Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

arstechnica.com

Post reply on HN
Print view View original

371–380 of 484 posts

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#371

Post by jeltz »

BiteCode_dev wrote: post #314
rvz wrote: post #104

Earlier quoted context omitted.

As long as Google is still leading in the browser market share, they do not care or give a shit and will never change.

So many people are harsh Google critics, yet still never use duckduckgo, don't try to migrate from gmail, or stick to firefox. Complaining is easy, but apparently even small compromises like these are hard.

I use Firefox on desktop and mobile, I use DDG, stopped using Google Analytics but I sadly still use Gmail and Android. I degoogled the east things (e.g. GA and Chrome) but getting totally rid off Google is hard.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#372

Post by flagrant_taco »

altfredd wrote: post #302
wraptile wrote: post #203

Earlier quoted context omitted.

This has been happening already. The market is trying really hard to price out web scraping through scraper detection technologies and it's kinda working - scraping is becoming non-existent in user-space apps. It's also extremely discriminatory. Try running a single scrape with a developing country's IP and Linux, you'll be blocked at TLS step lol

> The market is trying really hard to price out web scraping... scraping is becoming non-existent in user-space apps Uhh... Those two matters are pretty much unrelated to each other. Scraping is becoming non-existing because the era of static web pages has ended. No need to "scrap" when you have a nice, performant JSON REST API provided for you.

SSG vs SSR really has nothing to do with whether an API exists to provide the data you would otherwise need to scrape.

When was the last time you saw a site with a JSON API providing metadata, like the json-ld for a product on an e-commerce site? Or an API just for the open graph data? How would you even discover these APIs for sites that you don't own?

It's also worth noting that very, very few JSON APIs today are actually REST. They rarely include all the context needed, and in general JSON is much less useful than XML when you're talking to other APIs that you don't own since JSON can't easily describe the shape and datatypes of the content.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#373

Post by grishka »

bayindirh wrote: post #363
grishka wrote: post #330

Earlier quoted context omitted.

> It's 90s DRM wave all over again. Except in the 90s you controlled 100% of the code running on your computer. Now there are all kinds of treacherous computing with all those "trusted" execution environments and TPMs and all the other bullshit that can't be avoided, with someone else's public keys burned into the silicon.

Nope. In the 90s we also had tons of closed code on our computers, namely the BIOS, proper firmware embedded in plethora of peripherals (Disks, Ethernet cards, Microcode in the CPU, etc.), yet due to computing constraints, this has been only tried in forms of Pentium 3 Serial Numbers + Windows APIs + IE6. However; courts, Free Software Movement and alternative operating systems plus Mozilla stopped this. Now all of t…

> In the 90s we also had tons of closed code on our computers

Sure, there was much closed code, but there was no signed or trusted code. You could still reverse engineer, patch and reflash every single bit of it to your liking, provided you knew what you were doing. On modern hardware, even dumping the decrypted binary for the "trusted execution environment" is a challenge, and getting the thing to run your modified version is simply impossible because it needs to be signed with a key you don't have.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#374

Post by fifteen1506 »

gloosx wrote: post #301
whatshisface wrote: post #296

Earlier quoted context omitted.

> once a copy of the content is server to AT LEAST one attested user agent – what prevents him from sharing his copy with unattested users? This is already covered by the DRM in all major web browsers today. If your software will allow that, it can't get attested.

I don't understand – how exactly DRM knows that I have a video-capture card recording my screen right now? The browser has no idea. Or what prevents me from copying NYT article and re-hosting it? What DRM has to do with it?

I'm out of the loop of current DRM.

I assume it's something like the old Protected Media Path.

For example, if you try to screenshot a Netflix video all you screenshot is a dark-pinkish square, because the video is probably added by the graphics card at the last moment.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#375

Post by flagrant_taco »

userbinator wrote: post #131

It's great to see this getting more attention. User-agent discrimination (i.e. "go away if you're not using the latest version of Chrome") needs to become illegal. As long as I'm not overloading your service or similar, what hardware or software I use must not be restricted. The same goes for other deliberate obstacles to accessibility and interoperability --- creating a "standard" that's so complex and churned frequ…

> It's great to see this getting more attention. User-agent discrimination (i.e. "go away if you're not using the latest version of Chrome") needs to become illegal.

I really hate this attempt by Google and hope they don't follow through, but why should this be illegal?

Software users agent strings are just an identifier added on by a browser to give the server context, it's not a protected class. Google has every right to gate use of their software however they choose, we can just stop using it.

We don't have a fundamental right to an open internet, no one owes us this. I hope we can get back to the days when the internet was much more open and less commercialized, but that day won't come by legal regulation.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#377

Post by flagrant_taco »

dhx wrote: post #229
TylerE wrote: post #154

Earlier quoted context omitted.

Why shouldn't the owner/operator of a website be able to decide who to sling bits to? How is this, conceptually, any different from sites that used to block IE out of spite?

For the same reasons a shop owner must sell to all customers without discriminating on ethnicity, religion, disability, etc? Would it be acceptable for a website owner to block users from Detroit (78% African Americans)[1] or block users from El Paso (82% Hispanic)[2] because the website owner claims that fraudulent ad clicking is more prevalent from those cities? Would it be acceptable to only serve web pages to peo…

This is a massive leap in assumptions and arguments.

For one, blocking users in a geographic region would not be legally considered racial discrimination unless you can prove intent. This is the bullshit loop hole that makes it easy to get away with discrimination, but that's the way it works.

If Google really wants to play this game and create a technical gate preventing usage of sites by anyone that uses a browser that may be blocking ads, there's a legitimate business need there and all they have to say is they are no longer willing to serve users that refuse to pay by viewing ads and providing valuable data. In the case of Chrome they can extend this and say they are helping make sure anyone hosting content online can also protect their revenue as well.

Is that a shitty practice and will it cripple the internet as it was originally designed? Absolutely. But likening this to systemic racism is an insane argument and really doesn't help get at the underlying problem that we would all rather have an internet that is open, free, and not designed entirely as a corporate ad playground.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#378

Post by exitheone »

benterix wrote: post #276
exitheone wrote: post #67

Earlier quoted context omitted.

The market share of firefox is so low and there are already a ton of popular websites that don't work on firefox. Mozilla will very much be forced to follow along here.

> there are already a ton of popular websites that don't work on firefox. Like which one?

https://support.mozilla.org/en-US/products/firefox/fix-probl...

Try searching for "only chrome".

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#379

Post by flagrant_taco »

urda wrote: post #237
EvanAnderson wrote: post #92

The proposal author (who locked the issue[0] on Github) also commented on HN and has, so far, remained silent here too: https://news.ycombinator.com/item?id=36825097 [0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

They have also violated an important Code of Conduct [1], to the point of even aggressively closing valid complaints [2]. The Googlers RupertBenWiser [3] and yoavweiss [4] are really just toeing the Google line. What's super gross is even yoavweiss tried to play pretend that the original issue they forced closed, without comments or reading, was "spam" [5]. I believe both of these users are acting in very-bad-faith,…

I wish it didn't take bad faith efforts to enforce anti-trust laws, if we even get there with Google.

Im not a fan of big government and regulation, but if we're going to have anti-trust laws on the books they should be enforced evenly. It's so crazy to me that Bill Gates got raked through the coals for years over IE while Google and Apple have been allowed to get away with much, much worse.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#380

Post by cxr »

urda wrote: post #237
EvanAnderson wrote: post #92

The proposal author (who locked the issue[0] on Github) also commented on HN and has, so far, remained silent here too: https://news.ycombinator.com/item?id=36825097 [0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

They have also violated an important Code of Conduct [1], to the point of even aggressively closing valid complaints [2]. The Googlers RupertBenWiser [3] and yoavweiss [4] are really just toeing the Google line. What's super gross is even yoavweiss tried to play pretend that the original issue they forced closed, without comments or reading, was "spam" [5]. I believe both of these users are acting in very-bad-faith,…

Claims of code of conduct violations on the basis that the technical proposal itself is a violation of the Positive Work Environment provisions is a stretch. It is, however, a clear violation of the Priority of Constituencies[1], including the dictum about who is in control: the Web must enhance individuals' control and power[2].

Having said that, the comment that Weiss links to when citing himself...:

> I understand many folks here are upset about this proposal. I urge you to actually read the proposal, rather than rely on rumors about what it does or doesn't propose. If it's at all helpful, I wrote a few words about ways you can constructively engage with proposals you don't like.

... almost certainly does run afoul of the W3C's provisions for acceptable and unacceptable behavior outlined in the code of ethics and professional conduct. Implying that someone who is "upset" about the proposal is responding to rumors and that it is okay to admonish them to "actually read [it]" is both uncharitable and noxious to the discussion. There's a good reason why HN, for example, has an explicit rule against accusing people of not having read the article.

1. https://www.w3.org/TR/design-principles/#priority-of-constit...>

2. https://www.w3.org/TR/ethical-web-principles/#control>

Post reply on HN