311–320 of 876 posts
I've heard time and time again how this is "the end of the free web". Can someone succinctly explain how this is the case, for somebody not familiar with web browser architecture? What does WEI provide that wasn't previously possible?
Earlier quoted context omitted.
Is https://github.com/RupertBenWiser/Web-Environment-Integrity/... the best place to shame?
Yoav Weiss is closing concern threads, calling them "spam." Ben Wiser ( https://benwiser.com ) turned off comments altogether.
for a personal blog it has quite a lot of PR speak
Earlier quoted context omitted.
> this hold-back feature will be quietly disabled at some point in the future. Will it though? Googles main reason for WEI I assume is to combat ad-fraud. Ie. to prevent someone making a bot farm to click ads to earn money from advertising or exhaust competitors ad budgets or manipulate search engine user ranking signals. With WEI, all ad clicks without WEI could just be ignored (ie. not billed to advertisers, ignore…
As the middle man Google benefits from ad-fraud and has few incentives to really stop it. Ad-blocking is a real problem for them however, and they have huge incentives to prevent that. Ignore what they say - that's what WEI is actually about.
Companies give google $X, and hopefully sell Y extra products. X/Y is the cost per sale. Google competes with other advert forms (eg. TV/radio/newspaper ads) on that X/Y number.
If there is ad fraud, that Y number gets decreased (budget is used up on fraud that doesn't translate to sales), and their revenue decreases as advertisers spend their ad budget on other mediums.
Earlier quoted context omitted.
WEI turns non-compliant browsers into second-class citizens. You’re perfectly free to use whatever compliant browser engine and OS combo you like today – but in a world with WEI, you’ll have to use Approved Chrome on an Approved OS on Approved Hardware with Approved Signing Keys, or you won’t be able to sign into your bank.
isn't this good? banks can raise security while we can still use any browser to check hackers news! or this 3 cows story?
Earlier quoted context omitted.
I sparingly run into sites that don't render properly on Firefox but they do exist. As an example, Ticketmaster's account page has problems on Firefox that I don't get on Chromium.
Firefox is helping you, Ticketmaster is evil.
Earlier quoted context omitted.
> Google needs to be broken up. To make it explicit: the only way this happens is by Americans voting for it. The FTC has been more active on anti-trust issues in the past two years than at any time in the past 30. That's a direct result of the 2020 election. Elections matter.
The FTC isn't going to do anything as Google/Alphabet is a big donor to the Democrats. https://www.opensecrets.org/orgs/alphabet-inc/recipients?id=... Here is them lobbying specifically around antitrust reform legislation: https://www.opensecrets.org/federal-lobbying/bills/specific_...
https://www.nytimes.com/2023/01/24/technology/google-ads-law...
n.b. I've found a lot of comfort by conciously rolling away from any subject that leads me to do "They"-ing, i.e. name an enormously large group, then talk about them as a unit. The more I avoid it, the more I realize how prevalent it became and drives how a lot of us feel society shifted.
Can you give me an idea as to why WEI is a bad idea for the web? Granted, it is morning, but as I am going through the notes linked ( https://googlechrome.github.io/OriginTrials/developer-guide.... ), I am not sure I understand why it is that bad.
As a general rule of thumb, web technology has traditionally separated the content and protocol from the browser ("user agent") in terms of concerns. By which I mean, a user agent needs to be able to handle any possible input without breaking, and a web server needs to be able to handle any possible request without breaking. WEI tries to shortcut that process by creating a secured sign-off system that would allow the…
Mozilla should call for Google's removal from the W3C over this implementation of Web Environment Integrity. "But Chrome has 65% market share, what good is the W3C without them?” If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw…
They had enough weight at the time to say "The Web is XHTML2, you can make your own internet if you want " compared to what they can bargain for these days.
Maybe at the time it was a somewhat reasonable decision to abdicate their responsibility over to big internet companies, but that's what brought us to the current state where we're basically going back to original version of The Microsoft Network[1].
Earlier quoted context omitted.
The FTC isn't going to do anything as Google/Alphabet is a big donor to the Democrats. https://www.opensecrets.org/orgs/alphabet-inc/recipients?id=... Here is them lobbying specifically around antitrust reform legislation: https://www.opensecrets.org/federal-lobbying/bills/specific_...
So are Amazon: https://www.opensecrets.org/orgs/amazon-com/recipients?id=D0... and Microsoft: https://www.opensecrets.org/orgs/microsoft-inc/recipients?id... And yet we see high profile activity against them from the current FTC.
And Intuit: https://www.opensecrets.org/orgs/intuit-inc/recipients?id=D0..., https://www.ftc.gov/legal-library/browse/cases-proceedings/1...
And Epic: https://www.opensecrets.org/orgs/epic-systems/recipients?id=..., https://www.ftc.gov/legal-library/browse/cases-proceedings/1...
etc. etc.
One thing about this that I don't understand is how they intend to validate memory without controlling the entire stack (which we aren't even 1% close to achieving on the desktop). If I poke /dev/mem, does that mean Chrome will have to validate every single byte of it's ram? Or does it rely on having a fully locked down environment (maybe feasible on phones).
There's just no such thing as verifying a "secure environment" outside of extremely narrow, controlled scenarios.