I hope this is something that non-Chrome Chromium-based browsers can omit from their builds.
Google is already pushing WEI into Chromium
501–510 of 876 posts
Re: Google is already pushing WEI into Chromium
#502Earlier quoted context omitted.
Yoav Weiss has a blog post from 6 days ago on his website. https://blog.yoav.ws/ for a personal blog it has quite a lot of PR speak
Oof. It does check, though, that the guy CoC-blocking all the github comments would have blog posts like the Professor Umbridge of the W3C.
I think people like to take the easy way out of declaring those with a different mindset "evil." Everyone is the hero of their own story, and honestly there are multiple incompatible-but-internally-consistent models of how technologies can and should work. I think it's more useful to recognize these things than to write off a competing mindset (especially when the competing mindset is in a position of power).
Consider incentives from Google's standpoint. They want to provide users a safe and secure experience. They want to simplify maintenance of software and provide developers the ability to simplify maintenance of software (a problem simplified by chopping the unbounded set of possible user agents down to a blessed, vetted subset). They have the resources to make their site screen-reader compatible, so they're not concerned about damage that could be done to screen-readers because they'll just bless one and support it. And, of course, they implicitly trust themselves to do all this.
In that ecosystem, Weiss's viewpoint is completely reasonable. The old model of the web is old, and led to gestures broadly at all the bad things about the web today... fraud, users getting owned, CP, botnets, misinformation factories. I can definitely see the viewpoint where someone concludes "It's time for a new model, and this company has the resources to do it."
I don't agree with him (and in fact I think the idea will fail; I think Google actually overestimates its ability to provide an equivalently-good user experience to what we have now if they aren't leveraging the unpaid labor of other vendors putting the effort into making their own houses work with Google's house without Google even being aware of their work). But I think it's useful to wrap our heads around how one gets into that headspace without thinking oneself a monster.
Re: Google is already pushing WEI into Chromium
#503As someone who is a somewhat new to web technologies, can someone really explain why this is bad? I saw the techical discussions in the PRs made to the WEI repo but it was all super technical that I was not able to understand the arguments made for and against it.
To put it simple, it makes it possible for service provider to reject providing service to clients not running corporate-owned white-listed clients. Thus making it virtually impossible to create independent clients for such services.
It will be swiftly adopted by well meaning but clueless bank and government clerks who will accidentally use to lock all open hardware, open operating system, open browser users out and mandate you need to purchase at least one locked down corporate device to exist.
It's the trusted computing story all along. Eventually you will need permission to run your code on your own device and such "unlocked" device will be blocked from accessing any digital infrastructure because it might be otherwise used to breach ToS.
Re: Google is already pushing WEI into Chromium
#504Earlier quoted context omitted.
Corporations will dismiss all of that as asshole Luddites, and do it anyway. You're not Google's customer. The advertisers are. The only way to stop Google from treating the Web as their own OS is to take that power away from them, by switching to other browser engines.
And we have this crappy paradox that Mozilla is held to an impossibly high standard. People want to burn them to the ground for daring to use Google Analytics, or the Pocket acquisition, and keep using a 100% Google browser, with preferential integration with all of Google's services/protocols/APIs.
I think that's a false dichotomy. It's possible to criticize Mozilla (ideally in good faith) for both the way in which they develop Firefox and their focus/mission in general, while at the same time using Firefox, since to me it looks like the best alternative we've got.
Not every Mozilla critic is a Chrome user; I'd even expect that the most vocal critics are Firefox fans and users.
Re: Google is already pushing WEI into Chromium
#505Earlier quoted context omitted.
Yes, and I am still unable to play 4K Netflix on a PC that has been able to play 4K videos for about 7 years now. It's permanently blocked to prevent piracy, or something, mumble, mumble...
There are several ways to play 4k Netflix videos on any platform you want, because nothing they are doing actually prevents piracy.
It's not about preventing, it's about controlling. Making everything as an appliance is the backbone of consumerism.
Re: Google is already pushing WEI into Chromium
#506Earlier quoted context omitted.
>> isn't this good? banks can raise security while we can still use any browser to check hackers news! Are you okay with buying a new computer running the operating system and browser someone else wants to access your bank's web site? You can still use you current computer and bowser to access HN.
Like many others in this thread you stack so many assumptions on top of each other. Why? I don't think that helps. Will this person's bank implement WEI in such a way that none of this person's devices (computer, phone) are supported and will this person not be willing or able to switch banks, only then buying a new computer comes into view. Without knowing anything about this person, assuming average, the chances fo…
I have talked to government officials responsible for my country's digital security policy and they have explicitly told me that they want remote attestation to lock out devices not running big corporate systems and they do not care about freedom. The same ministry is responsible for police. If they could, they would forbid you doing anything that is not explicitly legal just to be safe.
Re: Google is already pushing WEI into Chromium
#507Earlier quoted context omitted.
>> isn't this good? banks can raise security while we can still use any browser to check hackers news! Are you okay with buying a new computer running the operating system and browser someone else wants to access your bank's web site? You can still use you current computer and bowser to access HN.
Like many others in this thread you stack so many assumptions on top of each other. Why? I don't think that helps. Will this person's bank implement WEI in such a way that none of this person's devices (computer, phone) are supported and will this person not be willing or able to switch banks, only then buying a new computer comes into view. Without knowing anything about this person, assuming average, the chances fo…
It's called looking ahead to the straightforward results of the obvious power dynamic, to know what it will lead to when that dynamic gets entrenched enough to be taken for granted.
It's like how all these "free" websites coasted along for years being quite user friendly, but have recently switched to extraction mode. Anybody who thought about the incentives knew what was coming down the line eventually.
Re: Google is already pushing WEI into Chromium
#508Mozilla should call for Google's removal from the W3C over this implementation of Web Environment Integrity. "But Chrome has 65% market share, what good is the W3C without them?” If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw…
Good luck getting anything from Mozilla, Google is their largest source of revenue by far. Over half.
Re: Google is already pushing WEI into Chromium
#509Earlier quoted context omitted.
isn't this good? banks can raise security while we can still use any browser to check hackers news! or this 3 cows story?
In what way does this increase the security of my bank account? A criminal can use credentials it obtained via a hack, etc. using an approved platform to access my account. My own approved platform can be compromised by malware and used to access my account. This class of problems is addressed by physical ID tokens, not attestation.
Corporate world currently sells attestation as a way to create secure token out of everyone's phone to the public sector worldwide. They obviously want it for the walled gardens and to fight ad-blocking, but public sector really wants to "deal with the cyber criminality" and they are clueless.
Re: Google is already pushing WEI into Chromium
#510Earlier quoted context omitted.
The problem is that this feature can and will be used to restrict the users, it doesn't offer any real benefit to you. This will not increase security for the user either, it's just a new barrier at the risk of higher fingerprinting. Why should you care how your bank handles security? It's their responsibility, not yours to handle.
Because they have my money?
OK, then legislate that this shit can only ever be opt-in and then we can talk.