no users want to be digital hermits. This protest approach has nobody following you up that mountain to the hermitage.

Most users are more comfortable with computers that are toasters, not (hackable) general purpose machines.

The flexibility to hack implies the flexibility to be owned. Users don't want to get owned. They hate that so much they'd voluntary choose an owner

It all started with "trusted computing", where "trusted" means "not under the owner's control". Then they tried to spin it as a "security" thing with TPMs, and created the impression that those speaking out against them were either malicious actors or insane conspiracy theorists.

Now it is actually happening. They want to control exactly what hardware and software you use, and they're doing it by ostracisation, which makes this even more sinister: you're still technically allowed to use software and hardware of your choosing, but you'll be blocked from participating.

I still remember when Intel was forced to revert adding a unique serial number to its processors because of widespread outrage, so it is possible for the public to make a difference; they just need to be educated about the coming dystopia and agitated enough to care and act upon it.

Perhaps we can start by spreading instructions on how to disable TPMs and "secure" boot along with all the advantages that come with doing so (custom drivers, running whatever OS you want, hardware you actually own, etc.) Of course the corporate-owned "security" lobby is going to start screaming that it's "insecure", but we need to make it clear that this is not the "security" we want because it is inherently hostile to freedom.

"Those who give up freedom for security deserve neither."

https://www.gnu.org/philosophy/right-to-read.html