Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity API Proposal

github.com

Post reply on HN
Print view View original

441–450 of 460 posts

Re: Web Environment Integrity API Proposal

#441

Post by netbeethoven »

PontifexMinimus wrote: post #349
iddan wrote: post #305

Earlier quoted context omitted.

Google is not stronger than the EU.

This presumes that the EU (1) Understands what this is about (2) cares about its citizens' freedom (3) has enough coherence to actually do something about it It's not obvious to me that any of these apply. The EU is pushing -- in fits and starts -- towards self-reliance in its computing infrastructure, but at a slow pace.

Of these, number 1 is probably the most doubtful. The EU, however boring that line of thinking is, is still quite bureaucratic, and it's doubtful that measures to control this, might not be a priority of bureaucrats. After all, the regs I mention later are in the name of "less e-waste" (which is good, but besides the point). So something like "control web DRM" might not be as blatant and easily solved (your point No.3).

For number 2, the EU's new regulations above more easily replacable batteries, mandatory USB-C ports and such, in my eyes prove -- though not doubtlessly -- that they do care about walled gardens in tech.

Number 3 though, again, as I've alluded to before, doubtful. But possible in my eyes. Urgency is another thing you've mentioned, and -- let's say it again -- bureaucrats are not particularly known for solving a problem in the right time.

NB: don't misenterpret my use of 'bureaucrat[ic]' as a negative comment, it is just a fact, however boring.

Re: Web Environment Integrity API Proposal

#442

Post by jacooper »

Dalewyn wrote: post #225
saagarjha wrote: post #215

Earlier quoted context omitted.

I think you missed the point of the comment you’re replying to. Without market share, the custom feature will never be respected by the web. At best if web developers don’t have to do any work for it you might get something that you can maintain for a while.

In fact, Edge is a perfect example of "nobody caring about your tiny fork": No matter what Microsoft tried, the internet no longer cared about Trident and IE/Edge. The only way Microsoft could regain some semblance of existing was to turn IE/Edge into Chrome and play the internet game as Google dictates. Nowadays Edge has some superfluous features that differentiate it from Chrome, but they are still superfluous. Und…

Still bummed they didn't go with gecko. (I know chromium is the superior engine, but Microsoft could've pushed gecko development to new highs for sure)

Re: Web Environment Integrity API Proposal

#443

Post by toshaexists »

What a weird dystopian world we find ourselves in. And, sadly, the despair in the comments reflecting utter defeat is very troubling. Times like this make me really miss the 90s, when the tech culture embraced open source and always found a way to outsmart the "googles" of that day. It is certainly a different time these days, however the game being played has always been the same. I wish people would completely re-envision the internet. Because, in reality, google has only captured one protocol. The web is much bigger than you all think. If you build it they will come sounds like a good philosophical statement to end this with.

Re: Web Environment Integrity API Proposal

#444

Post by rodgerd »

spystath wrote: post #20
tentacleuno wrote: post #13

Earlier quoted context omitted.

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1]. I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do…

> how do we protest this? You do not and you cannot. It was written in stone once Chrome dominated the browser market. What Chrome (Google) wants, Chrome (Google) gets. Despite all the good engineering Google wants to sell ads, that's all there is to it. And the result is this proposal. > The saving grace here might be that Firefox won't implement the proposal. It's irrelevant and we are an irrelevant minority. Unles…

> the web is Chrome

And lot of people here squeal like stuck pigs if you suggest anything other than the Chrome monopoly. HM is a constant barrage of demanding that legislators force the Chrome monopoly to be extended to iOS devices!

Re: Web Environment Integrity API Proposal

#445

Post by flangola7 »

apostacy wrote: post #110
flangola7 wrote: post #107

Earlier quoted context omitted.

Spotify will not load in a browser without a DRM plugin

Yes, but that is fairly recent! Did anyone even notice? For years, you could siphon every song you listened to and save it locally. But did it affect anything? I did it for a little while, but then found it wasn't worth the trouble.

Recent? I signed up 4 years ago and this has always been the case.

Re: Web Environment Integrity API Proposal

#446

Post by dhx »

RupertWiser wrote: post #333

Proposal author here I’m hoping to get back to everyone as soon as possible. I hope you can all appreciate that I’m a human being and this has been a lot! In the mean time, I wanted to repost my last comment on the GitHub issue thread [1]: Hey all, we plan to respond to your feedback but I want to be thorough which will take time and it’s the end of a Friday for me. We wanted to give a quick TL;DR: - This is an early…

> giving websites a way to maintain anti-abuse protections for their sites without resorting to invasive fingerprinting.

What prevents a website from using invasive fingerprinting _AND_ WEI together? I strongly suspect websites will end up using both WEI and invasive fingerprinting because:

1. Websites will want to use invasive fingerprinting on old browsers and it would work within browsers that deliberately don't implement WEI.

2. Websites will want to get as much invasive fingerprinting information as they can get their hands on.

3. It is another layer of fingerprinting in the likely event that WEI is ineffective due to TPM exploits[1], operating system/driver exploits, web browser exploits, determined actors using rooms of computer display recording devices and robotic arm mouse movers, etc. Invasive fingerprinting further increases the cost and complexity to actors the website is trying to block.

> This is not DRM - WEI does not lock down content

It is absolutely 100% DRM. Your proposal states that devices would need to attest their configuration to the website. The website can then block the user because it doesn't want to show the news article to a Linux device where the user can block annoying pop-up ad videos, copy and paste the text or save the web page. The website can instead only allow devices which are factory-configured to block copy+paste, block saving web pages, block screenshots, etc. It's still DRM even with the proposed holdback mechanism because in the best case, a user will still be blocked 9/10 times (or whatever the holdback mechanism is set to). The more likely scenario is a website owner will just refuse to serve content until the client has attested itself. "The requested page can not be provided due to an unexpected problem. Try again in a few minutes."

There are so many flaws with the scheme as currently proposed I feel I could write for days:

Will websites be expected to block and ban users of AMD-SP now that it is broken[1]? Or will whoever conducts ad fraud just buy all the AMD-SP devices they can get their hands on?

As another author replied, are Gentoo users that compile their web browsers and operating systems from scratch just ignored, and the proposal pretends it won't impact these users?

How does the proposal allow users with specialist accessibility software to browse the web without being blocked for being a minority group that is not economically worth website owner's time to support? What prevents abuse of said specialist accessibility software for other purposes?

How would a new start-up developing a competing browser or phone from scratch, and are very much unknown and in a minority position, be able to convince millions of website owners to unblock/allow their new browser or phone? Cloudflare's Friendly Bots program refuses to respond to open source projects, so why would Cloudflare as an implementer of WEI care about new start-ups or small open source software projects?

[1] https://arxiv.org/abs/2304.14717

Re: Web Environment Integrity API Proposal

#447

Post by Cyphase »

circuit10 wrote: post #426
cjameskeller wrote: post #257

Earlier quoted context omitted.

I'm not sure what you mean. I used Teams on Firefox, from my Linux laptop just this week.

Last time I tried some icons were showing up huge (so they would take up most of the page)

Were you blocking any CSS/scripts/fonts?

Re: Web Environment Integrity API Proposal

#448

Post by knewter »

michaelmrose wrote: post #432
knewter wrote: post #431

Earlier quoted context omitted.

Brendan Eich getting fired was like watching the original internet get murdered by progressives. Everything since then has been about how I thought that would go.

He spent money to promote misusing a legal process to as it turns out illegally take his fellow citizens rights away. Why do you think that's acceptable?

A guy gave a $3100 dollars to a political cause of his choice that was on the ballot, and people with this ideology drove him out of the company he founded that fought very hard for internet freedoms.

Since then, Mozilla/Firefox has largely become irrelevant and absolutely no longer has the same privacy concerns and respects.

He donated money in opposition of a law he didn't want to pass. He didn't take anyone's rights away.

Re: Web Environment Integrity API Proposal

#449

Post by macintosh-hd »

jabbany wrote: post #56
josephcsible wrote: post #46

Earlier quoted context omitted.

Either Apple will make their devices refuse to sign the attestation if you're using it, or Google will remove Apple from its list of trusted attesters.

Or (most likely) they will negotiate how to split the money. Maybe through some kind of safe advertising consortium. Apple is just fine with collecting user data on platforms so long as they're the only ones doing it. Apple even runs its own ad network over its own app store.

If you ask anyone who works in advertising they always say Apple has by far the "worst" targeting options. They display ads in the App Store but the data they use to track is usually not very great.

Re: Web Environment Integrity API Proposal

#450

Post by tobr »

RupertWiser wrote: post #333

Proposal author here I’m hoping to get back to everyone as soon as possible. I hope you can all appreciate that I’m a human being and this has been a lot! In the mean time, I wanted to repost my last comment on the GitHub issue thread [1]: Hey all, we plan to respond to your feedback but I want to be thorough which will take time and it’s the end of a Friday for me. We wanted to give a quick TL;DR: - This is an early…

> I will reopen them after the weekend

I suspect you didn’t just forget. It would look good to at least explain why you’re not following through on this, as it’s now Thursday in parts of the world.

Post reply on HN