Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

arstechnica.com

Post reply on HN
Print view View original

271–280 of 484 posts

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#271

Post by sanxiyn »

smaudet wrote: post #245
tiltowait wrote: post #146

Earlier quoted context omitted.

This line is what makes me roll my eyes whenever I hear someone say "Safari is the new IE". Safari missing a couple of features few websites use is far less of an issue than the dominant browser company can just invent new "standards" that make the web actively worse for everyone. (Sorry, I should say "everyone except for the scummy advertisers".)

Safari is just Apples Opera (before they went Blink and made themselves irrelevant). They aren't great, just another proprietary browser. Every time I've used it has been sub-par. It reminded me a lot of Opera in that it was very opinionated, even if it tried to offer some feature. Apple makes money off of apps, not websites, though, so it makes sense they don't invest much into their browser.

Safari has the fastest JavaScript engine. In many respects, Safari's implementation is top notch. Apple makes money off phones and people use Safari a lot on phones. I don't understand why people think Apple don't invest on Safari.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#272

Post by heipei »

What I've seen missing in these discussions is what happens with Headless browsers. Yes, these are used a lot for scraping, but there are also many legitimate use-cases. If the Web Integrity API is available to everyone then you can effectively no longer use Headless Chrome to browse to any of these pages, or am I missing something?

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#273

Post by piva00 »

wraptile wrote: post #206
PaulDavisThe1st wrote: post #200

The people involved in this concept/idea/proposal should be shamed into retirement. They should never work in the tech sector again. They should be afraid to use their names before first knowing their audience (an agricultural audience would likely be OK).

It's really perplexing how people in such privilidged positions would put their name on this. Either their not as smart as they appear or somehow manipulated/corrupted.

One of them has been a SWE for only about 5-6 years, probably a smart person but naive enough to be the face of this proposal being pushed by some bigger fish in Google Corp that didn't want their name attached to it.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#274

Post by schroeding »

javajosh wrote: post #144
doliveira wrote: post #106

Earlier quoted context omitted.

Do you know how rooting Android is basically useless nowadays? Most banking and government apps, at least in my country, don't work if Google didn't give the seal of approval for your system. I take it you see as good thing to bring this to the browser as well, because this somehow has to do "personal computer advocacy"? It literally cripples the users' devices.

I don't see the connection between Chrome attestation and Android attestation. A computer has only one operating system (in general) but many browsers. I see some value in attesting to a "pristine" browser environment to any application developer, as it removes a wide array of error modes (particularly useful if you have a weak or underfunded team). Now, if the application provider chooses not to support the alternat…

Browser attestation only works if the OS is attestated, though. It has to be an unbroken chain of signed blobs from the TPM / boot loader to the browser - otherwise, you could just use e.g. a kernel driver to modify the behavior of a signed browser.

If WEI is implemented, we will get the combo package.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#275

Post by Springtime »

notatoad wrote: post #170
ineptech wrote: post #93

Earlier quoted context omitted.

I don't buy this. I'm sure most iphone users don't care when you ask them about privacy or manifest v3 as an abstract concept, but remember what happened when Apple tried to push a U2 album to them? They lost their collective shit. They may not write blog posts about privacy or donate to the EFF, but they have deeply personal relationships with "their" phone and they absolutely hate being reminded that it isn't reall…

>when Apple tried to push a U2 album to them? They lost their collective shit and that's exactly it. putting something in your music library is a hugely more visible and tangible thing than all the nebulous privacy concerns the internet wants me to be afraid of. nobody gives a shit if google or apple or facebook or whoever else introduces some techical measure that could be used for nefarious things. they only care i…

> as long as the argument is "well if google implements X, then it would potentially allow them to do Y", that's a failing argument.

It's similar to privacy 'dead bodies'[1], where users want to know actual concrete examples. I keep a collection of them in a larger directory of web pages about privacy, about instances where 'nebulous' privacy aspects meet reality and users are impacted and upset by it.

[1] Term used by a law professor in Daniel J. Solove's "I've got nothing to hide" and Other Misunderstandings of Privacy

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#276

Post by benterix »

exitheone wrote: post #67
benterix wrote: post #46

Earlier quoted context omitted.

Not until Mozilla gives in.

The market share of firefox is so low and there are already a ton of popular websites that don't work on firefox. Mozilla will very much be forced to follow along here.

> there are already a ton of popular websites that don't work on firefox.

Like which one?

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#278

Post by troupo »

sanxiyn wrote: post #271
smaudet wrote: post #245

Earlier quoted context omitted.

Safari is just Apples Opera (before they went Blink and made themselves irrelevant). They aren't great, just another proprietary browser. Every time I've used it has been sub-par. It reminded me a lot of Opera in that it was very opinionated, even if it tried to offer some feature. Apple makes money off of apps, not websites, though, so it makes sense they don't invest much into their browser.

Safari has the fastest JavaScript engine. In many respects, Safari's implementation is top notch. Apple makes money off phones and people use Safari a lot on phones. I don't understand why people think Apple don't invest on Safari.

Because people are in arms about Web Integrity API, but a lot of the same people will crucify Safari (and Firefox) for not implementing a bunch of Chrome-only non-standards (like the plethora of hardware APIs)

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#279

Post by bayindirh »

That's wrong on so many levels, I don't know even where to start.

First of all I hate this "proposals" which is actually, "we implemented this in our flagship product, and kindly force it on our users, you don't have to use it, if you have a choice", stance.

Then comes all the "ensuring they aren't a robot and that the browser hasn't been modified or tampered with in any unapproved ways." part. I'm using an open source browser which is not Chromium based (i.e. Firefox). I can modify and recompile the way I want it. I can use links/elinks/lynx/dillo if I want (and I use them, too). Who do you think you are, and how come dictate my software I use on my own computer?

It's 90s DRM wave all over again. Constant attacks towards open software, open platforms, open protocols.

It's maddening and saddening at the same time.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#280

Post by superkuh »

no_time wrote: post #248
superkuh wrote: post #89

Even if this DRM doesn't get accepted and used Google's QUIC protocol they call "HTTP/3" that they whitewashed through the IETF with MS makes it so it's impossible to establish a connection to a server unless it gets 'attestation' from a third party CA TLS corporation. It's the same thing in different clothing but everyone is cool about it for some reason. Google should've just called this HTTPS+ Everywhere and there…

Can you post the relevant part of the spec or discussion of it? This sounds wack but I'm not seeing it.

The spec suggested defaults don't matter when all current HTTP/3 implementations will not let compiled software users connect to a site with a self-signed cert (or none at all).

But also the spec itself is bad: "MUST" in capital letters when talking about setting up the HTTP3 endpoint and verifying the cert. https://datatracker.ietf.org/doc/rfc9114/

There are compile-time flags you can use to enable it in the QUIC HTTP/3 libs you can then manually link when compiling your personal browser. But with Google/Microsoft/Apple/Mozilla browser binaries used by the public they will not be able to connect.

Post reply on HN