Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity API Proposal

github.com

Post reply on HN
Print view View original

51–60 of 460 posts

Re: Web Environment Integrity API Proposal

#51

Post by emilsedgh »

spystath wrote: post #20
tentacleuno wrote: post #13

Earlier quoted context omitted.

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1]. I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do…

> how do we protest this? You do not and you cannot. It was written in stone once Chrome dominated the browser market. What Chrome (Google) wants, Chrome (Google) gets. Despite all the good engineering Google wants to sell ads, that's all there is to it. And the result is this proposal. > The saving grace here might be that Firefox won't implement the proposal. It's irrelevant and we are an irrelevant minority. Unles…

This is not the right attitude. Google wanted AMP. Google didn't get AMP. AMP is dead.

Re: Web Environment Integrity API Proposal

#52

Post by jabbany »

tshaddox wrote: post #28

It seems like a pretty clever way to propose extremely powerful DRM functionality, phrased as if it’s about trust and security.

It's not even phrased like that... If you read their examples it's very clear that they're not hiding the goal of using it as DRM for advertisiers.

In fact, their first example (!) outlines how this would be appealing to advertisers because they can attest a real human is viewing the content.

Re: Web Environment Integrity API Proposal

#54

Post by enumjorge »

tentacleuno wrote: post #13
saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1]. I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do…

> The saving grace here might be that Firefox won't implement the proposal.

As others have said, FF doesn't have a lot of leverage left to influence those type of decisions, but Safari might. Not sure what their position is on this proposal.

The one pager has a section on stakeholder feedback [0], but doesn't name them for some reason.

[0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

Re: Web Environment Integrity API Proposal

#55

Post by cesarb »

saurik wrote: post #10
PaulHoule wrote: post #3

Earlier quoted context omitted.

It looks very similar to the “secure boot” mechanisms in Windows and other commercial client OS. Strikes me as very dangerous though on the web where there are so many paths for malware to get in and this could get in the way of plugging the holes.

It was also dangerous for your PC: as soon as people ceded the ability to led their parties control what we run on our devices--such as by "only firmware signed by Apple can run on my phone"--we lost this war.

> It was also dangerous for your PC: as soon as people ceded the ability to led their parties control what we run on our devices--such as by "only firmware signed by Apple can run on my phone"--we lost this war.

If that's how "we lost this war", then it was lost before it even started. Even before Apple released their phones, it was already the case that phone firmware came only from the phone manufacturer. That is: phones come from a different lineage than PCs, and were never as open as general purpose computers ended up being.

Re: Web Environment Integrity API Proposal

#56

Post by jabbany »

josephcsible wrote: post #46
eropple wrote: post #18

This is a level or two below where my knowledge of the browser trails off, so I'll ask generally: how would this interact with things like the WebKit Content Blocker API?

Either Apple will make their devices refuse to sign the attestation if you're using it, or Google will remove Apple from its list of trusted attesters.

Or (most likely) they will negotiate how to split the money. Maybe through some kind of safe advertising consortium.

Apple is just fine with collecting user data on platforms so long as they're the only ones doing it. Apple even runs its own ad network over its own app store.

Re: Web Environment Integrity API Proposal

#57

Post by phpnode »

The underhanded way this is being proposed is really something else. It's hosted on a non-google github to provide distance, it's worded in a way that makes it seem like this is something that benefits users, when it's the absolute opposite of that. It subverts the whole concept of a user agent. This is a huge threat to our industry and we cannot allow this to happen.

Re: Web Environment Integrity API Proposal

#58

Post by enumjorge »

wmf wrote: post #50
sergiomattei wrote: post #24

Proposals like this demonstrate the utter failure of our ethics education in computer science. In a field facing increasingly harder ethical questions every day, it’s important to start empowering our engineers to say “no” to ethically bankrupt things like this.

You might be disappointed. Ethics training can't force people with different political viewpoints to conform to yours; in fact it gives them better tools to explain their views.

I don't understand why ethics in engineering has to be framed as a political discussion.

Re: Web Environment Integrity API Proposal

#59

Post by quenix »

What's strange to me is that the main author of the spec -- Ben Wiser -- seems to be against closed, wall-garden paradigms as he has written in a blog post "I just spent £700 to have my own app on my iPhone" [1]. In the post, he laments the state of the App Store monopoly on iOS and ponders returning to Android for the app installation freedom.

How can he reconciliate these views with this spec, which he is the main author of? Surely Ben sees the parallels?

He writes: "Apple’s strategy with this is obvious, and it clearly works, but it still greatly upsets me that I couldn’t just build an app with my linux laptop. If I want the app to persist for longer than a month, and to make it easy for friends to install, I had to pay $99 for a developer account. Come on Apple, I know you want people to use the app story but this is just a little cruel. I basically have to pay $99 a year now just to keep using my little app."

It's honestly comical and a little sad.

[1]: http://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-o...

Re: Web Environment Integrity API Proposal

#60

Post by madeofpalk »

saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

> and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access)

Interesting that fixing "how to center a div" is considered harmful, but WebSerialPort is actually very good?

> The result: there is now effectively one dominating web browser run by an ad company who nigh unto controls the spec for the web itself

I don't think this this reality. Google proposes a bunch of APIs that goes nowhere because the other browser vendors consider them harmful. Google's previous attempts at trying to drive more adtech into the browser have failed due to a lack of support from other browser vendors.

I think "who drives the web specs" is probably in the best situation possible. It's largely Google, Mozilla, and Apple who all have slightly different interests in what makes a good web platform, and the web ends up better for it.

Post reply on HN