Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google is already pushing WEI into Chromium

github.com

Post reply on HN
Print view View original

771–780 of 876 posts

Re: Google is already pushing WEI into Chromium

#771

Post by danShumway »

izacus wrote: post #419
tolmasky wrote: post #197

Mozilla should call for Google's removal from the W3C over this implementation of Web Environment Integrity. "But Chrome has 65% market share, what good is the W3C without them?” If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw…

It didn't happen when Apple did it with Safari (and you all were quiet as a mouse as well, with HN actively defending Apple Safari monopoly with this feature enabled)... so why would NOW be any different?

> and you all were quiet as a mouse as well, with HN actively defending Apple Safari monopoly with this feature enabled

Citation? To be sure, there was not universal outrage over Safari's attestation implementation, but out of curiosity I looked up the only thread I was aware of, in part because I couldn't remember what my reaction was at the time. That thread was a year ago and the overwhelming sentiment of the comments section is critical: https://news.ycombinator.com/item?id=31751203

Here were my comments at the time:

- https://news.ycombinator.com/item?id=31752980

- https://news.ycombinator.com/item?id=31753257

- https://news.ycombinator.com/item?id=31752431

They're less forceful than they are now with Google, partially because I know more now about how attestation works than I did over a year ago, and partially because (as some people have also pointed out) Chrome's implementation is straightforwardly more dangerous than Apple's is.

But HN "actively defending" Safari? That's not the impression I get from the overall comment section and it's definitely not what I personally was doing. There are a lot of people in these comments calling Apple's implementation DRM. So I'm a little skeptical of the "nobody on HN cared about this with Safari" narrative that has sprung up; from what I can see media coverage was fairly positive, but people on HN were rightly critical. I'm not sure the facts match the narrative: Safari was criticized for this.

It's a fair critique that there wasn't a coordinated attempt to outright stop Apple, but I would once again remind everyone that attestation in Chrome is way more dangerous than attestation in iOS. The market matters, that's not context that can be ignored. So it's not really all that weird to me that people are more willing to react more strongly to abusive behavior in Chrome.

Re: Google is already pushing WEI into Chromium

#772

Post by derefr »

troupo wrote: post #674
tzs wrote: post #325

Earlier quoted context omitted.

> If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw this implementation. It's pretty generally accepted that the correct way to do web standardization is for proponents of some new thing to implement that thing and deploy it and…

> It's pretty generally accepted that the correct way to do web standardization is for proponents of some new thing to implement that thing and deploy it and then once it has been shown to actually work bring a spec to the the standards folks for standardization. - Behind dev flags - And then wait for consensus - And then there have to be at least two independent implementations And only then does this become a stand…

How is a company that runs a public website supposed to A/B-test marginal attach rates for a feature hidden behind a dev flag?

Re: Google is already pushing WEI into Chromium

#773

Post by liendolucas »

4oo4 wrote: post #627
hooverd wrote: post #604

Earlier quoted context omitted.

A customizable form letter would be nice to have, if anyone wants to jump on that. I'm not a great writer in that respect.

This is what I sent, feel free to use and customize: I would like to bring your attention to Google’s recent proposal to add a feature to its Chrome (Chromium family) of browsers called Web Environment Integrity. This provides a mechanism to reinforce Google’s already dominant browser market position by creating a technological control that can be used to nullify a user’s choice of browser, device and operating syste…

Should I submit my complaint right away or only after this disease starts spreading out without control? I'm in the EU.

Re: Google is already pushing WEI into Chromium

#774

Post by derefr »

slig wrote: post #752
matkoniecz wrote: post #640

Earlier quoted context omitted.

4% of global browser usage can be described in many ways (defeated, miserable, collapse compared to the past etc) but it definitely is not dead and is one of few developed browsers.

There's no plan, no growth, they don't have a mobile OS, and users will use whatever browser (aka, "the internet") comes with their device. On Windows, Edge is being heavily "promoted". Most of the technical people I know gave up, unfortunately.

Corporate + institutional mass installs on Windows and Linux — e.g. university computer labs — are still mostly Firefox. It's easier to lock down something that's not part of the OS; and it's easier to create a local-network roaming-user-profile experience that's seamless between the machines that must run Windows (regular labs) and the machines that must run Linux (CompSci labs.)

Re: Google is already pushing WEI into Chromium

#776

Post by derefr »

devsda wrote: post #397

There are many arguments against this but not many brought the implications for search engines. If websites implement this, it will effectively make building a web search engine impossible for new entrants. The current players can whitelist/attest their own clients while categorizing every other scraping clients as bots. If not for other reasons, I can't see how Google a search company can be allowed to push somethin…

> The current players can whitelist/attest their own clients while categorizing every other scraping clients as bots.

Can't they already do this by having scrapers send plain-old client certificates? Or even just a request header that contains an HMAC of the URL with a shared secret?

Actually, taking a step further back: why does anyone need to scrape their own properties? They can make up an arbitrary backchannel to access that data — just like the one Google uses to populate YouTube results into SERPs. No need to provide a usefully-scrapeable website at all.

Re: Google is already pushing WEI into Chromium

#777

Post by throw_m239339 »

tzs wrote: post #769
throw_m239339 wrote: post #736

Earlier quoted context omitted.

> The web was more open when to play those videos you had to use a proprietary Flash or Silverlight plugin? That's what you are claiming with your sarcasm hidden behind a rhetorical question, I've never said anything about Flash or Silverlight in the comment you've answered to. There is absolutely no difference from a conceptual perspective between EME implementation and proprietary plugins, EME is necessarily based…

You said the web stopped be open when EME was accepted. But as you just noted there is no conceptual difference between EME and the proprietary plugins that it replaced (Flash based and Silverlight based video players). So how does replacing something with something else that is conceptually not different change that status of the web from open to not open?

> You said the web stopped be open when EME was accepted.

Neither Flash or Silverlight were ever web standards. Flash was never accepted as a web standard. EME is a web standard.

EME is as bad as Flash or Silverlight from a conceptual perspective. EME has no place in web standards, no more than flash.

Again, it's you who brought up Flash and Co, I never brought it up.

Re: Google is already pushing WEI into Chromium

#778

Post by throw_m239339 »

asadotzler wrote: post #750
throw_m239339 wrote: post #736

Earlier quoted context omitted.

> The web was more open when to play those videos you had to use a proprietary Flash or Silverlight plugin? That's what you are claiming with your sarcasm hidden behind a rhetorical question, I've never said anything about Flash or Silverlight in the comment you've answered to. There is absolutely no difference from a conceptual perspective between EME implementation and proprietary plugins, EME is necessarily based…

Flash wasn't just DRM though. Incorporating video and animations into the web proper through browser was a win for the web despite the bitter pill of not ridding ourselves of DRM.

> Flash wasn't just DRM though. Incorporating video and animations into the web proper through browser was a win for the web despite the bitter pill of not ridding ourselves of DRM.

DRM as implemented by EME is necessarily a closed source, proprietary plugin just like Flash, I never said that Flash was just a DRM. Flash could be used as DRM system, in fact its video format FLV supported DRM.

Re: Google is already pushing WEI into Chromium

#779

Post by derefr »

EvanAnderson wrote: post #697
helen___keller wrote: post #677

Earlier quoted context omitted.

WEI proposal leaves open the functionality of the attester, so it’s neither correct to say this will prove requests are humans nor that it simply proves a sanctioned OS/browser. The attester will attest whatever they want. They can evolve to match the further degradation of user freedoms.

> The attester will attest whatever they want. They can evolve to match the further degradation of user freedoms. Agreed. Eventually the attestor will be measuring “proof of life” with the camera, for example. “Please drink verification can” isn’t too far down that road either.

> Agreed. Eventually the attestor will be measuring “proof of life” with the camera, for example.

Ultimately, it's all just instructions being sent to your computer to be executed, and "your computer" is whatever you say it is. Everything (e.g. Intel SGX et al) can be emulated in a sandbox. That's how modern DRM is defeated.

Re: Google is already pushing WEI into Chromium

#780

Post by derefr »

jmvoodoo wrote: post #183
andersa wrote: post #136

Earlier quoted context omitted.

Why do you think they don't have consensus or approval from all the people that matter? This is far too big for that. Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Governments will like it for "security", and 99% of users won't care.

That looks an awful lot like a cartel.

No, this is how industries work. The slaughterhouse industry body does not ask the cows for their opinion.
Post reply on HN