Live data from Hacker News

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

arstechnica.com

91–100 of 484 posts

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#91

> Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data. There is no value in this "attestation" for me as a user. I want to be able to do whatever I want with the browser (for example, remove ads or block access to canvas and webgl) and I want sites to be unable to know this. And probably this attestation will provide a…

Ehhh, it depends.

In theory one could imagine a scenario like a bank website refusing to be accessed unless the entire OS & browser stack pass attestation - as that would rule out things like keyloggers, malicious browser extensions, and session hijacking.

In practice it'll just be used to lock down content and force unskippable ads on users, of course.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#92
The proposal author (who locked the issue[0] on Github) also commented on HN and has, so far, remained silent here too: https://news.ycombinator.com/item?id=36825097

[0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#93
post #63
post #32

> Exactly how the rest of the world feels about this is not necessarily relevant, though. Google owns the world's most popular web browser, the world's largest advertising network, the world's biggest search engine, the world's most popular operating system, and some of the world's most popular websites. So really, Google can do whatever it wants. This is the point that company breakups start to make a lot of sense.…

> When Google can do something that every one of it's users hates I don't think this is remotely the case. Quite a few tech-savvy people I know (some of them software developers) use Chrome and mostly don't care about whatever Google does with it. I mention "manifest v3" and get a blank stare. I talk about advertising and ad blockers, and most people don't care, with some of them not even using ad blockers. We really…

I don't buy this. I'm sure most iphone users don't care when you ask them about privacy or manifest v3 as an abstract concept, but remember what happened when Apple tried to push a U2 album to them? They lost their collective shit. They may not write blog posts about privacy or donate to the EFF, but they have deeply personal relationships with "their" phone and they absolutely hate being reminded that it isn't really theirs.

If this weren't true, Apple could just start inserting ads into every iphone's Safari window tomorrow, and Youtube could serve the ad in the same stream as the video to defeat adblockers, and they'd make a bunch of extra money with no downside. The fact that they don't do this suggests that Apple and Google understand this: people only tolerate restricted platforms that do a convincing job of pretending to be unrestricted. In practice, this means that step 1 of Google foisting off user-hostile stuff on us is getting Firefox to include it too, which is presumably why they spend so much money on it.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#94
post #71
post #23

Earlier quoted context omitted.

This proposal only impacts "the web", which has already been going downhill for years now due to unsustainable ad-reliant business models. The internet is fine.

For the vast majority of people, the internet is the web, as well as mobile apps. The latter are already out of the control of users. Today, we at least have browsers that we can mostly force to do what we want (like stop downloading and displaying ads), but WEI will end up restricting portions of the web to users running browsers that do what the web servers want, not what their users want. And for most people in th…

The distinction is important in my opinion because it means that our technology stack isn't necessarily captured to the root by hostile interests. In these respects, a better world is possible without having to dig everything up and start over, for now.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#95
post #71
post #23

Earlier quoted context omitted.

This proposal only impacts "the web", which has already been going downhill for years now due to unsustainable ad-reliant business models. The internet is fine.

For the vast majority of people, the internet is the web, as well as mobile apps. The latter are already out of the control of users. Today, we at least have browsers that we can mostly force to do what we want (like stop downloading and displaying ads), but WEI will end up restricting portions of the web to users running browsers that do what the web servers want, not what their users want. And for most people in th…

The current browser stack is a lost cause. There's just no way for anyone who cares to compete with Google.

But we still have TCP and HTTP. We will rebuild this place.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#96
Are you using Chrome now? Hate to say it, you are part of the problem. Switch to anything else.

I'm not a super anti-Google person. I use Gmail and Google as my search engine. But Firefox is a good browser that I use as my daily driver, and Edge, Brave, Safari and the DDG browser are other options.

Switch today and start taking away Google's leverage.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#97
post #63

Earlier quoted context omitted.

> When Google can do something that every one of it's users hates I don't think this is remotely the case. Quite a few tech-savvy people I know (some of them software developers) use Chrome and mostly don't care about whatever Google does with it. I mention "manifest v3" and get a blank stare. I talk about advertising and ad blockers, and most people don't care, with some of them not even using ad blockers. We really…

I don't buy this. I'm sure most iphone users don't care when you ask them about privacy or manifest v3 as an abstract concept, but remember what happened when Apple tried to push a U2 album to them? They lost their collective shit. They may not write blog posts about privacy or donate to the EFF, but they have deeply personal relationships with "their" phone and they absolutely hate being reminded that it isn't reall…

No one I knew really cared much about the U2 album except that it was a bad album and they didn't want it in their collection. From the people I know there no one upset about the power dynamics - everyone who complained would have been 100% happy if Apple had given them an album they liked.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#98
post #91

> Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data. There is no value in this "attestation" for me as a user. I want to be able to do whatever I want with the browser (for example, remove ads or block access to canvas and webgl) and I want sites to be unable to know this. And probably this attestation will provide a…

Ehhh, it depends. In theory one could imagine a scenario like a bank website refusing to be accessed unless the entire OS & browser stack pass attestation - as that would rule out things like keyloggers, malicious browser extensions, and session hijacking. In practice it'll just be used to lock down content and force unskippable ads on users, of course.

And in practice it will eventually mean being unable to do online banking if you're on Linux. My Android phone with a custom ROM doesn't pass even a basic SafetyNet check, and this means I essentially cannot use mobile banking. For now, using a browser on my phone is a "workaround", but this proposal could change that

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#99

Earlier quoted context omitted.

It's good that it's happening strong & still semi-early-ish. I'd be curious to know how or if Chrome actually manages the PR around their work. Chrome lead fired off a blog post So you don't like a web proposal which effectively says it's purely a technical decision, and that only constructive technical criticism is regarded at all. https://news.ycombinator.com/item?id=36818409 https://blog.yoav.ws/posts/web_platform…

More importantly, a company of the size, scope and sophistication of Google trying to hide its fundamental redefinition of how people access the web, behind “it’s only a technical change” is unacceptable. As if something with multiple downstream non-technical effects, is only a technical change As if you can minimize and dismiss everyone’s fears and concerns as hollow, invalid and irrelevant by waving the magic wand…

This defies my Occam's Razor view. You seem to be assuming Google is an extremely well connected organism with vast coherency: each limb knows what the others are doing, they are working together in close fashion, & doing things for ulterior motives.

This is such a horrific & bastardly case - of creating unparalleld rank awfulness hither-to-fore unimaginable - that I am tempted to agree. And I do think there probably was some cross-pollination on this idea (which I personally would characterize as unlike the vast majority of things happening on the Chrome team).

But I still think there's a very necessary "reel it in" counter-response that has to happen here. It was me who characterized this as "only a technical change". Google is trying to shift how the web works & knows it, with this change, and that's clear, and their explainer indeed rather twists words somewhat to make it sound like it's for the user: but it is also imminently clear they seek to shift of the web works in a wide way, and they're not cloaking that behind anything or as simply technical: they're wrong & immoral & awful, but up front about what they're doing, and they're not presenting it subtly.

I linked Yoav Weiss's post with some disdain (for rebuffing), but I think a lot of these rules hold true in most circumstances, and I think even under duress many should be respected to the degree possible. But reciprocally, I've already advocated (in the HN thread) that sometimes I don't think constructive replies are appropriate or possible. When we are working to define the only open accessible shared hyper medium humanity has, there is a higher degree of engagement necessary, which also has to permit explosively deconstructive argumentation sometimes. That was my main critique: that Yoav is sheltering Chrome unjustly from the minefield of conflict he created (or more generously, let be created).

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#100
post #96

Are you using Chrome now? Hate to say it, you are part of the problem. Switch to anything else. I'm not a super anti-Google person. I use Gmail and Google as my search engine. But Firefox is a good browser that I use as my daily driver, and Edge, Brave, Safari and the DDG browser are other options. Switch today and start taking away Google's leverage.

Edge and Brave are based on Chromium. While Brave would likely block this API for a while (until too many sites require it and it would hurt their market share) they don't block most changes that Google pushes into Chrome so are still largely contributing to Google's power over the Internet.

So if you really want to disrupt Google's control over the web platform the only options are really Firefox and Safari.

Post reply on HN