[HN Gopher] Google is already pushing WEI into Chromium
       ___________________________________________________________________
        
       Google is already pushing WEI into Chromium
        
       Author : topshelf
       Score  : 1198 points
       Date   : 2023-07-26 12:05 UTC (10 hours ago)
        
 (HTM) web link (github.com)
 (TXT) w3m dump (github.com)
        
       | cmrdporcupine wrote:
       | Is adding a feature-flag really the same as pushing the feature
       | into the browser immediately? It can easily just be part of a SWE
       | needing the flag in place in order to continue work without
       | impacting anything else, even if that thing never ever launches.
       | 
       | In general Google engineers don't tend to work on branches,
       | especially long-running ones. Incremental small code reviews are
       | the expectation. The general process would be to stick things
       | securely behind flags and continue development without turning it
       | on, even if it never ever launches.
       | 
       | Not saying this work should be done -- it shouldn't -- but code
       | being pushed is not the same as "we're going to make this happen
       | tomorrow, no matter what."
        
         | knaik94 wrote:
         | Yes, because a feature flag shows intent to implement it before
         | any real discussion have taken place with privacy and non-
         | corporate security advocates.
        
         | orlp wrote:
         | > Is adding a feature-flag really the same as pushing the
         | feature into the browser immediately?
         | 
         | "Don't mind me guys, I'm barely boiling the frog."
        
         | BlargMcLarg wrote:
         | When was the last time you heard Google or anything Google-
         | related backing down from getting their paws in deeper? It's no
         | longer a fallacy when there's a sign next to the slippery
         | slope.
        
           | cmrdporcupine wrote:
           | I worked in that code base. Things were feature flagged then
           | murdered all the time.
        
           | jvolkman wrote:
           | https://killedbygoogle.com/
        
             | gmerc wrote:
             | That's backing down from responsibility not from doing the
             | wrong thing.
             | 
             | We can add www to the list.
        
         | Xelbair wrote:
         | > Is adding a feature-flag really the same as pushing the
         | feature into the browser immediately? It can easily just be
         | part of a SWE needing the flag in place in order to continue
         | work without impacting anything else, even if that thing never
         | ever launches.
         | 
         | Yes, because that's a such anti-consumer issue. It shouldn't
         | exist in the first place, it should never be merged to master.
         | There's no reason to not keep it on a separate branch if you
         | don't intend to use it.
        
           | cmrdporcupine wrote:
           | Honestly, if the work is going to be done ( _again_ it should
           | not be done), I 'd rather have it out in the open.
        
         | duerra wrote:
         | Companies don't usually make a habit of having their employees
         | work on something they don't intend to pursue.
        
           | cmrdporcupine wrote:
           | Yes, they actually do. Or rather, there is no "company",
           | there are thousands of different decision makers.
           | 
           | My point is that at some other company (e.g. Apple) it would
           | be done in secret on a branch somewhere, then big-bang merged
           | later.
           | 
           | Google's process doesn't tend to work that way.
        
           | nullindividual wrote:
           | I wish that were true in corporate America! Think of all of
           | the waste that would eliminate.
        
             | sgjohnson wrote:
             | Yeah but then you also have to think about all the jobs
             | that would be lost.
        
         | for1nner wrote:
         | [flagged]
        
           | cmrdporcupine wrote:
           | Do you or did you work at Google? Because I did, for 10
           | years.
           | 
           | And can we retire this inane content-less quip already?
           | 
           | Also I'm old enough that even my children aren't children
           | anymore. How I would _dearly_ love for your statement to be
           | true.
        
         | gmerc wrote:
         | What you think they push the flag without the intention to make
         | it happen?
        
           | cmrdporcupine wrote:
           | Because I worked at Google. People get tasked on working on
           | things that get killed later _all the time_.
           | 
           | Don't underestimate how much money they have to burn and how
           | incompetent upper management is at making hard decisions and
           | planning.
        
       | ColinHayhurst wrote:
       | Google depends on Adwords. Other revenue streams are minor in
       | comparison. Chromium is the main moat. Android too, of course.
       | ~$15 billion to Apple is another, so protecting all on mobile.
       | With the demise of AICOA, we cannot hope or expect the EU to
       | deliver. In a sense it's simple; folks have to stop using Google
       | search in order to preserve the web, and support those who are
       | trying to preserve it. But I would say that. We are doing what we
       | can.
        
         | jonnycomputer wrote:
         | Break it up. Break them all up. We need more disruption, not
         | this codswallop.
        
       | twleo wrote:
       | That's why we should isolate Chromium from Google. Chromium
       | should be lead by third-party like W3C.
        
       | 4oo4 wrote:
       | Don't just comment and complain, contact your antitrust authority
       | today:
       | 
       | US:
       | 
       | - https://www.ftc.gov/enforcement/report-antitrust-violation
       | 
       | - antitrust@ftc.gov
       | 
       | EU:
       | 
       | - https://competition-policy.ec.europa.eu/antitrust/contact_en
       | 
       | - comp-greffe-antitrust@ec.europa.eu
       | 
       | UK:
       | 
       | - https://www.gov.uk/guidance/tell-the-cma-about-a-competition...
       | 
       | - general.enquiries@cma.gov.uk
       | 
       | India:
       | 
       | - https://www.cci.gov.in/antitrust/
       | 
       | - https://www.cci.gov.in/filing/atd
        
         | varispeed wrote:
         | I admire your optimism. Don't know about the others, but I'll
         | be surprised if UK one would lift a finger. They are beyond
         | useless.
        
           | 4oo4 wrote:
           | I'm not extremely optimistic either but at least in the US
           | Lina Kahn is already on the right track with antitrust and
           | the FTC already has two antitrust cases against Google in
           | process. However, it's still an uphill because antitrust
           | enforcement was either asleep at the wheel (or corrupted,
           | depending on your perspective), which is partially why Google
           | is in such a dominant position to begin with.
           | 
           | IANAL, the EU is also on the right track with antitrust but
           | unfortunately seems very weak in terms of penalties and
           | enforcement.
           | 
           | At this point, anything we can do to slow them down in any
           | jurisdiction in a win. Even if antitrust enforcement is weak
           | making Google at least have to defend this in a pro-forma way
           | I think helps.
        
         | hooverd wrote:
         | A customizable form letter would be nice to have, if anyone
         | wants to jump on that. I'm not a great writer in that respect.
        
           | 4oo4 wrote:
           | This is what I sent, feel free to use and customize:
           | I would like to bring your attention to Google's recent
           | proposal to add a feature to its Chrome (Chromium family) of
           | browsers called Web Environment Integrity. This provides a
           | mechanism to reinforce Google's already dominant browser
           | market position by creating a technological control that can
           | be used to nullify a user's choice of browser, device and
           | operating system. This technology also has the potential for
           | abuse by preventing users from using browser extensions that
           | can enhance security by blocking unwanted and potentially
           | malicious content, as well as browser extensions that help
           | vulnerable users with enhanced accessibility needs, such as
           | color blindness and visual impairment.              Google's
           | dominant, near-monopoly position in the browser market
           | already harms me as a consumer by reducing browser choices
           | and preventing a competitive market for developing new
           | browsers. Allowing Google to include this feature will reduce
           | my browser choices and consolidate the browser market even
           | further, and it is incumbent on [INSERT AUTHORITY HERE] to
           | take action against this abusive behavior.
        
             | liendolucas wrote:
             | Should I submit my complaint right away or only after this
             | disease starts spreading out without control? I'm in the
             | EU.
        
           | burkaman wrote:
           | My email:
           | 
           | Google has proposed a new Web Environment Integrity standard,
           | outlined here: https://github.com/RupertBenWiser/Web-
           | Environment-Integrity/....
           | 
           | This standard would allow Google applications to block users
           | who are not using Google products like Chrome or Android, and
           | encourages other web developers to do the same, with the goal
           | of eliminating ad blockers and competing web browsers.
           | 
           | Google has already begun implementing this in their browser
           | here: https://github.com/chromium/chromium/commit/6f47a22906b
           | 28994....
           | 
           | Basic facts:
           | 
           | 1. Google is a developer of popular websites such as
           | google.com and youtube.com (currently the two most popular
           | websites in the world according to SimilarWeb)
           | 
           | 2. Google is the developer of the most popular browser in the
           | world, Chrome, with around 65% of market share. Most other
           | popular browsers are based on Chromium, also developed
           | primarily by Google.
           | 
           | 3. Google is the developer of the most popular mobile
           | operating system in the world, Android, with around 70% of
           | market share.
           | 
           | Currently, Google's websites can be viewed on any web-
           | standards-compliant browser on a device made by any
           | manufacturer. This WEI proposal would allow Google websites
           | to reject users that are not running a Google-approved
           | browser on a Google-approved device. For example, Google
           | could require that Youtube or Google Search can only be
           | viewed using an official Android app or the Chrome browser,
           | thereby noncompetitively locking consumers into using Google
           | products while providing no benefit to those consumers.
           | 
           | Google is also primarily an ad company, with the majority of
           | its revenue coming from ads. Google's business model is
           | challenged by browsers that do not show ads the way Google
           | intends. This proposal would encourage any web developer
           | using Google's ad services to reject users that are not
           | running a verified Google-approved version of Chrome, to
           | ensure ads are viewed the way the advertiser wishes. This is
           | not a hypothetical hidden agenda, it is explicitly stated in
           | the proposal:
           | 
           | "Users like visiting websites that are expensive to create
           | and maintain, but they often want or need to do it without
           | paying directly. These websites fund themselves with ads, but
           | the advertisers can only afford to pay for humans to see the
           | ads, rather than robots. This creates a need for human users
           | to prove to websites that they're human, sometimes through
           | tasks like challenges or logins."
           | 
           | The proposed solution here is to allow web developers to
           | reject any user that cannot prove they have viewed Google-
           | served ads with their own human eyes.
           | 
           | It is essential to combat this proposal now, while it is
           | still in an early stage. Once this is rolled out into Chrome
           | and deployed around the world, it will be extremely difficult
           | to rollback. It may be impossible to prevent this proposal if
           | Google is allowed to continue owning the entire stack of
           | website, browser, operating system, and hardware.
           | 
           | Thank you for your consideration of this important issue.
        
             | araknafobia wrote:
             | Thanks for sharing! I just sent to https://competition-
             | policy.ec.europa.eu/antitrust/contact_en
        
         | DanHulton wrote:
         | Canada: - https://www.competitionbureau.gc.ca/eic/site/cb-
         | bc.nsf/frm-e...
        
         | ethanjstark wrote:
         | Thank you so much for your call to action; just emailed
         | antitrust@ftc.gov.
         | 
         | For any experiencing barriers for writing the email, my method
         | is below; Bing Chat generated an excellent email that only
         | needed a bit of editing.
         | 
         | 1. Open https://vivaldi.com/blog/googles-new-dangerous-web-
         | environme... page in (ugh) Edge.
         | 
         | 2. Open Bing Chat sidebar (top right corner); it auto-
         | summarizes the article.
         | 
         | 3: My prompt: Using the that webpage summary, please write a
         | letter reporting Alphabet for antitrust violation. Please
         | include the following [this language is from the ftc.gov site]:
         | 
         | Q: What companies or organizations are engaging in conduct you
         | believe violates the antitrust laws? A: Alphabet
         | 
         | Q: Why do you believe this conduct may have harmed competition
         | in violation of the antitrust laws? A: [use the article]
         | 
         | Q:What is your role in the situation? A: I'm a user of the
         | Firefox browser
         | 
         | [edit: line breaks for readability]
        
         | burkaman wrote:
         | Thanks, just emailed the FTC. It was a bit cathartic and now I
         | don't have to be angry about this for the rest of the day, I'd
         | encourage everyone else to do the same.
        
         | bfelbo wrote:
         | I think https://competition-
         | policy.ec.europa.eu/antitrust/procedures... would be better for
         | contacting EU antitrust.
         | 
         | Here you can specifically create new antitrust complaints.
        
       | PhilipRoman wrote:
       | One thing about this that I don't understand is how they intend
       | to validate memory without controlling the entire stack (which we
       | aren't even 1% close to achieving on the desktop). If I poke
       | /dev/mem, does that mean Chrome will have to validate every
       | single byte of it's ram? Or does it rely on having a fully locked
       | down environment (maybe feasible on phones).
        
         | TillE wrote:
         | Even on Windows, you can do practically anything with a signed
         | driver.
         | 
         | There's just no such thing as verifying a "secure environment"
         | outside of extremely narrow, controlled scenarios.
        
       | coding123 wrote:
       | Remember when everyone and their brother helped everyone and
       | their mother get on Chrome about meh, maybe 15 years ago?
       | 
       | Time to get everyone and their brother help everyone and their
       | mother get on Firefox.
        
       | topshelf wrote:
       | Disappointing to see such a 180 on 'don't be evil'.
       | 
       | I'm recommending Mozilla Firefox to all friends and family.
        
         | maxloh wrote:
         | Unfortunately Firefox doesn't have a good UI/UX after all.
         | 
         | The last time I checked, multiple profiles support is somehow
         | half-baked.
        
           | realharo wrote:
           | Firefox is also missing a _don 't allow any website to play
           | audio unless explicitly enabled_ setting (mute tabs by
           | default, except on allowed sites), as far as I can tell.
        
             | bartvk wrote:
             | I think it has?
             | 
             | Go to Settings, and search for Autoplay (or in the left
             | navigation, select Privacy and Security and scroll to
             | Permissions).
             | 
             | Click the Settings button next to Autoplay, and set the
             | default to whatever you like (amongst them "Block Audio").
        
               | realharo wrote:
               | That's not the same thing. Chrome's setting can force
               | audio to be muted regardless of user interactions or
               | manually started playback, until the website settings are
               | changed to allow sound.
        
           | mozball wrote:
           | Multiple profiles is fully supported. It's just hidden behind
           | a clunky UX.
           | 
           | Also check out firefox containers which is to profiles what
           | docker is to virtual machines.
        
             | luuurker wrote:
             | Containers are useful, but it's like having a few similar
             | terminal windows open. Eventually you'll type something on
             | the wrong window... at least I found myself searching for
             | personal stuff on my work Google container.
             | 
             | With profiles I can have different bookmarks, extensions,
             | and even a different theme so I'm aware I'm on my personal
             | profile, not on a work profile. Since switching profiles on
             | Firefox + macOS is a pain in the butt, I use 2 different
             | Firefox channels (stable + dev).
             | 
             | Anyway, containers are nice, but they're not a replacement
             | for profiles.
        
               | wsgeorge wrote:
               | > Anyway, containers are nice, but they're not a
               | replacement for profiles.
               | 
               | This, so much. Anytime I've brought up profiles on
               | Firefox, I'm told about this alternative that isn't a
               | replacement for the feature.
               | 
               | Safari is (finally) bringing this, so maybe the folks at
               | FF will begin to see this as a feature worth investing
               | in. First-class profiles support is one of the main
               | reasons I stick to Chrome, despite trying to switch.
        
             | wsgeorge wrote:
             | > It's just hidden behind a clunky UX.
             | 
             | That's part of the "problem" with Firefox's support of
             | profiles. It feels more like an afterthought and less like
             | a primary use case the product wants to surface. To
             | approximate the functionality Chrome has, I had to bookmark
             | "about:profiles" and make it my home page.
             | 
             | Chrome also added this nifty feature that lets you open
             | links as a Profile, making it easy to switch.
             | 
             | These may seem like small issues, but the end up mattering.
        
             | SoftTalker wrote:
             | Yeah, AFAIK to setup profiles you have to run:
             | firefox --ProfileManager
             | 
             | And then to use them you have to start firefox e.g. :
             | firefox -P <profile-name>
             | 
             | Very few casual users (nor even most technical users) start
             | Firefox from a command line, and setting up shortcuts for
             | these is also a step that most users won't do.
             | 
             | The support for profiles is there, it's just hard to use in
             | the context of a GUI desktop.
        
               | justcool393 wrote:
               | can't you just go to about:profiles?
        
               | SoftTalker wrote:
               | Wow. I never knew. Thanks!
        
           | wsgeorge wrote:
           | Not sure why you're getting downvoted, but this is a big deal
           | IMO. We're here because Chrome has been the better product
           | for a long time. Firefox not doing things people want well
           | enough will hurt its adoption, which will impact its capacity
           | to influence the Web.
           | 
           | Add to Mozilla's perceived not-very-good management and you
           | have a death spiral on your hands, and more power to Google
           | and Apple to shape the Web towards their interests.
           | 
           | FWIW, first-class profiles support matters a lot:
           | https://medium.com/sort-of-like-a-tech-diary/profiles-the-
           | on...
        
             | pndy wrote:
             | Mozilla in the past ignored the criticism users had
             | regarding UI/UX changes and went with deploying this bulky
             | mobile-oriented interface for desktops. And here we are.
             | 
             | This itself is one issue; there are also all sorts of
             | adventures they decide to go for little to not at all
             | related to the browser development, and which are conducted
             | to convince people all around the world that they're a good
             | humane corporation that _cares_. Igh.
        
         | slowmovintarget wrote:
         | I was just able to finally move my wife back to Firefox. Chrome
         | just stopped working on her Mac. Wouldn't pull up a page.
         | Everything else worked.
         | 
         | She's now happily using Firefox with a non-hobbled version of
         | uBlock Origin.
        
           | smolyeet wrote:
           | I don't think this indicative of chrome being bad on Mac.
           | What did you try to resolve the issue?
           | 
           | Because I could say chrome always works for me (which would
           | be true in my experience), but that doesn't mean it always
           | does.
        
         | fps_doug wrote:
         | I do, and I keep having those tiring conversations, but it's
         | really hard to get the point across in layman's terms. I have
         | enough friends in tech who stick with Chrome out of convenience
         | instead of just falling back on it in case something actually
         | doesn't work in Firefox. how do I convince tech illiterate
         | people of doing this?
        
           | erklik wrote:
           | It's faster. The same old justification that was used to
           | switch to Chrome can now be used for Firefox.
        
           | jckahn wrote:
           | You can't, realistically. I don't think there's any
           | repeatable or effective way to make non-nerds (AKA most
           | people) care about this sort of thing.
        
           | Buttons840 wrote:
           | Start referring to them as "Chrome developers" -- what's this
           | "web" thing you keep talking about?
        
           | hummingly wrote:
           | Whenever a new device needs to be setup for my parents, I
           | just install whatever I use (Firefox in this case). Then I
           | show them the things they need on a day by day basis. The
           | problem are people who did grow up with tech. They will say
           | things like it will take too long. In cases like this you
           | need to manipulate them based on their personality.
        
           | AdamN wrote:
           | For the tech illiterate recommend Safari. For tech people,
           | appeal to their privileged position and the importance of
           | defending the web by choosing any other browser (or Safari).
           | 
           | Both users can keep Chrome installed as a fallback - that
           | will help with convincing too.
        
             | freedomben wrote:
             | Didn't Apple implement this same type of thing in Safari a
             | year or so ago?
        
             | suslik wrote:
             | And drop my Ublock origin, bypass paywall clean, etc? Hell
             | no.
        
               | timeon wrote:
               | > Ublock origin
               | 
               | At least there is Adguard.
        
             | JohnFen wrote:
             | > For the tech illiterate recommend Safari.
             | 
             | That's only applicable to Apple users, though.
        
         | baybal2 wrote:
         | [dead]
        
       | Havoc wrote:
       | And yet people keep saying it's an independent project that is
       | definitely not google controlled.
        
       | A37N wrote:
       | Can't we make a intranet of our own? yes im being stupid right
       | now but i dont want wei or anything like that, if we power users
       | can create something like the internet where there are multiple
       | websites and stuff like it was in the old days i don't know what
       | im talking clearly but i think y'all understand me
        
       | philipwhiuk wrote:
       | It's notable that the proposal was put on a personal GitHub
       | rather than a Google corporate GitHub. Someone is trying to avoid
       | Google's obvious presence being too visible and throw their
       | engineer under the bus instead.
       | 
       | For shame.
        
       | varelse wrote:
       | [dead]
        
       | Pannoniae wrote:
       | This proposal is just so throughly user-hostile that it's
       | impossible to criticise it based on technical grounds. It's not a
       | bad proposal, it's a dangerous, evil and malicious one, so
       | criticising it in details is futile. The whole thing in itself is
       | evil, and it needs to be thrown out. Quietly protesting won't
       | work this time, the goal is to kick up a huge fuss which gets the
       | attention of governments, regulatory bodies and start antitrust
       | proceedings.
       | 
       | Excuse my french but Google can fuck off with their censorship
       | and "reminder to be civil". They have truly gone mask off, with
       | the Code of Conducts not reinforcing good practice and a
       | welcoming environment, but just a tool used to suppress dissent.
       | 
       | I've switched to Firefox and I'd recommend everyone else to do
       | so.
        
         | hanniabu wrote:
         | As someone that isn't up-to-date on WEI, can someone provide a
         | TLDR of what it does and why it's bad?
        
           | hightrix wrote:
           | TL;DR: It is DRM for the web where Google (or others) can
           | only allow specific OS/Browser combination to access a
           | website.
           | 
           | If you want to know more, others have written novels in these
           | comments.
        
           | stronglikedan wrote:
           | Not exactly a nutshell, but here's an explainer:
           | 
           | https://github.com/RupertBenWiser/Web-Environment-
           | Integrity/...
           | 
           | And here's why it _may_ be bad:
           | 
           | https://vivaldi.com/blog/googles-new-dangerous-web-
           | environme...
           | 
           | And the HN discussion on the latter:
           | 
           | https://news.ycombinator.com/item?id=36875940
        
         | TheCoelacanth wrote:
         | > The whole thing in itself is evil, and it needs to be thrown
         | out.
         | 
         | Not only the proposal, but Google itself. Google desperately
         | needs to be broken up.
        
         | tristor wrote:
         | > This proposal is just so throughly user-hostile that it's
         | impossible to criticise it based on technical grounds. It's not
         | a bad proposal, it's a dangerous, evil and malicious one, so
         | criticising it in details is futile.
         | 
         | I can't agree more strongly. I sat down to write a letter to
         | the FTC, and I can't even articulate my objections because
         | after reading this spec my only response is encompassed in "WTF
         | is this shit?". I've worked in my past with members of the
         | Chromium team and I've generally found them competent and well-
         | meaning, and I can't see any amount of well-meaning (and some
         | lack of competence) in this spec proposal. This feels like a
         | shift in the behavior for Google far beyond their existing slow
         | drive to consume everything, to something far more draconian
         | and direct.
        
         | strix_varius wrote:
         | Agreed - if anyone else is curious to see Google's "side"
         | (motivations, technical or otherwise), here's the explainer:
         | 
         | https://github.com/RupertBenWiser/Web-Environment-Integrity/...
         | 
         | It's nakedly user-hostile. A blatant attempt to invert the
         | "user agent" relationship such that the agent works for the
         | advertiser/corporation/government to spy on the human behind
         | the screen. The way the intro paragraph tries to disguise this
         | as something users need or want is frankly disgusting:
         | 
         | > Users often depend on websites trusting the client
         | environment they run in. This trust may assume that the client
         | environment is honest about certain aspects of itself, keeps
         | user data and intellectual property secure, and is transparent
         | about whether or not a human is using it. _This trust is the
         | backbone of the open internet, critical for the safety of user
         | data and for the sustainability of the website's business._
         | 
         | Ugh. Here's a fixed, honest version:
         | 
         | Corporations like Google often depend on advertisers knowing as
         | much as possible about their users. Their revenue may depend on
         | fingerprinting the client environment, tracking their behavior
         | and history, and attesting that a human with sufficient
         | disposable income is behind the keyboard. This personal data
         | mining is the backbone of Google's business model, critical for
         | their continued dominance of the web and for the sustainability
         | of their enormous margins.
        
         | pptr wrote:
         | How is this feature hostile to Googles users? There is genuine
         | benefit from websites allowing you to do more things via their
         | website (vs their app). Also: fewer/no Captchas, fewer bots on
         | social media
         | 
         | The platforms most people use will see benefits. Apple users
         | apparently already do.
         | 
         | I understand the argument that the open source experience will
         | get worse. But frankly, google.com will still work for you. It
         | will be other websites that make your experience worse.
        
       | wasmy wrote:
       | Another tame article in The Register:
       | 
       | https://www.theregister.com/2023/07/25/google_web_environmen...
       | 
       |  _Despite the spec 's half-baked state, the blowback last week
       | was swift - in the form of a flood of largely critical comments
       | posted to the WEI GitHub repository, and abuse directed at the
       | authors of the proposal. The Google devs' response was to limit
       | comment posting to those who had previously contributed to the
       | repo and to post a Code of Conduct document as a reminder to be
       | civil._
       | 
       | The usual way to deal with opposition these days.
        
         | user3939382 wrote:
         | If you want to protest the knife we're driving into your
         | stomach, you can do so, but we need to see credentials and
         | civility.
        
           | JohnFen wrote:
           | And limit your protesting to technical critiques about how
           | the knife is made, not whether it should be in your stomach.
        
         | ben_w wrote:
         | Limiting posting and asking for civility is the _only_ way for
         | individuals to meaningfully engage with even a mere thousand
         | others. Nothing about the human mind was meant for social
         | internet at the scale of the internet, where there are more
         | distinct voices than you have heartbeats in a lifetime.
        
           | ynniv wrote:
           | Yes, and the response should be to make the repo private.
           | Only allowing interactions from previous contributors to a
           | public repo is disingenuous.
        
             | ben_w wrote:
             | My expectation is that private is worse for any public
             | involvement in any discussion because nobody else can see
             | it, and also likely to get them yelled at more via other
             | channels, and also lead to the assumption that they "have
             | something to hide".
        
           | notpachet wrote:
           | > more distinct voices than you have heartbeats in a lifetime
           | 
           | Quotable!
        
         | btown wrote:
         | Also worth noting that this locks reactions (thumbs up, hearts,
         | etc.) - providing plausible deniability that "only a small
         | number of people raised concerns about specificTopicX."
         | Journalists should be more aware of this!
         | 
         | On a separate note, for journalists and others who wish to
         | communicate with the spec's author directly, his public website
         | (which lists a personal email) is one of the other repos on the
         | Github profile under which the specification was published.
         | It's painfully absurd that he wrote this sentence in 2022 [0]:
         | 
         | > I decided to make this an app in the end. This is where my
         | costs started wracking up. I had to pay for a second hand
         | macbook pro to build an iOS app. Apple's strategy with this is
         | obvious, and it clearly works, but it still greatly upsets me
         | that I couldn't just build an app with my linux laptop. If I
         | want the app to persist for longer than a month, and to make it
         | easy for friends to install, I had to pay $99 for a developer
         | account. Come on Apple, I know you want people to use the app
         | story but this is just a little cruel. I basically have to pay
         | $99 a year now just to keep using my little app.
         | 
         | [0] https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-
         | my-...
        
         | prox wrote:
         | "Please be civil while we destroy the web as we know it. We
         | also put earplugs in, just in case."
        
       | pabs3 wrote:
       | I wonder if any web servers or web apps have started to block
       | Chrome users yet.
        
         | nfw2 wrote:
         | No serious business is going to block the majority of their
         | traffic
        
       | pcdoodle wrote:
       | Alright folks, time to cancel that Youtube Premium, Google
       | Domain, Google Compute Engine, Ad campaign, PPC, Etc.
       | 
       | My business is off any paid Google crap.
       | 
       | I will never prepare a computer without uBlock Orgin for any
       | customer of colleague.
        
       | lolinder wrote:
       | As wonderful as it has been to have a platform that the entire
       | world is on at once, I'm beginning to conclude that the only way
       | to get back to the web as we knew it is to go back to the days
       | when only a small, geeky subset of the population spent time on
       | here. Back then it wasn't worth it to create massive amounts of
       | garbage content in order to serve ads to unwary search engine
       | users--there weren't enough of us to make money off of!
       | 
       | I think it's time to establish a successor to the web that we can
       | once again call home. This doesn't mean we need to give up on the
       | web or stop using it--it can run in parallel to the mainstream, a
       | niche home for hackers and techies and people who care about
       | freedom. It needs to be simple, like Gemini [0], but also have
       | enough interactive features to enable old-school social apps like
       | HN or the old Reddit. It should have a spec and a governance
       | process that discourages rapid changes--we've learned from hard
       | experience that more features does not mean better.
       | 
       | I realize this sounds like a cop out, and that getting people to
       | use such a thing in sufficient numbers would be extremely
       | difficult. But I'm pretty convinced at this point that the web as
       | we knew it will never come back unless there's a reset--unless we
       | create a new niche tech that isn't big enough for corporations to
       | want to take over.
       | 
       | [0] https://gemini.circumlunar.space/
        
         | nehal3m wrote:
         | >I realize this sounds like a cop out, and that getting people
         | to use such a thing in sufficient numbers would be extremely
         | difficult.
         | 
         | In the last few days browsing Fediverse platforms I prefer the
         | smaller communities for that old internet spirit anyway.
        
       | [deleted]
        
       | itissid wrote:
       | I am a bit confused. This sounds a bit stupid. If this is DRM for
       | web content, then what would non chrome browsers like FF for web
       | pages that ask for such authentication? Refusing to work with
       | other browsers than chrome seems like a lawsuit waiting to
       | happen.
       | 
       | [1]https://arstechnica.com/gadgets/2023/07/googles-web-
       | integrit...
        
       | codedokode wrote:
       | What you can do:
       | 
       | - stop using Chrome
       | 
       | - do not implement web DRM on your personal site
       | 
       | - do not use providers like Cloudflare if they will support web
       | DRM
       | 
       | - maybe add a warning on your personal site for Chrome users
       | 
       | Maybe something else?
        
         | goku12 wrote:
         | One problem I find is that all that we do is in a bubble. I can
         | convince a dozen like-minded people about the dangers and
         | actions to take. However, the vast majority of the population
         | is completely oblivious to all this and are negligently
         | complicit in enabling bad behavior. This sort of things need to
         | be discussed on the streets and in mainstream media (not tech
         | media) for regular people to become aware. Remember that during
         | the previous browser wars (IE vs Netscape), it was much more in
         | the open and a lot more people knew.
        
           | baal80spam wrote:
           | I'd go even further and say that vast majority of population
           | equates google with "the internet".
           | 
           | "IT people" live in a bubble and HN crowd even more so. There
           | is nothing to stop this.
        
       | rolph wrote:
       | https://www.ftc.gov/about-ftc/contact
        
       | washadjeffmad wrote:
       | I vote that this happens, but happens completely, definitely, and
       | thoroughly to its logical conclusion.
       | 
       | If you want a penny from Google adtech, you're subject to their
       | stringently filtered portal, you're inaccessible from non-WEI
       | enabled browsing, and circumventing WEI policies gets you
       | demonetized. It'll be the Great Firewall of Adtech, gated access
       | via an app to a filtered corporate paradise - a bit like Facebook
       | tried in India, unsuccessfully.
       | 
       | If you want to be part of the free, non-commercial web, WEI
       | doesn't apply, access is open. You are able to be indexed as
       | such. The healing can begin.
       | 
       | This will provide a true choice: commercial xor non-commercial.
       | Confine all the SEO garbage to ghettos that think they're
       | kibbutzim, forcing the big commercial entities to either fight
       | over the noise or exert their influence, and leaving the rest of
       | us out.
        
       | esafak wrote:
       | WEI stands for Web Environment Integrity:
       | 
       | https://en.wikipedia.org/wiki/Web_Environment_Integrity
        
       | KingOfCoders wrote:
       | I wonder how many of the 210 comments were written in Chrome.
        
       | anshumankmr wrote:
       | As someone who is a somewhat new to web technologies, can someone
       | really explain why this is bad? I saw the techical discussions in
       | the PRs made to the WEI repo but it was all super technical that
       | I was not able to understand the arguments made for and against
       | it.
        
         | thurn wrote:
         | Like any technology, there are both positive and negative
         | aspects of it. The positive take would probably be that this
         | technology is already widely used by iOS and Android apps.
         | People use Apple's AppAttest to e.g. ensure that high scores
         | submitted for a game are from a legitimate copy of the game and
         | not just someone calling the SubmitHighScore API.
         | 
         | But it's absolutely fair to argue that the web operates on a
         | different set of expectations than the Play Store/App Store,
         | and I think the concerns that this will create a second-class
         | citizen status for browsers are totally valid. There's a _huge_
         | difference in character between  "in order to prevent piracy
         | and ensure ad revenue we are only releasing our app on the Play
         | Store" and "we are only releasing our web app for Chrome".
        
           | jimkoen wrote:
           | > People use Apple's AppAttest to e.g. ensure that high
           | scores submitted for a game are from a legitimate copy of the
           | game and not just someone calling the SubmitHighScore API.
           | 
           | But that's for Apps. Native Apps, not websites. If we argue
           | this way, then this becomes a solution seeking an issue,
           | since the first thing you learn in web programming is to
           | never trust the client. I don't even see how this changes
           | here, given that it won't mitigate any bugs, except giving me
           | proof that the only bugs present on the client side system
           | are the ones written by me.
           | 
           | The reason Google actually want's to implement this, is
           | because they risk loosing huge amounts of revenue due to
           | adblocking, something they can control on mobile (since they
           | control the software supply chain there) but cannot do in the
           | browser (since I have access to the DOM).
        
         | peter422 wrote:
         | It's like having the "I'm not a robot" button embedded in your
         | web browser.
        
         | mplewis wrote:
         | WEI turns non-compliant browsers into second-class citizens.
         | You're perfectly free to use whatever compliant browser engine
         | and OS combo you like today - but in a world with WEI, you'll
         | have to use Approved Chrome on an Approved OS on Approved
         | Hardware with Approved Signing Keys, or you won't be able to
         | sign into your bank.
        
           | anshumankmr wrote:
           | Approved Signing Keys -> Will this require for the end user
           | to do it? If so, then this might be a short lived change,
           | cause for a lot of people having a username and password is
           | already super complicated.
        
             | mordae wrote:
             | Nothing special. Just use preinstalled system and don't
             | even think about using anything else.
        
           | minsc_and_boo wrote:
           | Is there any way around this, like spoofing headers or OS
           | specs?
        
             | burkaman wrote:
             | No, Google has plenty of skilled engineers that can make
             | spoofing an attestation extremely difficult. It will
             | probably rely on hardware that you cannot modify. See
             | details of a plausible implementation here:
             | https://news.ycombinator.com/item?id=36859465
        
           | netdur wrote:
           | isn't this good? banks can raise security while we can still
           | use any browser to check hackers news! or this 3 cows story?
        
             | helen___keller wrote:
             | This is good as a user story if you are using a blessed
             | OS/browser/device in that you can avoid CAPTCHA or whatever
             | 
             | This is bad as a user story if you are not blessed and get
             | likely locked out because the web operator doesn't
             | recognize you as valid
             | 
             | This is worse in the second order effects in that it can be
             | leveraged to fight against ad blockers, paywall bypassers,
             | YouTube video downloaders, and so on, by forcing all those
             | user-friendly software under the umbrella of being
             | unblessed. Hence the moniker of "web DRM"
        
             | ulkesh wrote:
             | No, it isn't good.
             | 
             | Despite what some on the political spectrum try to say, the
             | Internet has become a basic human right. It is required in
             | schools in America. In many cases, it is required to even
             | interact with certain government entities. Allowing
             | governments and corporations to force users to a specific
             | browser on a specific operating system just to interact
             | with their site goes against everything the web is supposed
             | to be -- an open platform for the free exchange of ideas.
             | 
             | This proposal is a slap in the face to all of that and
             | basically allows governments and corporations to force
             | users to use what those governments and corporations
             | choose.
             | 
             | This is net neutrality all over again, just in a different
             | vein.
             | 
             | I, for one, will continue supporting Mozilla and Firefox
             | and will never again use Chromium-based browsers, or any
             | browser which supports this. I just hope I can keep
             | browsing the sites I need to.
        
             | bryanrasmussen wrote:
             | one example of a non-compliant browser would be something
             | crawling the web and building up some sort of search index
             | of things because I don't think we want anyone to be
             | allowed to do that.
        
             | yborg wrote:
             | In what way does this increase the security of my bank
             | account? A criminal can use credentials it obtained via a
             | hack, etc. using an approved platform to access my account.
             | My own approved platform can be compromised by malware and
             | used to access my account. This class of problems is
             | addressed by physical ID tokens, not attestation.
        
               | mordae wrote:
               | Corporate world currently sells attestation as a way to
               | create secure token out of everyone's phone to the public
               | sector worldwide. They obviously want it for the walled
               | gardens and to fight ad-blocking, but public sector
               | really wants to "deal with the cyber criminality" and
               | they are clueless.
        
               | kccqzy wrote:
               | Presumably a criminal now no longer can install a piece
               | of malware that looks into the memory of your browser to
               | steal credentials in the first place.
               | 
               | They will now have to use old fashioned social
               | engineering to make you cough up that credential to
               | steal.
        
             | thesuperbigfrog wrote:
             | >> isn't this good? banks can raise security while we can
             | still use any browser to check hackers news!
             | 
             | Are you okay with buying a new computer running the
             | operating system and browser someone else wants to access
             | your bank's web site?
             | 
             | You can still use you current computer and bowser to access
             | HN.
        
               | icoder wrote:
               | Like many others in this thread you stack so many
               | assumptions on top of each other. Why? I don't think that
               | helps.
               | 
               | Will this person's bank implement WEI in such a way that
               | none of this person's devices (computer, phone) are
               | supported and will this person not be willing or able to
               | switch banks, only then buying a new computer comes into
               | view. Without knowing anything about this person,
               | assuming average, the chances for this must be low or the
               | bank will have no happy customers left.
               | 
               | I fully agree with the underlying worries you and others
               | in this thread have, but to extrapolate that without any
               | nuance into a world where we all become privacy-less, ad
               | consuming, eye tracked zombies on newly bought computers
               | is not helping the case (in my view).
        
               | mordae wrote:
               | I have talked to government officials responsible for my
               | country's digital security policy and they have
               | explicitly told me that they want remote attestation to
               | lock out devices not running big corporate systems and
               | they do not care about freedom. The same ministry is
               | responsible for police. If they could, they would forbid
               | you doing anything that is not explicitly legal just to
               | be safe.
        
               | nulld3v wrote:
               | > Will this person's bank implement WEI in such a way
               | that none of this person's devices (computer, phone) are
               | supported and will this person not be willing or able to
               | switch banks, only then buying a new computer comes into
               | view.
               | 
               | Yes, they will, because it has already happened.
               | 
               | On Android many many banking apps block rooted phones and
               | custom OSes by using Play Integrity and Safetynet. And
               | then games started doing it too, you can't play Pokemon
               | GO unless your phone's OS passes Safetynet. And then
               | restaurants joined in. Sorry, you can't order from
               | McDonald's unless you pass Safetynet.
               | 
               | When does it stop?
        
               | mindslight wrote:
               | It's called looking ahead to the straightforward results
               | of the obvious power dynamic, to know what it will lead
               | to when that dynamic gets entrenched enough to be taken
               | for granted.
               | 
               | It's like how all these "free" websites coasted along for
               | years being quite user friendly, but have recently
               | switched to extraction mode. Anybody who thought about
               | the incentives knew what was coming down the line
               | eventually.
        
               | im3w1l wrote:
               | I already today have a phone dedicated to "important
               | stuff" like accessing banks. I think it's actually a
               | decent solution, and a low-end phone doesnt cost that
               | much either.
        
             | loeg wrote:
             | Not great if your bank arbitrarily decides Linux isn't a
             | supported operating system, for example.
        
               | YPCrumble wrote:
               | Wouldn't this just mean I should change my bank?
        
               | anshumankmr wrote:
               | That would be difficult to do, if say all banks decide to
               | only support Windows/MacOs. My bank that I use is a bit
               | wonky on Firefox but works fine on Chrome. Some banks
               | even refuse to run on Firefox. Also, switching banks
               | might be more difficult than switching an OS. And you
               | would lose the reward points if any if you switch a bank,
               | not to mention, if you use autopay that is configured to
               | withdraw from a certain card, you would need to go and
               | reconfigure that everywhere.
               | 
               | It is not technically impossible, it's just going to
               | arduous.
        
               | imadj wrote:
               | Are you going to make your own bank too when enough banks
               | do it?
        
               | loeg wrote:
               | I just believe that imposing this cost and inconvenience
               | on Linux users (in this example) would be a bad thing.
        
               | hellojesus wrote:
               | Or ultimately fund your own if all banks adopt this under
               | a regulatory recommendation.
        
               | plagiarist wrote:
               | Does that seem easier for people to do than buying a
               | Windows or MacOS device? If your oldest credit cards are
               | through your bank it could wreck your FICO for quite a
               | while.
        
               | OfSanguineFire wrote:
               | There are already countries where all banks in the
               | country (and often it is a mere handful; not everywhere
               | is like the USA with a big choice of banks) already
               | require e.g. using their app on an Android version that
               | passes SafetyNet, in order to log in to online banking.
        
             | XzAeRosho wrote:
             | The problem is that this feature can and will be used to
             | restrict the users, it doesn't offer any real benefit to
             | you.
             | 
             | This will not increase security for the user either, it's
             | just a new barrier at the risk of higher fingerprinting.
             | Why should you care how your bank handles security? It's
             | their responsibility, not yours to handle.
        
               | nfw2 wrote:
               | Because they have my money?
        
               | nehal3m wrote:
               | Technically they don't. They incur a debt to you when you
               | give them your money. The money at the bank is not your
               | money.
        
               | nfw2 wrote:
               | Fine then because they owe me money
        
               | mordae wrote:
               | OK, then legislate that this shit can only ever be opt-in
               | and then we can talk.
        
         | javajosh wrote:
         | It's a change to the browser that gives site-owners the ability
         | to require a positive attestation of non-modification before
         | running. The stated goal of this change is to make it more
         | difficult for end-users to block ads. As the spec states,
         | blocking ads violates the deal you make with content creators
         | to use your attention to ads as a form of payment.
         | 
         | In practice, this will make it harder, but not impossible, to
         | run ad blockers. Now instead of just finding and installing a
         | plugin, you'll have to first find and install a forked browser
         | that implements the attestation as something like 'return
         | true'. This will predictably decrease the number of people
         | blocking ads.
         | 
         | Personally, I don't object to this. The easy solution for most
         | people is simply: don't consume the content. Or pay money
         | instead of watching ads. Content creators, it must be said,
         | also have the option of self-hosting and/or creating content as
         | a hobby rather than a career. As someone who has grown more and
         | more despairing of any paid-for speech, especially by ads, I
         | welcome this change.
         | 
         | Far more troubling is the possibility of attestation for
         | "important apps" like banking or government. In general this
         | mechanism gives the org a way to prevent you from doing what
         | you want with your data. For example, they can prevent you from
         | scraping data and automating end-user tasks. This takes away
         | your degrees-of-freedom, and using a modified browser will
         | certainly become an actionable offense. In my view this is by
         | far the more troubling aspect of this change, since it take
         | away significant aspects of user autonomy in a context where it
         | matters most.
         | 
         | Technically sophisticated users will note that it's not
         | possible to secure a client, and foolish to try. This misses
         | the point. These changes stochastically change behaviors "in
         | the large", like a shopping center that offers two lanes in and
         | one lane out, or two escalators in and one out. This represents
         | a net transfer of power from the less powerful to the more
         | powerful, and therefore deserves to be opposed.
         | 
         | EDIT: please don't downvote, but rather reply with your
         | objection.
        
           | mindslight wrote:
           | This has been litigated to hell on HN, but no, there is no
           | implicit contract when loading a webpage that your user agent
           | will display ads or any other content as envisioned by the
           | publisher. A _user agent_ has always been intended to be
           | something that displays content according to the wishes of
           | the user. Even this  "modest proposal" phrases itself in
           | terms of user desires (albeit completely disingenuously). Ads
           | have become prevalent because most users go with the default
           | and don't install content filters to block them, but this
           | does not create some obligation for all users to display ads.
           | Rather, the core dynamic remains that ads essentially display
           | at the pleasure of users.
           | 
           | There is no option to " _implements the attestation as
           | something like 'return true'_". There is a chain of
           | verification from the hardware manufacturers building in
           | software surveillance, through OS developers treating the
           | device owner as an attacker, this proposal of carrying the
           | same user-hostile dynamic through browsers, and finally to
           | the website that by verifying the signatures can force a user
           | to only use software that enforces all of the above.
           | 
           | You should very much object to this! Today, "unsupported
           | browser" is a CYA term that doesn't really mean much besides
           | that the website has limited testing budget (and who
           | doesn't?). With this proposal it would become a _hard
           | blocker_. Goodbye Linux /BSDs/etc. Goodbye `make install`.
           | Goodbye virtual machines. Goodbye computers that last longer
           | than the rapid e-waste treadmill of mobile phone land. You
           | will of course be able to keep running user-representing
           | operating systems, old computers, "jail" breaking them, etc.
           | You just won't be able to access banking websites, followed
           | by web stores, then general sites. Basically anywhere today
           | that hassles users with CAPTCHAs will be looking to implement
           | these restrictions eventually (which is basically
           | everywhere).
        
             | javajosh wrote:
             | Your first paragraph, about ad blockers, is very strong,
             | thank you. I may even be convinced. I already want a world
             | where communication only happens by consent, and framing
             | this change as fundamentally coercive makes sense. One may
             | object on the basis of wanting the consumer to consume "the
             | whole thing", however I think that's easy to dismiss. I
             | think I'm convinced.
             | 
             | Your second paragraph, about chain of trust, gets a little
             | more wobbly, but this is a matter of fact, not opinion.
             | Will this change require a chain of trust from hardware up?
             | That's startling. Do you have a link? I read the proposal
             | but don't recall seeing that.
             | 
             | The third paragraph seems to articulate the worry that
             | systems will now be closed with centralized gate keepers
             | determining what we can do with our systems. Or at least,
             | that will be the default unless you can get grandpa's old
             | TPM-free linux laptop working again. And even if you do,
             | you won't be able to connect it to the future internet to
             | do anything real. That's not a good future. It's one which
             | makes individuals passive and controlled by central
             | authority - and even if you don't object to this morally,
             | you must admit that an ignorant and disabled population is
             | weak and susceptible to attack.
        
               | mindslight wrote:
               | I haven't read the proposal in depth. But skimming, this
               | stands out:
               | 
               | > _With the web environment integrity API, websites will
               | be able to request a token that attests key facts about
               | the environment their client code is running in. For
               | example, this API will show that a user is operating a
               | web client on a secure Android device. Tampering with the
               | attestation will be prevented by signing the tokens
               | cryptographically._
               | 
               | I don't see what else this could be referring to besides
               | bringing TPM "remote attestation" up through the software
               | stack to the level of a web browser. By "secure" Android
               | it must mean one running a corporate Android distribution
               | (see: SafetyNet), where Google has already been pushing
               | this lockdown dynamic for a few years at least. Without
               | tying it into the TPM, there would be literally no point
               | to this specification as it could always be faked.
               | 
               | The insidious thing about this spec is that it's not an
               | immediate prescriptive lockdown the way corporate
               | "secure" boot is. Rather if it turns on tomorrow,
               | Firefox, extensions, and community Linux distributions
               | will all still work fine. But the long term dynamic is
               | that each of these nonstandard things will be stamped out
               | in the name of "security" - look at how the SafetyNet
               | requirements on Android are getting incrementally harder
               | to "pass".
               | 
               | Fundamentally this is _entirely_ about consensual
               | interactions. Right now, the demarcation point between
               | user interests and website /server/company interests is
               | the _communications protocol_ itself. Your computer
               | represents your interests, my computer represents my
               | interests, and they possibly communicate with each other
               | while still representing each of our interests. Remote
               | parties that you 're communicating with being able to
               | verify what code you are running means they are then able
               | to dictate what code you must run, even when it
               | undermines your interests. Your only recourse becomes to
               | not communicate, which doesn't work in our world of
               | imbalanced power relationships. Computing's revolutionary
               | spark of personal autonomy gets shoved back in the bottle
               | as far as the Web is concerned.
               | 
               | > _centralized gate keepers determining what we can do
               | with our systems. Or at least, that will be the default
               | unless you can get grandpa 's old TPM-free linux laptop
               | working again_
               | 
               | There's some nuance here. Likely you will still be able
               | to "jail break" new devices, or even root them in a
               | supported way like Google's current Android devices. But
               | doing so will make the device useless for accessing any
               | website that insists on performing the verification. So
               | sure, you can keep on using your nonstandard development
               | environments just fine - most of the Web will be
               | unavailable to it though.
               | 
               | You will just need a second WebTV like device for
               | accessing banking websites, then shopping websites, then
               | news websites. As I said, anywhere that currently pops up
               | CAPTCHAs when browsing from less-surveillable IPs is a
               | good indicator for the eventual adoption path. Said
               | device will implement all the restrictions the website
               | publishers can dream of - ads, lack of copy/paste, no
               | screenshots, no access by VNC, no browser extensions, no
               | protection from corporate surveillance, etc.
               | 
               | > _And even if you do, you won 't be able to connect it
               | to the future internet to do anything real_
               | 
               | That's a long way off and doesn't have any technical
               | connection to this proposal. But one can imagine this
               | proposal being one step in a chain of
               | developments/legislation that brings us to that point.
        
               | javajosh wrote:
               | _> there would be literally no point to this
               | specification as it could always be faked._
               | 
               | I disagree. There is a point to making something more
               | difficult but not impossible: you alter behavior at
               | statistically significant scale in practice AND you get
               | to point to the alternative as a reason why the change
               | isn't "coercive". In practice, 99% of users won't know to
               | download an altered Chrome - they have a shaky
               | understanding of "browser" and "os" as it is. In fact, I
               | can imagine Googlers rationalizing this as a kind of
               | shibboleth that keeps hacker culture alive.
        
               | mindslight wrote:
               | Sure, I see where you're coming from, and much corporate
               | software has traditionally worked in this quasi-
               | consensual hostile-default kind of way. But the specific
               | terms used in that passage are highly indicative of this
               | being intended as implementation of remote attestation
               | for the web.
               | 
               | Furthermore, even if the "key facts" it reports don't
               | initially include results of hardware remote attestation,
               | it's entirely foreseeable that over time these will be
               | added.
        
         | mordae wrote:
         | To put it simple, it makes it possible for service provider to
         | reject providing service to clients not running corporate-owned
         | white-listed clients. Thus making it virtually impossible to
         | create independent clients for such services.
         | 
         | It will be swiftly adopted by well meaning but clueless bank
         | and government clerks who will accidentally use to lock all
         | open hardware, open operating system, open browser users out
         | and mandate you need to purchase at least one locked down
         | corporate device to exist.
         | 
         | It's the trusted computing story all along. Eventually you will
         | need permission to run your code on your own device and such
         | "unlocked" device will be blocked from accessing any digital
         | infrastructure because it might be otherwise used to breach
         | ToS.
        
           | sir_brickalot wrote:
           | Isn't this already the reality in the mobile space?
           | 
           | I own a rooted Samsung device and have to jump through 100
           | hoops to be able to use my banking app or Netflix or some
           | rando game (which I don't actually play). SafetyNet broken,
           | hardware fuse blown, Magisk Hide + some other havks just to
           | still be able to do online banking.
           | 
           | I just want to be able to ssh into my own device or install a
           | real ad blocker, like Adaway without losing access to real
           | world applications.
           | 
           | This is all very depressing.
        
             | erulabs wrote:
             | Yes, exactly correct. WEI is a way to turn this mobile
             | device signing nightmare into a web standard that can be
             | enforced across all devices.
        
             | dvngnt_ wrote:
             | it is the reality for mobile.
             | 
             | on iphone you can't even install software that apple
             | doesn't explicitly allow.
             | 
             | they would love to extend this to all computing devices to
             | remove control
        
               | jimkoen wrote:
               | > they would love to extend this to all computing devices
               | to remove control
               | 
               | That's not really true. Apple is encroaching freedom of
               | software choice on their devices, but they know that they
               | can't extend the same kind of security policies to the
               | desktop. You can disable secure boot on Macs and even run
               | Linux if you like. Additionally, it's a bit difficult but
               | if you disable SIP you do get access to the entire
               | systems file system. They're a shitty company when it
               | comes to repair-ability and their walled garden, but they
               | know they can't extend this to the desktop, or else they
               | would disqualify themselves from the developer market
               | (where they are quite popular).
        
       | btown wrote:
       | From the spec author, in 2022 [0]:
       | 
       | > I decided to make this an app in the end. This is where my
       | costs started wracking up. I had to pay for a second hand macbook
       | pro to build an iOS app. Apple's strategy with this is obvious,
       | and it clearly works, but it still greatly upsets me that I
       | couldn't just build an app with my linux laptop. If I want the
       | app to persist for longer than a month, and to make it easy for
       | friends to install, I had to pay $99 for a developer account.
       | Come on Apple, I know you want people to use the app story but
       | this is just a little cruel. I basically have to pay $99 a year
       | now just to keep using my little app.
       | 
       | The double-think is absolutely astounding.
       | 
       | [0] https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-
       | my-...
        
         | toyg wrote:
         | The guy seems to have deleted most of his social accounts.
         | Clearly he values privacy for himself, just not for everyone
         | else.
        
         | freeAgent wrote:
         | This is especially surprising coming from a Linux user who
         | presumably understands the desire to have a device that runs
         | code one can read, write, compile, execute, and share freely
         | and without needing to receive approval from a Big Tech
         | gatekeeper.
        
           | caskstrength wrote:
           | Maybe desire for great performance review is much greater in
           | the author than being able to access the Web from his Linux
           | laptop?
        
         | Waterluvian wrote:
         | My understanding is that Ben gets his paycheque from Google.
        
           | toyg wrote:
           | It's hard to get someone to understand if his salary depends
           | on not understanding.
        
         | kalleboo wrote:
         | I don't think it's double-think, it's just a lack of
         | consequential thinking. I believe the writers of the spec when
         | they say that they just want to be able to see which ad views
         | are real or not. They even lay out some (far too weak) ideas to
         | keep the system from being mandatory and abusable. But they
         | don't realize just how quickly things will go out of hand once
         | the rest of the organization realizes what they have created.
         | 
         | The road to hell is paved with good intentions.
        
           | dogleash wrote:
           | > it's just a lack of consequential thinking
           | 
           | Googlers tend to _trust_ google, even when its readily
           | apparent tool /system design obviously puts them in a control
           | position above anyone else in matters that extend beyond
           | their own walls. I've only met a few that will coyly admit
           | they don't trust google, but maintain they have to keep up
           | appearances.
           | 
           | I think it also explains their outspokenness on societal
           | issues outside google's control. It's a distraction from
           | thinking too hard about what societal bad google does have
           | control over.
        
             | kalleboo wrote:
             | Exactly. This is common also with other tech companies. I
             | knew an ex-Facebook employee who was defending them at the
             | height of their "Facebook Research proxy monitoring
             | underage kids traffic" scandal. I'm sure _his_ team was
             | trying to be moral in their work, but people don 't realize
             | this doesn't generalize to massive corporations or even
             | that in their bubble their morals may be perverted.
        
           | dmvdoug wrote:
           | > The road to hell is paved with good intentions
           | 
           | Fine. Then, when we arrive in hell because this person took
           | us there, it should follow him all the rest of his days that
           | he was too Pollyannish about the consequences of his own
           | designs.
        
           | nvm0n1 wrote:
           | [flagged]
        
             | jorams wrote:
             | > 3. Web EME. "End of the web as an open platform", years
             | later, web is just the same as it always was.
             | 
             | And yet every single paid streaming service refuses to
             | serve high quality video to users on platforms like Linux.
             | This is entirely normalized, and they still get to call
             | themselves "web" sites because this mechanism is now
             | officially part of "the web".
        
             | userbinator wrote:
             | I see damage control has started to appear...
             | 
             | The frog boils very slowly.
             | 
             |  _This from an industry that broke a zillion scripts as
             | part of renaming git master to git main on the basis that
             | the first name is somehow hateful._
             | 
             | That was the actions of a small group of extremists, and
             | there was widespread opposition to it too.
             | 
             | Spinning the opposition as "hate" seems rather popular
             | these days, and it's not wrong: _We hate what Big Tech has
             | done and is continuing to do to our freedoms and it 's
             | about time we released all of our rage on our oppressors._
        
               | undersuit wrote:
               | We're a long way past source code being transmitted in
               | magazine articles. Some of the people that are going to
               | hand wave this away were born in the boiling water.
        
             | hooverd wrote:
             | Calling it a "vicious hate and bullying campaigns" is
             | pretty overblown. You can't even propose closing the web to
             | anyone without a big three controlled device anymore
             | without being mean to you, sad.
        
             | kalleboo wrote:
             | You're not wrong.
             | 
             | The real problem here seems to be giving one single company
             | too much unchecked power rather than the individual
             | proposal itself.
        
             | freedomben wrote:
             | AFAIK, Number 2 only didn't happen because of pushback.
             | It's also not too late for that to happen should Microsoft
             | decide to move with it.
             | 
             | FWIW I didn't think any of the previous things would turn
             | catastrophic, but I do think this might. I work with a lot
             | of web marketers and also with security teams, and they
             | will both _salivate_ over this. Between marketers and
             | security teams, that 's like 90% or more of the internet.
             | 
             | This change is laying a trail of metaphorical kerosene from
             | the campfire. It's possible the fire won't spread beyond
             | the fire ring, but it won't take much for it to escape and
             | then it's going to be unstoppable.
        
             | callalex wrote:
             | You seem to be under the impression that a forum with
             | hundreds of thousands of users has one consistent opinion
             | on everything. This is wildly incorrect.
        
             | whywhywhywhy wrote:
             | >1. Apple GateKeeper. "End of the Mac as a general purpose
             | compute platform is nigh", >10 years later, you can still
             | run whatever apps you want.
             | 
             | We ignoring that they now, as of the last 2 years claim
             | unsigned apps are "Broken" and need to be "Moved to the
             | Trash" instead of just "Unsafe" with an "Open" command?
             | 
             | They're moving at snails pace but there are people working
             | at Apple trying to force the hands of devs into an iOS like
             | system.
        
             | dang wrote:
             | I agree that there shouldn't be bullying campaigns on HN
             | but you veered into offtopic flamewar at the end of your
             | comment and that is in no way helping. Please stick to the
             | site giudelines.
             | 
             | https://news.ycombinator.com/newsguidelines.html
        
       | [deleted]
        
       | renegat0x0 wrote:
       | Because we are only 'recipients' of their actions we can only
       | watch, shame, scream, screech.
       | 
       | It is, as always, for your protection. They will shake hands,
       | implement whatever they like.
       | 
       | The road is clear. Chat control, Earn IT act, TPMs, Secure Boots,
       | Cyber Resilience act, Online Safety Bill, Crypto Wars.
       | 
       | Most of the users decide what can happen. Most of the users are
       | blind. The network effect will eventually force everybody to
       | follow.
        
       | topshelf wrote:
       | @dang Would we be able to update the title please?
       | 
       | To clarify the acronym, _Google is already pushing Web
       | Environment Integrity (WEI) into Chromium_
        
       | mrguyorama wrote:
       | If you STILL use chrome after this, you were never willing to
       | give an alternative even a little bit of a chance anyway. Surely
       | not supporting this and the power it gives Google over the web is
       | worth a "slower" (I've never experienced that) browser or one
       | with a stupid pocket logo in the corner that you NEVER HAVE TO
       | INTERACT WITH EVER
        
       | thesuperbigfrog wrote:
       | It looks like they do not care if they have consensus or approval
       | for WEI, they are implementing it regardless.
       | 
       | Wherever you live, you should contact your government
       | representatives and regulators and put a spotlight on this issue
       | for what it is--monopoly abuse of power.
       | 
       | Grassroots efforts are great and it is good to let your friends,
       | family, and associates know what they are doing and why it is
       | wrong. However, government regulation of this abuse is needed to
       | stop it by force of law.
        
         | andersa wrote:
         | Why do you think they don't have consensus or approval from all
         | the people that matter? This is far too big for that. Google,
         | Apple, Microsoft, Cloudflare, etc, are all working together on
         | this. Governments will like it for "security", and 99% of users
         | won't care.
        
           | jmvoodoo wrote:
           | That looks an awful lot like a cartel.
        
             | derefr wrote:
             | No, this is how industries work. The slaughterhouse
             | industry body does not ask the cows for their opinion.
        
       | mozball wrote:
       | If this isn't the straw that breaks the camel's back, there is
       | never going to be one.
       | 
       | Google needs to be broken up.
       | 
       | They own the browser market. They own the web (through Adwords).
       | They own Search. They own mobile. They own most of the video
       | sharing market with 2.5 billion monthly annual users. They own a
       | good chunk of email with 1.2 billion monthly annual users.
       | 
       | They have amassed an incomprehensible amount of power and
       | influence over humanity and they have proven repeatedly that they
       | are willing to use that power to the detriment of humanity and to
       | entrench themselves further.
       | 
       | Google needs to be broken up.
        
         | nologic01 wrote:
         | > Google needs to be broken up.
         | 
         | Not going to happen. Rationally there should be broad political
         | consensus about cutting Google back to size: from rabid
         | libertarians worshiping the miraculous abundance generated by
         | "competition and free markets" to bleeding-heart socialists
         | keen on pushing back corporate power as the root of all evil.
         | 
         | Alas, these political categories no longer have any meaning.
         | The US political system has mutated into something else (the
         | messenger being a horned man) which will probably require some
         | time to properly characterize and name using terminology that
         | is appropriate to use in good company.
         | 
         | So the fate of Google will be more shaped by actions of
         | external entities than as part of US regulatory efforts.
         | Powerful countries that _antagonize_ the US are simply
         | degoogling and creating their own copycat panopticons.
         | 
         | The question is what will be the course of action of powerful
         | countries that are _alies_ of the US (i.e. Europe and a few
         | others). Will they accept that _their_ digital society will be
         | feudal in nature because the broken US political system cannot
         | deliver on even basic responsibilities?
        
           | Dracophoenix wrote:
           | > Will they accept that their digital society will be feudal
           | in nature because the broken US political system cannot
           | deliver on even basic responsibilities?
           | 
           | The Germans, British, Australians and French are also
           | attempting to build their own panopticons.
        
         | ChatGTP wrote:
         | Don't forget, increasingly transport, you won't be able to get
         | a taxi in SF soon without being monitored / tracked by Google.
        
           | hellojesus wrote:
           | How so? Are they requiring request of taxis via a site with
           | Google analytics?
        
             | xnx wrote:
             | I think they're alluding to Waymo. I feel much better about
             | Google tracking my taxi rides than I do with Uber, Lyft,
             | random taxi company, my cell phone company, etc.
        
         | threatofrain wrote:
         | What would it mean for Chrome to be spun-off into a separate
         | business? How would it survive?
        
           | cmrdporcupine wrote:
           | Google Ads and Search would have to pay Chrome for search
           | placement. Just like they do to Mozilla right now.
        
           | rolph wrote:
           | ideally, it wouldnt survive.
        
             | ketzo wrote:
             | the _ideal_ scenario is that 65% of users ' favorite
             | browser is no longer available? why is that ideal?
        
               | flangola7 wrote:
               | It's ideal that monolithic spyware dies.
        
         | px43 wrote:
         | Google broke itself up in 2015. What are you even asking for
         | here?
         | 
         | Chrome and Android are open source, and there are several forks
         | of both thriving in the ecosystem. Yeah it would be cool if
         | there was a decent open source alternative to GMail and Drive,
         | but no one else seems to have figured out how to get the
         | incentives right for something like that.
        
           | goffer wrote:
           | Say that to Huawei.
        
           | troupo wrote:
           | That "incentive" for Google is "80% of our revenue comes from
           | ads".
           | 
           | Google's open source projects are open in name only.
        
             | px43 wrote:
             | > Google's open source projects are open in name only.
             | 
             | The link at the top of the page is pointing to the GitHub
             | repo, where you can see literally over a million
             | contributions from thousands of people working at hundreds
             | of companies:
             | https://github.com/chromium/chromium/commits/main
             | 
             | I've worked on both Chrome and Android (Chromium and AOSP)
             | professionally, and never worked at Google.
        
               | troupo wrote:
               | Well, true :)
               | 
               | What I should've written is that: yes, they are open
               | source, but there's no way to influence the direction
               | they are going. These projects are 100% Google-run, and
               | very few (if any) decisions are public.
               | 
               | For most projects there's also a significant proprietary
               | part in the actual final product
        
               | jsjohnst wrote:
               | You and GP both can be right depending on definition used
               | for "open source".
        
               | lcnPylGDnU4H9OF wrote:
               | There is the OSS vs FOSS distinction which may have been
               | unwittingly invoked. Certainly there is nothing "free"
               | about Chromium except its price. Google is not about to
               | switch to a fork for Chrome and any changes to Chromium
               | which are not approved by Google are unlikely to be in
               | any release builds.
        
           | BlargMcLarg wrote:
           | It's not the lack of open source, it's ease of use.
           | Alternatives exist, but no company is going to run a charity
           | case for you to store tons of data for free. Mail in
           | particular is commonly known to be a hassle which has nothing
           | to do with Gmail the software, as much as Gmail the provider.
        
           | alistairSH wrote:
           | _Google broke itself up in 2015. What are you even asking for
           | here?_
           | 
           | No, it didn't, it restructured itself into Alphabet, with
           | many subsidiaries. But, all the core businesses are still
           | under that umbrella organization, with most web-related
           | businesses remaining inside the current Google entity.
           | 
           | A forced divestment of the browser business might help. Same
           | for the productivity products.
        
             | Cthulhu_ wrote:
             | But what does breaking up even mean? Separate companies,
             | each publicly traded with their own C level staff,
             | shareholders, etc?
             | 
             | Because to me it just feels like it might be legally
             | separated, but still owned and directed by the same handful
             | of people. And it being separated makes it safer, in that
             | they can't forward e.g. large fines to the parent company.
             | 
             | Disclaimer: I don't know anything about large corporations.
             | or economy. or governments.
        
               | alistairSH wrote:
               | Yes, breaking up a company means divesting some business
               | units. The new businesses would have their own BoD,
               | leadership, shareholders, etc.
               | 
               | The US did this with Standard Oil in 1911, Bell/AT&T in
               | 1983. And the same laws were used against Microsoft in
               | 2001, though the company was able to avoid a break-up.
               | 
               | Breaking up Google might not be the best option. Perhaps
               | more rigorous regulation by the government would be
               | better, similar to Microsoft. But a break up should be an
               | option.
        
             | scarface_74 wrote:
             | What browser "business"? Chrome makes no money. Don't you
             | think they are going to fund themselves the same way that
             | Firefox does - via Google ads?
             | 
             | No one has paid for a browser in almost 3 decades and even
             | then few did.
        
               | rchaud wrote:
               | Chromebooks are literally a browser that you pay for, and
               | they are heavily embedded in the US education system.
               | 
               | Just because they don't sell floppies in a box like it's
               | 1994 doesn't mean these aren't businesses.
        
               | scarface_74 wrote:
               | Yes, you just pay for the browser and not the hardware.
               | Are ChromeBooks also a "keyboard you pay for"?
        
               | jsjohnst wrote:
               | > No one has paid for a browser in almost 3 decades and
               | even then few did.
               | 
               | Considering NCSA Mosaic's initial release was _just_ 30
               | years ago this year and it's considered the first
               | browser, think you might be using a bit of hyperbole
               | there? Twenty years would've been more accurate.
        
               | xp84 wrote:
               | MSIE was free, 28 years ago in late 1995, and while
               | Netscape did take 5 years to follow suit, by 1998
               | Netscape was not in a healthy position because of the
               | free competition.
        
               | scarface_74 wrote:
               | And to a first approximation. No one paid for Netscape
               | then. I first downloaded it free in 1996 from their ftp
               | server.
        
               | bradleyy wrote:
               | As someone who worked in this space at the time
               | (Webmaster at Spry, Inc. in 1994), and we sold a web
               | browser in the 1994-ish timeframe
               | https://en.wikipedia.org/wiki/IBox, no, saying "almost 3
               | decades" isn't hyperbolic at all. 29 years is close
               | enough.
        
               | marcinzm wrote:
               | I don't think you understand what a business is. Google
               | pays Firefox a lot of money to be the default search
               | which means there is a lot of money in browsers. Google
               | Search conceptually pays Google Chrome to be the default
               | Search engine on Chrome. Except since they're both under
               | the same company they will never take an outside offer
               | which is why it's a monopoly. No different from any other
               | vertically integrated company.
        
               | scarface_74 wrote:
               | I understand that perfectly, how do you think the
               | theoretical Chrome business would make money?
        
               | marcinzm wrote:
               | The same way the non-theoretical Firefox business makes
               | money.
               | 
               | edit: Safari as well.
        
               | scarface_74 wrote:
               | By showing ads from the "AdSense Company" and sending
               | your personal information to them?
               | 
               | Meet the new boss...
        
               | alistairSH wrote:
               | Sure, but on the positive side, the Chrome Company has
               | its own incentives.
               | 
               | Today, Google can provide Chrome as a loss-leader, making
               | up for the "free" browser with ad revenue.
               | 
               | The new Chrome Company can't operate that way. It needs
               | to make money on its own. Perhaps MS Bing offers more
               | money. Or they build their own ad system. Or pivot into
               | some other business area.
               | 
               | Anyway, I don't think anybody is arguing Google/Alphabet
               | must be broken up, only that it's a tool that's available
               | in the US, should we (society) decide other regulation is
               | insufficient.
        
               | scarface_74 wrote:
               | > Perhaps MS Bing offers more money.
               | 
               | > Or they build their own ad system.
               | 
               | And we still are being tracked by BigTech with the same
               | business model that people object when Google does it.
               | 
               | > Or pivot into some other business area.
               | 
               | And what other method do you suggest for funding besides
               | ads or people paying for the browser? The second option
               | has never been a long term successful business for
               | browsers?
        
         | mardifoufs wrote:
         | Why should the US break up an asset like Google? Would be
         | completely self defeating. This isn't like standard oil or
         | at&t, that mostly had influence and market share inside the US.
         | It would basically be handing power to foreign competitors who
         | would pounce at the opportunity
         | 
         | And I'm not American so it's not even some sort of patriotic
         | comment. If Europe , or anywhere else, had a Google sized
         | Behemoth, they wouldn't mess with it no matter how "anti tech"
         | they might seem now. If anything they are anti tech because
         | they don't want _foreign_ big tech to have massive influence
         | over them. You 'd bet they wouldn't cripple big tech if they
         | were European. On the other hand, as long as they are American
         | that massive power is a feature, not a bug for the US
         | government.
         | 
         | The reaction to Tiktok is a good example of how
         | nationalism/geopolitics shape the reaction to big tech, which
         | is why google is probably safe.
        
           | strix_varius wrote:
           | > Why should the US break up an asset like Google? Would be
           | completely self defeating.
           | 
           | Because in the _short term_ it would disrupt a major company
           | (ala Standard Oil), but in the _long term_ it would allow the
           | US to remain competitive in the global market.
           | 
           | If we allow Google to continue abusing its monopoly power in
           | the US, that guarantees that the US will not be the home of
           | the future technologies of the world. Innovations will be
           | sucked up and killed as acquisitions. Enormous energy will be
           | focused on blatant moat-building like WEI instead of
           | developments that benefit the world. etc.
        
             | minsc_and_boo wrote:
             | Tech competitiveness relies on network effects. Breaking up
             | tech would just cede marketshare to companies like
             | ByteDance and Baidu.
             | 
             | Any successful US-based tech post-breakup would be acquired
             | by larger international players, like Tiktok was.
        
           | lacrimacida wrote:
           | One thing comes to mind: antitrust! It happened to Microsoft
           | as well!!
        
             | bagacrap wrote:
             | ...and Microsoft has more power than Google at the moment
        
               | asadotzler wrote:
               | But anti-trust stalled Microsoft's efforts at a critical
               | time and allowed Firefox and Safari (like Gecko) to
               | restore a standards-based web from an IE-based web. It's
               | not a cure all but it worked. IE had 95% marketshare in
               | 2002 and Firefox took a third of that from them in a few
               | years thanks to anti-trust and the consent decree it
               | forced on MS.
        
           | paganel wrote:
           | > Why should the US break up an asset like Google?
           | 
           | I'm also European and I think almost pretty much 100% as you
           | think on this, but to play devil's advocate, and how I think
           | this should have worked in theory in a free-market economy,
           | is that the US, by allowing companies like Google to do their
           | nefarious and frankly evil things right now and in the near
           | future is also, at the same time, not allowing future
           | potential companies, more innovative than Google is now, to
           | take Google's place.
           | 
           | But what happens is that the US is focusing on having a
           | strong and national security-enhancing company (Google) on
           | its side now and in the near future, versus having an even
           | stronger and, potentially, even more national-security
           | enhancing company (the one that would have taken Google's
           | place had the free market been allowed to do its thing) in
           | the medium to long future.
           | 
           | On the face of it this compromise of security now and in the
           | near future vs security in the medium to long future looks
           | like a decent bet, the problem is that evil colossuses like
           | Google are actively getting rotten from the inside, and at
           | some point in the medium to long future they'll fall almost
           | in an instant, with no company to take their place. That will
           | leave the US highly vulnerable at that point in the future.
        
           | mozball wrote:
           | In which case foreign governments, the EU and the like who
           | collectively represent the interests of the other 7+ billion
           | people, should start levying taxes, penalties and fines on
           | Google and haul it and the US in front of international
           | agencies like the WTO for unfair trade practices.
        
         | scarface_74 wrote:
         | [flagged]
        
           | lnxg33k1 wrote:
           | I don't have a Google account and don't use any Google
           | service, still think that this libertarian message is
           | bullshit, how do you do the free will if the web starts
           | deciding which OS/Browser are authorised to do something? I
           | am not sure we are talking about free will or useful idiots
        
             | scarface_74 wrote:
             | And how will "breaking up Google" help if the "Chrome
             | company" is still implementing DRM?
        
               | lnxg33k1 wrote:
               | Because you break the interest of showing ads from google
               | search/adwords, to the interest of surfinh web freely of
               | those who would work on chrome
               | 
               | Now google has both the need to show ads, and direct
               | power on what people use to see those ads
        
               | scarface_74 wrote:
               | How do you think the "Chrome company" would be funded?
               | 
               | How is Firefox funded today.
        
               | lnxg33k1 wrote:
               | Is Firefox consistently trying to find ways to show you
               | ads? Are they working on technology that helps profiling
               | you?
               | 
               | One thing is funding, keeeping independence, another is
               | controlling
        
               | scarface_74 wrote:
               | They get 80% of their funding from Google. Do you think
               | they are going to change to a "privacy first" search
               | engine?
               | 
               | And Firefox already supports Google's WideVine DRM
               | 
               | https://support.mozilla.org/en-US/kb/enable-drm
               | 
               | What makes you think they won't support this?
        
               | lnxg33k1 wrote:
               | Are you sealioning me?
        
               | scarface_74 wrote:
               | I think it's kind of naive to think a company that gets
               | 80% of its funding from Google is going to go out of its
               | way to protect you from the same company or that it won't
               | implement the same proposed DRM standard when it already
               | implemented the older one.
        
               | lnxg33k1 wrote:
               | But if firefox is full of tech to prevent privacy leaks?
               | They incorporated a vpn, strict mode, containers, third
               | party cookie block, dnt, etc.. what the fucking hell are
               | you talking about?
        
               | scarface_74 wrote:
               | They are sending you to Google for searches. Everything
               | else is irrelevant if you are concerned about Google
               | getting information about you.
               | 
               | If you think that Firefox won't include DRM because of
               | "freedum", there is an existence proof that they will -
               | they support WideVine.
               | 
               | How can Firefox be "independent" of Google when 80% of
               | their funding comes from Google?
        
           | amelius wrote:
           | And yet, you are probably somewhere in Google's databases.
        
             | scarface_74 wrote:
             | And if they are broken up, now you're in 5 companies'
             | databases, win?
             | 
             | And then they are all probably going to implement "sign in
             | with Google".
        
               | kristiandupont wrote:
               | >And if they are broken up, now you're in 5 companies'
               | databases, win?
               | 
               | Yes, win. I'd rather be in a number of smaller businesses
               | database than in the one last company's.
        
               | scarface_74 wrote:
               | Isn't that the opposite of privacy?
        
               | amelius wrote:
               | The opposite of privacy in this context is 1 or more
               | companies having your data. Note the 1.
        
           | josephd79 wrote:
           | what browser do you use?
        
             | scarface_74 wrote:
             | Safari
        
           | mozball wrote:
           | Google Search is notably absent in your list.
           | 
           | If this proposal becomes standard in Chrome, You can be sure
           | Microsoft and Apple will follow Google's lead with the same
           | or their own similar implementations.
           | 
           | See Microsoft Pluton and Apple's Private Access Tokens. Or
           | read this article which provides an excellent overview of
           | these developments.
           | https://news.ycombinator.com/item?id=32282305
           | 
           | Make no mistake. If this becomes standard on Chrome, this is
           | going to be standard on the web.
        
             | rchaud wrote:
             | Youtube is absent as well. Maybe OP is not as de-Googled as
             | they think.
        
             | scarface_74 wrote:
             | I didn't specifically try to De-Googlefy my life for some
             | moral reason. I think most of Google's products are second
             | rate - including their search page unless you use an Ad
             | blocker. But I do find myself using ChatGPT more and Google
             | less for coding questions since it does a better job of
             | giving me exact answers to my problems and code is easy to
             | verify for correctness.
             | 
             | As far as YouTube, I think I only use it for AWS ReInvent
             | videos. I can't stand ads and there are no ads interrupting
             | the video.
        
           | LikelyABurner wrote:
           | Wait until your bank requires you to use it to pay your bills
           | and tax preparation websites require it to pay for taxes.
        
             | scarface_74 wrote:
             | I'm sure they are all going to block iOS users from using
             | their services.
        
               | beanjuiceII wrote:
               | iOS already implemented this stuff
        
               | kmeisthax wrote:
               | Not only did iOS implement this, but everyone either
               | sleep-walked on it, or worse, _praised it_ , because
               | Apple sold it as a CAPTCHA bypass instead of a DRM
               | scheme:
               | https://mastodon.delroth.net/@delroth/110775677023220850
        
               | martimarkov wrote:
               | How is PrivacyPass related to iOS?
        
               | kmeisthax wrote:
               | PrivacyPass is an extension that lets you pre-solve
               | CloudFlare CAPTCHAs if you're on a VPN. However, that was
               | too frustrating, so CloudFlare partnered with Apple to
               | integrate PrivacyPass into Safari.
               | 
               | How did they do this? Simple: iOS provides cryptographic
               | attestation that your browser isn't a bot and isn't
               | hacked, and CloudFlare takes that as your CAPTCHA
               | solution. This works exactly the same way that Google
               | proposes Web Environment Integrity work.
        
             | petepete wrote:
             | My former business bank actually did this. They insisted
             | their web app "was compatible with all modern browsers, but
             | more compatible with Chrome" - I couldn't make transfers to
             | other accounts with Firefox, it just hung indefinitely.
             | 
             | Virgin Money, UK - https://uk.virginmoney.com/
        
               | amalcon wrote:
               | > _was compatible with all modern browsers, but more
               | compatible with Chrome_
               | 
               | Is Animal Farm not required reading in Orwell's home
               | country? Or was that a misquote, or maybe just something
               | from a random support worker? It's almost too on the nose
               | for that statement to be written by someone familiar with
               | that book.
        
               | sherr wrote:
               | I use Virgin Bank and Firefox works OK for me.
        
               | [deleted]
        
             | goalieca wrote:
             | It's bad enough google captcha is broken on Firefox with
             | all the privacy extensions on.
        
               | glogla wrote:
               | It is not broken. They are punishing you for not wanting
               | to be tracked, profiled and manipulated.
        
           | idlewords wrote:
           | You may not use Gmail, but every email you send and receive
           | goes through Google infrastructure.
        
             | scarface_74 wrote:
             | I might need to tell my corporate IT department that our
             | emails are going through Gmail.
             | 
             | Besides, I can't remember the last time I actually sent a
             | personal email to anyone besides forwarding something from
             | another business.
        
         | coldpie wrote:
         | > Google needs to be broken up.
         | 
         | To make it explicit: the only way this happens is by Americans
         | voting for it. The FTC has been more active on anti-trust
         | issues in the past two years than at any time in the past 30.
         | That's a direct result of the 2020 election. Elections matter.
        
           | yyyk wrote:
           | >The FTC has been more active on anti-trust issues in the
           | past two years than at any time in the past 30.... That's a
           | direct result of the 2020 election.
           | 
           | Active against Google though? Remember, Google can help a
           | certain political party in tough times (e.g. rollout of
           | healthcare.gov).
        
             | coldpie wrote:
             | So can Microsoft and Amazon, surely? Yet they're getting a
             | lot of scrutiny from the FTC right now.
        
               | yyyk wrote:
               | Yes, but Google has a strong existing relationship, the D
               | party _owes_ them for that one and some other favours.
               | Can you find a link for any recent FTC action against
               | _Google_ (not against Google 's competitors or some tiny
               | subsidiary of Google)? I hope I'm wrong here.
        
               | coldpie wrote:
               | I don't see anything significant from the FTC
               | specifically regarding Google, but there is an ongoing
               | DOJ lawsuit. Possibly they don't want to step on that? I
               | admit I don't really understand the roles of the DOJ
               | versus the FTC regarding anti-trust enforcement.
               | https://www.justice.gov/opa/pr/justice-department-sues-
               | googl...
        
               | Mountain_Skies wrote:
               | Wake me up with they actually do something instead of
               | making announcements of looking into the possibility of
               | perhaps one day sending a strongly worded letter asking
               | their tech buddies to calm down a little bit, if they're
               | so inclined. Until then, this is campaign fodder and
               | nothing else.
        
               | coldpie wrote:
               | Okay, here's your alarm clock going off:
               | 
               | "FTC rewrites rules on Big Tech mergers with aim to ease
               | monopoly-busting"
               | 
               | https://arstechnica.com/tech-policy/2023/07/ftc-rewrites-
               | rul...
               | 
               | "FTC prepares "the big one," a major lawsuit targeting
               | Amazon's core business"
               | 
               | https://arstechnica.com/tech-policy/2023/06/ftc-prepares-
               | the...
               | 
               | "The Federal Trade Commission sued Amazon today, claiming
               | the online giant violated US law by tricking consumers
               | into signing up for the $14.99-per-month Amazon Prime
               | subscription service and making it annoyingly difficult
               | to cancel."
               | 
               | https://arstechnica.com/tech-policy/2023/06/ftc-sues-
               | amazon-...
               | 
               | "FTC files to block Microsoft's $69B Activision Blizzard
               | acquisition"
               | 
               | https://arstechnica.com/gaming/2023/06/report-ftc-will-
               | file-...
               | 
               | "A Federal Trade Commission lawsuit filed yesterday
               | accused Ring, the home security camera company owned by
               | Amazon, of invading users' privacy"
               | 
               | https://arstechnica.com/tech-policy/2023/06/ftc-amazon-
               | ring-...
               | 
               | "Microsoft will pay $20 million to settle an FTC
               | complaint that its Xbox platform illegally collected and
               | retained information about children without their
               | parents' consent"
               | 
               | https://arstechnica.com/gaming/2023/06/xbox-coppa-
               | violations...
               | 
               | And that's all just from one news source, in the last
               | three months.
        
           | Mountain_Skies wrote:
           | How much of that involves the tech industry? Are you
           | seriously claiming that Silicon Valley and Donald Trump were
           | besties while the Democrats and tech hate each other?
        
             | coldpie wrote:
             | > How much of that involves the tech industry?
             | 
             | A lot. Here's a link where you can read about some recent
             | activity in the tech industry (change it to sort by Date, I
             | couldn't figure out how to do that in the URL):
             | https://arstechnica.com/search/?ie=UTF-8&q=ftc You can
             | probably find more on Google (or perhaps Duck Duck Go? :)
             | ).
        
           | soumyadeb wrote:
           | Citation? FTC against Google doesn't produce much results on
           | Google (kind of an irony :))
           | 
           | Have seen FTC going against Amazon because the FTC chair had
           | published prior work against Amazon's practices. Not
           | defending Amazon but FB/Google are a much bigger threat than
           | Amazon.
        
             | coldpie wrote:
             | Citation for what, increased anti-trust activity from the
             | FTC over the last two years? Sure, here's one article:
             | 
             | > Private equity deals and transactions in the healthcare
             | and technology sectors continue to attract heightened
             | antitrust scrutiny...
             | 
             | > The US agencies have also demonstrated an increased
             | interest in challenging vertical transactions.
             | 
             | > In January 2022, for example, the FTC sued to block
             | Lockheed Martin's US$4.4 billion proposed acquisition of
             | Aerojet, which the parties subsequently abandoned.
             | 
             | > Increased enforcement, combined with the agencies'
             | reluctance to approve remedies, has created an uncertain
             | environment where commercial parties should be increasingly
             | prepared to litigate mergers.
             | 
             | > The ramping up of antitrust enforcement in 2022...
             | 
             | https://www.whitecase.com/insight-our-thinking/us-ma-
             | fy-2022...
             | 
             | Here's another:
             | 
             | > Since 2020, the Federal Trade Commission (FTC) and U.S.
             | Department of Justice (DOJ) have filed multiple lawsuits
             | against major tech companies...
             | 
             | > "The agencies have started laying the foundations for a
             | more interventionist stance over the last two years, and
             | this year is when we'll start to see some of those efforts
             | come to fruition -- or be stopped in their tracks by the
             | courts," Kass said.
             | 
             | https://www.techtarget.com/searchcio/news/252528606/FTC-
             | push...
             | 
             | I'm sure you can find more.
        
               | kyrra wrote:
               | Except they keep losing cases. ex:
               | 
               | https://www.reuters.com/legal/us-appeals-court-opens-
               | docket-...
               | 
               | Or Judges fast-tracking lawsuits to allow those being
               | prosecuted by the FTC to get things over quicker, ex:
               | https://www.reuters.com/legal/illumina-wins-fast-track-
               | appea...
               | 
               | And I think the biggest blow may actually come about
               | because of the SEC lawsuit that will be heard this
               | upcoming term at SCOTUS:
               | https://www.reuters.com/legal/us-supreme-court-decide-
               | legali..., which will likely heavily reign in the power
               | of administrator judges and the ability for an agency to
               | keep initial fights in-house (blocking litigants from
               | taking fights to the normal courts).
        
               | coldpie wrote:
               | Yeah. You can't expect every swing to be a home run, but
               | you also miss every swing you don't take. My point is at
               | least they're _trying_ to do something now, unlike
               | previous decades. It will take some time and effort to
               | bring the agency back around to being effective after
               | decades of inactivity. That 's not going to happen if
               | future administrations put the FTC back on the bench.
        
               | soumyadeb wrote:
               | Citation for this statement.
               | 
               | >The FTC has been more active on anti-trust issues in the
               | past two years than at any time in the past 30
               | 
               | FTC being more active in past two years over previous 30
               | is a strong statement.
        
           | tomschlick wrote:
           | The FTC isn't going to do anything as Google/Alphabet is a
           | big donor to the Democrats.
           | 
           | https://www.opensecrets.org/orgs/alphabet-
           | inc/recipients?id=...
           | 
           | Here is them lobbying specifically around antitrust reform
           | legislation: https://www.opensecrets.org/federal-
           | lobbying/bills/specific_...
        
             | coldpie wrote:
             | So are Amazon:
             | 
             | https://www.opensecrets.org/orgs/amazon-
             | com/recipients?id=D0...
             | 
             | and Microsoft:
             | 
             | https://www.opensecrets.org/orgs/microsoft-
             | inc/recipients?id...
             | 
             | And yet we see high profile activity against them from the
             | current FTC.
        
               | [deleted]
        
               | burkaman wrote:
               | And Meta: https://www.opensecrets.org/orgs/meta/recipient
               | s?id=D0000335..., https://www.ftc.gov/legal-
               | library/browse/cases-proceedings/0...
               | 
               | And Intuit: https://www.opensecrets.org/orgs/intuit-
               | inc/recipients?id=D0..., https://www.ftc.gov/legal-
               | library/browse/cases-proceedings/1...
               | 
               | And Epic: https://www.opensecrets.org/orgs/epic-
               | systems/recipients?id=..., https://www.ftc.gov/legal-
               | library/browse/cases-proceedings/1...
               | 
               | etc. etc.
        
             | [deleted]
        
             | refulgentis wrote:
             | ? This is provably false. FTC filed 6 months ago.
             | 
             | https://www.nytimes.com/2023/01/24/technology/google-ads-
             | law...
             | 
             | n.b. I've found a lot of comfort by conciously rolling away
             | from any subject that leads me to do "They"-ing, i.e. name
             | an enormously large group, then talk about them as a unit.
             | The more I avoid it, the more I realize how prevalent it
             | became and drives how a lot of us feel society shifted.
        
               | TeeMassive wrote:
               | It's called saving appearances.
        
               | refulgentis wrote:
               | So your position is, they'll never do it, and if they
               | did, it's fake. Sounds like self-peasantization.
        
             | [deleted]
        
             | minsc_and_boo wrote:
             | You're right, but not because of politics.
             | 
             | FTC is on a losing streak, with the latest fiasco being the
             | Microsoft Activision acquisition fiasco.
        
             | weare138 wrote:
             | Republicans control the house. That's who would have to
             | pass any legislation. FTC is non-partisan.
        
         | pndy wrote:
         | That would be a desirable action but look what happen in the
         | end of 90s to Microsoft. It was about to be broken up and in
         | the very end it didn't. They become dormant and polite only to
         | strike back some 10 years ago with Windows 10, its telemetry,
         | ads and cloud services which are being pushed onto users
         | whether they like or not. And somehow, no regulators decided to
         | step in to clean up this company's behavior - everyone seems to
         | be ok with what MS is doing. Whether it's the US or EU. I take
         | that the business and lobbing goes extremely well in both
         | markets.
         | 
         | And because of this, I don't believe that the US is able to
         | break Google or the other flagship companies despite of reasons
         | existing for such action.
        
       | lagrange77 wrote:
       | SSLKEYLOGFILE still works for Chrome, right?
       | 
       | One way i could imagine to circumvent WEI would be to let WEI
       | enabled Chrome do it's thing, while proxying the decrypted HTTP
       | traffic to a free browser with plugins activated, potentially on
       | another machine.
        
       | bryanrasmussen wrote:
       | Can attestation of the browser be used as personally identifying
       | information? It obviously must be one more data point in
       | identifying the user?
        
       | jgaa wrote:
       | Just say no.
       | 
       | Ignore Google and educate your friends and family about the
       | alternatives. Make it your mission to save the Internet.
        
       | sproketboy wrote:
       | [dead]
        
       | whelchel wrote:
       | Could a core common library that Chromium depends on update its
       | license to block use in software that supports attestation,
       | roughly?
       | 
       | If Google wants more control and closure of the web, they
       | shouldn't benefit as easily from its current openness.
        
       | helen___keller wrote:
       | There's a saying, on the internet nobody knows you're a dog.
       | 
       | WEI is part of a broader movement to make this false - more
       | generally to make an internet where we know you are a human
       | staring at a screen
       | 
       | It turns out having dogs (or more commonly programs and scripts)
       | on the internet is not profitable and not good for business, so
       | corporations want to take dogs off their websites by finding
       | clever ways to attest that a real human with eyeballs is clicking
       | with hands and staring at ads.
       | 
       | Support dog rights. Don't allow for a WEI-dominated web.
        
         | EvanAnderson wrote:
         | The whole narrative about WEI "proving" you're a human is
         | completely false (and I'd argue a ruse). It only proves you're
         | using a sanctioned OS and browser binary. It does nothing to
         | stop robots being wired-up to devices w/ emulated inputs.
         | 
         | In fact, WEI will make it easier to use a robot w/ a sanctioned
         | software stack since, hey, it's a "human" per WEI.
        
           | helen___keller wrote:
           | WEI proposal leaves open the functionality of the attester,
           | so it's neither correct to say this will prove requests are
           | humans nor that it simply proves a sanctioned OS/browser.
           | 
           | The attester will attest whatever they want. They can evolve
           | to match the further degradation of user freedoms.
        
             | EvanAnderson wrote:
             | > The attester will attest whatever they want. They can
             | evolve to match the further degradation of user freedoms.
             | 
             | Agreed. Eventually the attestor will be measuring "proof of
             | life" with the camera, for example.
             | 
             | "Please drink verification can" isn't too far down that
             | road either.
        
               | derefr wrote:
               | > Agreed. Eventually the attestor will be measuring
               | "proof of life" with the camera, for example.
               | 
               | Ultimately, it's all just instructions being sent to your
               | computer to be executed, and "your computer" is whatever
               | you say it is. Everything (e.g. Intel SGX et al) can be
               | emulated in a sandbox. That's how modern DRM is defeated.
        
           | BizarroLand wrote:
           | WEI is about proving you're a human the way the Kid's Online
           | Safety Act is about protecting kids.
        
       | xyzal wrote:
       | I hope someone from the Pirate Party in the European Parliament
       | brings this threat into discussion there as soon as possible to
       | spread awareness.
        
       | mordae wrote:
       | Requiring remote attestation of devices not owned by the relying
       | party should be illegal unless it is a revocable opt-in and only
       | used to protect interests of the user, not service provider.
        
       | throw_m239339 wrote:
       | The web stopped being open when W3C accepted EME. Now that
       | effectively Google IS the web, they don't even have fake
       | attempting to convince anybody and will just turn the web into
       | another proprietary technology.
        
         | tzs wrote:
         | > The web stopped being open when W3C accepted EME
         | 
         | The web was more open when to play those videos you had to use
         | a proprietary Flash or Silverlight plugin?
        
           | throw_m239339 wrote:
           | > The web was more open when to play those videos you had to
           | use a proprietary Flash or Silverlight plugin?
           | 
           | That's what you are claiming with your sarcasm hidden behind
           | a rhetorical question, I've never said anything about Flash
           | or Silverlight in the comment you've answered to.
           | 
           | There is absolutely no difference from a conceptual
           | perspective between EME implementation and proprietary
           | plugins, EME is necessarily based on a proprietary spyware,
           | but you can't fathom that fact apparently.
        
             | tzs wrote:
             | You said the web stopped be open when EME was accepted.
             | 
             | But as you just noted there is no conceptual difference
             | between EME and the proprietary plugins that it replaced
             | (Flash based and Silverlight based video players).
             | 
             | So how does replacing something with something else that is
             | conceptually not different change that status of the web
             | from open to not open?
        
               | throw_m239339 wrote:
               | > You said the web stopped be open when EME was accepted.
               | 
               | Neither Flash or Silverlight were ever web standards.
               | Flash was never accepted as a web standard. EME is a web
               | standard.
               | 
               | EME is as bad as Flash or Silverlight from a conceptual
               | perspective. EME has no place in web standards, no more
               | than flash.
               | 
               | Again, it's you who brought up Flash and Co, I never
               | brought it up.
        
             | asadotzler wrote:
             | Flash wasn't just DRM though. Incorporating video and
             | animations into the web proper through browser was a win
             | for the web despite the bitter pill of not ridding
             | ourselves of DRM.
        
               | throw_m239339 wrote:
               | > Flash wasn't just DRM though. Incorporating video and
               | animations into the web proper through browser was a win
               | for the web despite the bitter pill of not ridding
               | ourselves of DRM.
               | 
               | DRM as implemented by EME is necessarily a closed source,
               | proprietary plugin just like Flash, I never said that
               | Flash was just a DRM. Flash could be used as DRM system,
               | in fact its video format FLV supported DRM.
        
       | nfw2 wrote:
       | I don't see how this will end the "free web." No publisher will
       | be forced to use DRM. Anyone can still create a website and make
       | it accessible to anyone for free with an internet connection.
       | 
       | If certain publishers want to require ads to view their content,
       | that seems like their prerogative.
        
         | alex_suzuki wrote:
         | Until Google Search starts punishing sites that don't require a
         | trusted execution environment...
        
       | SergeAx wrote:
       | Is there a technical explanation of what exactly is being pushed
       | here?
       | 
       | Web is an open protocol. It is okay for both browser and server
       | to support some third party extension, and Google owns 95% of
       | browsers. But how can it be forced onto all the servers?
        
       | chris_wot wrote:
       | Firefox accepted EME. Why are we all suddenly so surprised this
       | is the ultimate outcome?
        
       | ep103 wrote:
       | And also, to switch back to Firefox
        
         | unmole wrote:
         | And what happens when website owners decide supporting Firefox
         | is not worth it?
        
           | JeremyNT wrote:
           | The best time to switch back to Firefox was 10 years ago.
           | 
           | The second best time is today.
           | 
           | Maybe it's too late, maybe it's not, but it's literally the
           | only option we have if we want an open web.
           | 
           | At this point, anybody who runs Chromium is just enabling
           | Google and has become part of the problem.
        
           | ewgoforth wrote:
           | So many sites don't work correctly in Firefox. Chrome is the
           | new IE6.
        
             | XorNot wrote:
             | Such as? Everything I care about works fine. I've no idea
             | what people are referring to when they say sites don't.
        
               | rileymat2 wrote:
               | I have had a couple of banking websites, I want to say
               | wellsfargo corporate card login in, as well as video
               | conference sites.
        
             | mehdix wrote:
             | Firefox is my daily driver on all my computers and
             | smartphones. There are some hiccups, often with obscure
             | websites and airlines. Most of them better be avoided
             | anyways. However, Slack and Microsoft Teams don't function
             | properly in Firefox.
        
             | beowulfey wrote:
             | I use firefox for everything. The only site I know that
             | doesn't work is an internal app at my work that was written
             | in FileMaker pro. I just use Edge/Safari for that one.
        
             | fsniper wrote:
             | I use Firefox as a daily driver. And I never encounter
             | these sites. Perhaps we are not surfin on the same pages?
             | Do you have a list of these pages?
        
               | anonymous_sorry wrote:
               | I very occasionally run into these, and keep Chrome as a
               | backup browser. I suspect it's as often to do with
               | adblocking though - I have no content blockers on Chrome.
               | 
               | Firefox performs way better and is a more pleasant
               | experience. (This is a fair comparison because my ad-
               | laden Chrome experience is internet as Google intends!)
        
               | pzo wrote:
               | Is your firefox rendering google maps the same sharp
               | (vectorized) as in chromium? In my firefox it seems not
               | so sharp and rasterized (tiles?), but might be related to
               | some privacy plugins/settings I'm using.
        
               | fsniper wrote:
               | I didn't compare or realize that. So if you are right and
               | most probably you are, I suppose I am not that interested
               | in that sharpness.
        
           | worksonmine wrote:
           | I never have any real issues with Firefox, and when I do I
           | simply don't use that site. I have my girlfriend and mother
           | using Firefox as main browser on desktop and mobile, with
           | uBlock Origin and they've never complained.
           | 
           | I did have issues during an interview in Microsoft Teams
           | refusing to play my video. "Your browser is not supported",
           | yeah fuck you it's not supported. I explain why, ask if we
           | can switch to Hangouts and send a link.
           | 
           | Works fine, if more people had the balls to do the same we
           | wouldn't be in this situation today. It's our duty to educate
           | people instead of conforming to the path of least resistance.
        
           | gmerc wrote:
           | The same that happened to the ones who decided to stick with
           | powered by IE.
        
           | ricree wrote:
           | It would be much less likely if we could get the market share
           | back to 2010 levels.
           | 
           | Is that a realistic goal? I don't know, maybe not, but it
           | seems like there's little will even in tech to try.
           | 
           | There was a time when tech was the biggest driver of
           | alternate browser adoption, and even managed to make serious
           | inroads into the mainstream. It's a huge shame that this
           | attitude seems long gone.
        
             | KingOfCoders wrote:
             | (As someone writing this in FF, being a Mosaic/Netscape/FF
             | user for ~30 years)
             | 
             | No that ship has sailed.
             | 
             | It would mean focusing on developing the best browser and
             | spending money on marketing so people download and install
             | the best browser. Cut every other expense. Take FF from the
             | politics of Mozilla and make it a real open source project.
             | 
             | If I look at Opera marketing, they seem to aim for young
             | people with themes and video integration.
             | 
             | I do think FF has no vision and no clear strategy to get
             | back market share, even it this is the only way to save the
             | web. Perhaps market share isn't even their goal, I have no
             | clue what they want.
        
             | [deleted]
        
             | VancouverMan wrote:
             | > There was a time when tech was the biggest driver of
             | alternate browser adoption, and even managed to make
             | serious inroads into the mainstream. It's a huge shame that
             | this attitude seems long gone.
             | 
             | I think that was just a side effect of browsers like
             | Phoenix/Firebird/Firefox and Opera offering numerous
             | tangible benefits over IE and the other browsers of that
             | era.
             | 
             | They offered things like better functionality, better
             | security, better extensibility, better performance, better
             | ad blocking, and so on.
             | 
             | There were many compelling reasons to switch to them, and
             | many compelling reasons to suggest them to others.
             | 
             | I could easily show less-technical users how those browsers
             | could make their lives better in many ways.
             | 
             | For a while now, though, that just hasn't been the case.
             | Using Firefox today, for example, doesn't really leave most
             | people any better off, but it does come with its own set of
             | new problems. I can't bring myself to recommend it.
        
           | sn0wleppard wrote:
           | Then Firefox users decide visiting those websites is not
           | worth it
        
           | bee_rider wrote:
           | It will be annoying if bank sites and other companies that
           | are hard to avoid drop Firefox support (I mean I can switch
           | banks I guess but it is a long term customer relationship, I
           | don't really want to).
           | 
           | Most websites aren't bank websites. If a website doesn't
           | support Firefox, leave. If a website doesn't support good old
           | HTML, it is probably made by some kind of dummy who is trying
           | to replace lack of content with glitz, this sort of person
           | shouldn't be listened to.
        
         | johnnymorgan wrote:
         | You mean Brave
        
           | mdale wrote:
           | Brave runs on Chromium; I am sure if WEI helped some crypto
           | scheme for attention token it would be embraced there. But
           | not as relevant as this relates to the "on by default" nature
           | of these tools to validate web viewers.
        
         | FooBarBizBazz wrote:
         | Firefox' killer feature on mobile is that it supports uBlock
         | Origin, while Chrome doesn't. Browsing the web without it is
         | horrible -- the screen covered in popups with tiny Xes. There's
         | a decent fraction of the time that you can't even read the
         | content underneath. Firefox solves all that.
         | 
         | However.
         | 
         | Try opening any article from The Guardian on Firefox mobile.
         | Even a _good_ phone will start feeling sluggish and laggy and
         | weird. An old phone will just go catatonic, get hot, and OOM
         | the whole browser.
         | 
         | Surely this is partly The Guardian's fault. (Should it surprise
         | me that the paper that poses "left" for the upper middle class
         | is also incompatible with any but corporate software from Big
         | Tech?)
         | 
         | But it's also definitely Firefox' fault too. Something is wrong
         | with the implementation. If Chrome can render these sites
         | smoothly, Firefox should be able to.
         | 
         | Firefox would only have an excuse if Google had some special
         | APIs on Android, or were doing something to actively sabotage
         | the Firefox experience. I'm not willing to get quite that
         | paranoid yet.
         | 
         | There are some other browsers, but who the hell wrote them? How
         | much of what you see in the app store is legitimate open
         | source, and how much is OSS that some opportunist put their own
         | trackers into? I'd love a good alternative, but I don't see a
         | lot worth trusting.
         | 
         | So it's Firefox for most things, and Chrome when Firefox gets
         | all slow and laggy. Or, Firefox for news articles, and Chrome
         | for businesses' websites.
        
           | LegitShady wrote:
           | Firefox mobile on Android, ublock origin and darkreader
           | installed. No lag on guardian articles on a pixel 6a.
        
         | rollcat wrote:
         | Obligatory mention of WebKit/Safari.
        
         | mrAssHat wrote:
         | [flagged]
        
           | [deleted]
        
         | robertoandred wrote:
         | Unless you're already using Safari.
        
         | mhx1138 wrote:
         | Exactly. I use Firefox for everything. It renders all the pages
         | fine and is speedy enough so that I never question its
         | performance. But even if it had some issues, those were minor
         | compared to the danger the web is in now.
        
         | fsniper wrote:
         | I suppose this is more important.
         | 
         | When the usage metrics drop for Chrome based browsers they
         | would need to start respecting other users, instead of just
         | ignoring them.
         | 
         | Currently they can just ignore the users and continue as they
         | do. As the rest would not hint a dent on their bottom line.
        
         | dang wrote:
         | We detached this subthread from
         | https://news.ycombinator.com/item?id=36876504 since that thread
         | broke the site guidelines and this one didn't.
        
         | PedroBatista wrote:
         | Who has been mismanaged for at least a decade and depends on
         | Google to pay their bills..
         | 
         | I'm a FF user since the early 00's and Firefox will mostly not
         | go away because Google has an interest in using it against
         | monopoly accusations but the reality is bleak..
         | 
         | And the reality is these people ( Google in this case ) are so
         | far removed from any moral compass about the Web ( at least
         | what most people here think of "the Web" ) that it's near
         | impossible to do anything about it. These companies are huge
         | and from top to bottom there are certain groups that are hired
         | guns to do a job, no matter what "job" it is, they'll do it,
         | achieve those KPIs, get promoted, get paid. Even for their own
         | detriment in the future, it doesn't matter. Big money now,
         | screw the rest.
         | 
         | Btw, this is how every big company operated since forever, the
         | only "news" here is the disproportionate impact their acts do
         | to the World due to their huge size and influence.
        
           | ChatGTP wrote:
           | _Who has been mismanaged for at least a decade and depends on
           | Google to pay their bills.._
           | 
           | I don't see how this matters, it's an open source project, if
           | people find enough value, it will be forked and improved by
           | community or a new organization will form around it. This is
           | the beauty of open source, you must embrace.
        
           | viraptor wrote:
           | I'm not really seeing the dilemma here. Would you choose a
           | browser from a mismanaged organisation, or a browser from a
           | corp actively subverting the very basic idea of having a web
           | client you can control, which has a chance of forever
           | changing how we get to interact with businesses online? (In
           | likely the worst way possible)
           | 
           | Seriously, how is this a question? (Unless you want to go
           | with another independent option, then sure)
        
           | Renaud wrote:
           | None of that should prevent anyone from using Firefox. There
           | are no alternatives, nearly all other browsers are built on
           | Chromium.
           | 
           | Making FF more prominent will not give Google more power, it
           | will give Mozilla more power to negotiate better deals with
           | Google and Bing to become the default search engine, because
           | in the world of browsers, that's what pays the bills.
           | 
           | Giving more power to Mozilla hinges on them having a larger
           | user-base so their voice is heard on these technical issues.
           | 
           | I'm tired of people complaining about how much better they
           | could do "if only" this, or that FF was % slower on some
           | tasks 10 years ago.
           | 
           | Firefox is a better alternative. It's the only alternative,
           | and we can make more demand on its direction if we actually
           | use it.
           | 
           | It doesn't mean that we shouldn't hold Mozilla to higher
           | standards, but if we keep waiting for them to be perfect
           | before we will consider using and pushing FF, we're just
           | going to lose the only alternative not controlled by Google
           | or Microsoft.
           | 
           | It's Firefox here and now. There probably won't be a tomorrow
           | otherwise. Google is making that very clear.
        
             | lxgr wrote:
             | Exactly. Also, if some anecdata can help change a mind:
             | Firefox is a really good browser these days. I use it quite
             | heavily, and it hasn't disappointed in the last three or so
             | years since I switched from Chrome.
             | 
             | About the only use case I still need Chrome for is for
             | sites requiring experimental web APIs not supported by
             | Firefox, such as Web USB or Web Bluetooth. Site
             | compatibility for everything else, including very heavy web
             | apps, is just fine.
             | 
             | History sync is encrypted, which is what made me switch
             | over in the first place (Chrome deactivates history sync
             | when activating end-to-end encryption - go figure...)
        
               | rkangel wrote:
               | I switched to Firefox for the idealogical reasons above
               | and was pleasantly surprised to find that it was a net
               | improvement.
               | 
               | The _only_ site I have compatibility issues with on
               | desktop is MS Teams and even then it 's only for
               | voice/video calls, everything else works fine.
               | 
               | Firefox Android is a slightly less happy place. The
               | password manager doesn't work very well (am moving away
               | from the built-in one) and I can't log in on Amazon
               | (which is important because I can't buy Kindle books in
               | the app because of the Play Store).
        
               | FooBarBizBazz wrote:
               | Firefox Android OOMs whenever it sees an article from The
               | Guardian.
        
               | atq2119 wrote:
               | This is just more anecdata, but I'm exclusively using
               | Firefox on Android and have never had issues with The
               | Guardian. In fact, at this very moment there is a
               | Guardian article linked on the front page, and I've
               | visited it without an issue.
               | 
               | I don't doubt your experience, but it's clearly not
               | universal.
        
               | PawgerZ wrote:
               | Interesting. Firefox android works great for me, but
               | Firefox windows gets very slow on my machine. I don't use
               | their password manager on either, though, so I can't
               | attest to that.
        
               | JohnFen wrote:
               | > but Firefox windows gets very slow on my machine.
               | 
               | This is why I don't use FF (although I'm on Linux). It's
               | unusably slow for me. My experience is not the most
               | common one (indicating that there's something about my
               | ecosystem that FF hates), but I haven't been able to make
               | FF work in any of the releases starting a couple of years
               | back, I think.
               | 
               | I don't browse on my phone at all, so I won't be using FF
               | there purely for that reason.
        
               | teddyh wrote:
               | Is it _still_ slow for you? Have you tested it recently?
               | 
               | <https://news.ycombinator.com/item?id=35458746>
        
               | PawgerZ wrote:
               | Yes, it's still my default browser -- work and home. I
               | put up with it because I browse far more on my phone than
               | on my computer.
        
               | clemiclemen wrote:
               | [dead]
        
             | UtopiaPunk wrote:
             | In addition to just using Firefox, people can donate to the
             | Mozilla Foundation. I give a few bucks every month.
             | 
             | https://foundation.mozilla.org/en/who-we-are/
        
               | gkbrk wrote:
               | Almost none of that money goes to the development of
               | Firefox though.
        
               | BizarroLand wrote:
               | That which is claimed without evidence can be dismissed
               | without analysis.
        
               | saurik wrote:
               | The same thing can be said about the opposite stance you
               | are taking. The question is: do we already know things,
               | and how easy are the things we don't already know to look
               | up?
               | 
               | Regardless, I have Googled this for you: please return
               | the favor by helping others learn to use search engines
               | in the future before leaving comments insinuating that
               | they are lying.
               | 
               | The tldr (as you'll probably insist on that also) is that
               | Firefox finds Mozilla, not the other way around, as the
               | latter is a non-profit while the former is a FOR-profit,
               | so Mozilla actually can't directly fund Firefox.
               | 
               | https://www.reddit.com/r/firefox/comments/ow9k0y/is_there
               | _a_...
               | 
               | https://www.reddit.com/r/firefox/comments/a98gmi/donation
               | s_t...
               | 
               | https://news.ycombinator.com/item?id=24200395
        
               | asadotzler wrote:
               | Much of it goes to policy issues like this very one, and
               | to government education about these kinds of things, and
               | to other important efforts closely aligned with this
               | exact issue. Mozilla does both "advocacy" and "product"
               | and that two pronged fork exists to serve people and the
               | web, not massive ad companies.
        
           | bee_rider wrote:
           | I hear Firefox is mismanaged all the time, but it seems to be
           | a perfectly fine browser for the most part. I hear all about
           | sites that won't render in comments on this website, but they
           | must all be internal tools or something because I never
           | encounter them.
        
             | oxygen_crisis wrote:
             | I'm surprised not to see more love for Librewolf here on
             | HN.
             | 
             | It's just the latest Firefox release, recompiled without
             | all the Mozilla telemetry, and with all the settings
             | flipped to more secure/private defaults so all the tracking
             | features are opt-in instead of opt-out.
        
               | jwells89 wrote:
               | Honestly I think the name of the project might be
               | limiting its adoption. It's sometimes annoying for the
               | more technically inclined among us, but branding matters
               | a lot. You need a name that's snappy and memorable, which
               | "Librewolf" is not.
               | 
               | Firefox is actually a pretty good example of good
               | branding. It's short, rolls off the tongue, has pleasant
               | alliteration, and evokes mental imagery.
        
               | HeckFeck wrote:
               | I wonder how those 'use GNU IceCat' conversations went,
               | if they ever happened.
        
               | prox wrote:
               | Unfortunately on the whole techies are absolutely poor at
               | marketing, which is a skill all by itself.
        
               | replete wrote:
               | It's behind by some weeks on major, contributing new
               | features is difficult because most dev effort seems to be
               | on integrating upstream. It is a great easy path for the
               | less technical to 'more privacy', but pretty much if you
               | are a developer just harden it yourself IMO.
        
             | gamache wrote:
             | The Mozilla Foundation is arguably mismanaged. Firefox does
             | ok, but could go further if the Foundation invested more in
             | FF development and less on... other things.
        
             | wsgeorge wrote:
             | Some Google services I regularly depend on (like YouTube
             | and Google Meet) don't work as well on Firefox as they do
             | on Chrome, in ways that actually matter. Besides that I
             | think most websites work fine.
        
               | amjd wrote:
               | I haven't noticed any issues on YouTube after
               | subscribing. Before that it used to glitch once in a
               | while possibly to penalize the ad blocking. But that may
               | have been the behaviour in Chrome too for all I know.
               | 
               | Google Meet does have some key features missing on
               | Firefox such as blurring / changing video background.
        
               | MSFT_Edging wrote:
               | I believe google has intentionally made google maps near
               | unusable in firefox. It's been consistently working worse
               | and worse every year. I feel like about 8 years ago there
               | used to be parity between them.
        
               | prmoustache wrote:
               | I am using it regularly without issues on firefox so I am
               | not sure what you are talking about and definitely not in
               | the "unusable realm". Can you be more specific?
        
               | bee_rider wrote:
               | I think this example is weirdly informative to me.
               | 
               | I mostly use maps via an app (Apple or Google, they seem
               | to be the same for basic use). Usually if I'm using a
               | map, I'll be using it in my car for navigation, so
               | Firefox doesn't even come to mind.
               | 
               | I suspect, on top of the "maybe it is internal apps"
               | thing I mentioned at first, some of the really bad sites
               | are the really interactive ones, I probably just use the
               | app without even thinking of it.
        
               | MSFT_Edging wrote:
               | I like to explore maps a lot, and its simply better on a
               | full desktop screen compared to a phone.
               | 
               | So its a regular drag for me. If I really need to move
               | quick to find something, I'll begrudgingly open chrome.
        
               | timeon wrote:
               | I rarely use google maps so haven't noticed. Only thing I
               | really miss from OSM based services is street-view.
        
               | MSFT_Edging wrote:
               | Its really bad, it takes almost a minute for the site to
               | "stabilize", and even then, default text in the search
               | bar is overlaid with whatever you're typing, a good 30
               | seconds to load a destination.
               | 
               | A chrome browser on the same device has maps behave
               | almost instantaneously.
        
               | timeon wrote:
               | That really sounds like intentional.
        
               | kristiandupont wrote:
               | What's wrong with Youtube? I haven't noticed anything.
        
               | wsgeorge wrote:
               | TBF YouTube has gotten better (see sibling comment), but
               | Google Meet is really what matters here for me. There's
               | also offline mode in Google Docs, which I use regularly
               | because I'm not guaranteed a good-enough connection
               | wherever I go.
               | 
               | Firefox does some things better (like PiP video playback
               | on most websites, like YouTube!) but others are so poorly
               | done (like Profiles) compared to Chrome that it overall
               | makes Chrome my first choice browser.
        
               | mort96 wrote:
               | I never used Firefox profiles, but Firefox container tabs
               | work really well IMO. I much prefer them to Chrome's
               | profiles for managing work vs personal logins.
        
               | coffeefirst wrote:
               | Yes. Google uses chrome-only APIs in a few of its own
               | products and falls back not so gracefully.
               | 
               | Which sort of underscores the monopoly point. There's no
               | universal free/cheap alternative to Meet, further
               | entrenching Chromium.
        
               | notpushkin wrote:
               | How about Jitsi? https://meet.jit.si/
               | 
               | It's free and open source, works everywhere, has stuff
               | like background replacement, and doesn't require signup
               | at all.
        
               | FooBarBizBazz wrote:
               | Jitsi is super easy to use, and I still can't get older
               | people to use it. They just hear "Zoom" on CNN so they
               | think, "I'm supposed to use Zoom. Other things are
               | weird." So much behavior is just driven by anxiety and
               | habituation.
        
               | yjftsjthsd-h wrote:
               | Well Zoom also isn't Meet, so for the purposes of this
               | conversation that seems like an advantage actually?
        
             | MildRant wrote:
             | I sparingly run into sites that don't render properly on
             | Firefox but they do exist. As an example, Ticketmaster's
             | account page has problems on Firefox that I don't get on
             | Chromium.
        
               | bee_rider wrote:
               | Firefox is helping you, Ticketmaster is evil.
        
               | lxgr wrote:
               | Maybe so, but asking somebody to not go to shows of their
               | favorite bands anymore as a form of protest against
               | Ticketmaster and/or Google is a bit much. Unfortunately,
               | some venues seem to be Ticketmaster only at this point.
               | Sometimes you've got to choose your battles.
        
               | prmoustache wrote:
               | I never used ticketmaster and it is not a monopoly.
               | Choose the right company to sell you tickets.
        
               | lxgr wrote:
               | Surely you've been to shows at _every possible venue_ to
               | be able to extrapolate that bold of a claim from your
               | personal experience?
        
               | prmoustache wrote:
               | No but appart from festivals (which were not relying on
               | ticket master) I haven't seen tickets sold by only one
               | company. Usually there are different ones and also some
               | plain old in person in ticket office of department
               | stores.
        
               | MildRant wrote:
               | There are venues that are Ticketmaster specific because
               | Ticketmaster's parent company owns the venue and some
               | acts just use Ticketmaster because they are the most
               | popular ticketing service. If I want to go to UFC 292 for
               | example, I have to get my tickets through Ticketmaster.
               | UFC isn't using some service that shows up on indiehacker
        
               | yencabulator wrote:
               | Ticketmaster is the only company selling tickets to
               | several venues, there is no choice of who to buy from
               | available there.
               | 
               | The only choice is to boycott your favorite artist
               | because their record label made a deal with the wrong
               | company. That's too many layers of indirection, for many
               | fans.
        
               | martin8412 wrote:
               | Yes, because the ones who owns the venues also own
               | Ticketmaster.
               | 
               | Live Nation is the name.
        
               | everdrive wrote:
               | This is going to be a problem which compounds more as
               | Google gains more ground. "Oh, I love internet freedom,
               | but I really need to visit website X." As more and more
               | websites adopt Chrome's standards, Chrome will be the
               | only browser that works.
        
               | pzo wrote:
               | I have the same - not sure if its related to many privacy
               | plugins in my Firefox but e.g. google maps still doesn't
               | render as sharp as in Chromium browsers - seems like
               | using rasterized tiles.
        
             | xlix wrote:
             | I've been using FF as my default browser on desktop and
             | mobile for at least 4 years. I've had zero issues. In fact,
             | if I need to use their dev tools, I find them superior to
             | chrome. I don't understand the shade Mozilla gets thrown at
             | them.
        
           | gmerc wrote:
           | You're gonna have to swallow your pride and use the best
           | option here. If you are American you already have lifelong
           | training in this dynamic and you know if you don't, it just
           | gets so much worse.
        
           | prmoustache wrote:
           | > Who has been mismanaged for at least a decade
           | 
           | Do you think Google is better managed?
        
             | PedroBatista wrote:
             | One has a browser that has +60% market share, the other
             | went from ~55% to 3%.
             | 
             | One company dominates "the Web" and pulls these shenanigans
             | all every other year, the other one is totally dependent of
             | the former to pay their bills.
             | 
             | So yeah, Google has been better managed than Mozilla. That
             | doesn't invalidate Google's execs are a bunch of lizards on
             | the now common SV ego trip and screw up all the time, but
             | they can and ensure they can continue to do so, Mozilla is
             | not in the same position and part of blame must be
             | attributed to them.
        
           | ddq wrote:
           | Sad that the broader message of this post was ignored in
           | favor of "but you should use Firefox" replies.
        
       | cosmaioan wrote:
       | maybe it's their IE6 moment.
        
       | samcat116 wrote:
       | Can someone explain how its technically impossible to conform to
       | this spec using, for example some desktop linux distro and say
       | firefox? Is there really no OSS way to implement this? Secure
       | boot works today on linux (might not be the default happy path,
       | but that seems fixable). TPM apis are there no?
        
       | scott_joe wrote:
       | Can someone please explain what this actually is. Without the
       | poetry.
        
         | papruapap wrote:
         | ELI5: Server: Are you a real user capable of viewing ads?
         | Client: Hmmm, not sure. Server: 404
        
         | Alifatisk wrote:
         | This is about WEI, Web environment integrity. The article below
         | sums it up pretty good.
         | 
         | "The proposal suggests that websites should be able to request
         | an attestation from the browser about its "integrity". Such
         | attestations are to be provided by external agents, which -
         | presumably - examine the browser and its plugins, and issue an
         | approval only if those checks pass.
         | 
         | The attestation is sent back to the website, which can now
         | decide to deny service if the agent did not give approval." [1]
         | 
         | 1. https://interpeer.io/blog/2023/07/google-vs-the-open-web
         | 
         | In other words, websites can now force you to comply with their
         | shitty behaviour in order to allow you access, otherwise you
         | get denided access.
        
           | icoder wrote:
           | The way you put it, it's like a captcha (but stronger, and
           | with a high risk of unwanted side effects)?
        
       | guy98238710 wrote:
       | We are in post-efficiency era. Power is driving profits and
       | that's what companies compete for. Efficiency (value-to-cost
       | ratio) is now a technical detail, soon to be automated away by
       | AIs. The same is happening in politics - efficiency is a
       | technical detail delegated to civil servants while politicians
       | focus on power. The world is a small pond full of sharks so
       | hungry they eat each other.
        
       | insanitybit wrote:
       | I don't think that that's surprising. Isn't this how all proposed
       | features work? They can sit behind a flag for _years_ , but the
       | goal during a proposal is to ship first.
        
       | rchaud wrote:
       | Are there forks or earlier versions of Chromium browsers that can
       | be maintained separately without folding in these changes?
        
       | Roark66 wrote:
       | I realise all the negative effects if this starts becoming a
       | thing, but could someone explain how is it they propose to
       | technically enforce this "signed browser binary" requirement?
       | What's stopping me from writing my browser to submit false info?
       | Any encryption keys or hashes present in the "certified" binaries
       | can be extracted (the binary after all needs access to it to use
       | it, right?).
       | 
       | The only way this has a slightest chance of working is in
       | connection with trusted hardware. Microsoft has been trying hard
       | to push tpm on everyone and failed. What makes them think they'll
       | succeed?
        
         | eganist wrote:
         | Edge is based on Chromium now, has been for years. Wouldn't be
         | a leap to have TPM enforcement here too.
        
       | sspiff wrote:
       | Publishing an implementation of a proposed web specification is
       | how all web standards are created or evolve. The same thing
       | happens with WebGPU, WASM, and many before them. Usually with a
       | prefix (ms-, moz-, webkit-,...) and/or locked behind a config
       | setting before standardization.
       | 
       | What is different this time other than it being a feature that is
       | considered user-hostile?
       | 
       | That's not to say we shouldn't oppose this feature, I just
       | wouldn't be up in arms about an implementation existing.
        
         | drewbug01 wrote:
         | > That's not to say we shouldn't oppose this feature, I just
         | wouldn't be up in arms about an implementation existing.
         | 
         | People aren't up in arms about the process by which web
         | standards become accepted; they are up in arms about this
         | standard moving forward at all because of its dangerous
         | implications for the web and it's outright user-hostility.
        
       | idlewords wrote:
       | I'm surprised to see so many people in this thread saying "write
       | a strongly worded letter!" (or something along those lines), and
       | so few saying we need to build a better browser without this crap
       | in it, which has been the traditionally successful answer to
       | attempts to privatize the Web.
        
         | strix_varius wrote:
         | Before doing this, Google was careful to make it as difficult
         | as possible to build a replacement for Chrome. Apple struggles
         | to make Safari capable. Mozilla struggles to make Chrome-first
         | websites work in Firefox. Building a new browser is a Herculean
         | task.
         | 
         | Pragmatically, I'm hoping that a Chromium spinoff like Brave
         | (or Edge!? Could MS be the hero we need?) will turn the privacy
         | switches on, WEI off, and get enough market share to make WEI
         | infeasible.
        
         | Tao3300 wrote:
         | We already have one, and building a browser is a nightmare.
        
       | contravariant wrote:
       | Since this is basically just obfuscation shouldn't it be possible
       | to break it? Heck it's not even DRM so it doesn't fall under the
       | protection of the DMCA.
        
         | mindslight wrote:
         | No, not at all. Search "remote attestation" and "safetynet".
        
       | croes wrote:
       | Hey Google, how about removing that "feature" because of lack of
       | interest as with Jpeg XL?
        
       | stainablesteel wrote:
       | so in the case of a forced implementation of this, websites don't
       | actually need to adapt.
       | 
       | i think if people see websites constantly being broken in chrome,
       | instead they'll pick another browser, that's most people's first
       | instincts when a site doesn't work.
       | 
       | just a take i guess, will it divide the web in 2?
        
       | TheCaptain4815 wrote:
       | Biden really needs to fire/replace Lina Khan and Congress start
       | exerting pressure on big tech for actual monopolistic issues, not
       | just political targeting. Although to be honest, I don't really
       | trust the GOP/Dem house to bring up non-partisan issues which
       | makes the role of FTC head even more important.
        
       | meindnoch wrote:
       | Would any of the usual enthusiastic Google employees ("Googler
       | here...") chime in and defend this please?
        
       | __MatrixMan__ wrote:
       | Is anyone else working on alternatives to this web? We're going
       | to want something working before this one becomes a telescreen.
       | 
       | I'm thinking:
       | 
       | - content addressing, not server addressing (to better distribute
       | the hosting load)
       | 
       | - looser coupling between data itself and apps for viewing data
       | (to prevent aesthetics from being used as a heuristic for
       | trustworthiness)
       | 
       | - a native permissionless annotation protocol (p2p trust governs
       | whether annotations appear: if you see an ad, just revoke trust
       | in its author)
       | 
       | - no code execution needed for browsing, fancy features (i.e. the
       | kind of thing you actually need js for) stay optional
       | 
       | I'm curious what design goals other people think are relevant.
        
         | supazek wrote:
         | I've put barely any thought into it but I think a "localnet"
         | would be better. Your usage is entirely based on calculated
         | geoposition and the userbase is segmented into regions based on
         | user count. More than X0,000 users in any one region and it
         | splits to keep things small. This would be a limitation for
         | hosting content. If you want to send a message out to another
         | person in a different region you'd have to make a deliberate
         | effort to do so and it will be private such as a letter would
         | be.
         | 
         | Idk if that would achieve my goals and honestly I can't plainly
         | state what my goals are. All I know is I get tired of
         | privileged California snobs telling me how things should be in
         | my back 40
        
           | __MatrixMan__ wrote:
           | I've had similar thoughts. I've been sketching out a design
           | where you can tag data with a location (a restaurant menu,
           | say, which is only needed near the restaurant). Suppose the
           | data is being gossiped between mobile devices. Some process
           | which understands the user's past (and estimated future)
           | movements can decide when the data can be forgotten.
           | 
           | Plus--as I imagine it--users would be able to trust each
           | other in certain domains, so which fragments your device
           | hangs on to is going to depend on who you trust and what
           | you're interested in.
           | 
           | Hopefully, these combined would mean that whatever part of
           | the web is relevant to your location is also the part of it
           | that's already cached on your device or on a nearby one.
        
       | gmerc wrote:
       | Stop contributing to chromium. Fork it.
        
         | guerrilla wrote:
         | Stop using it altogether. Use Firefox and contribute to it.
        
       | makingstuffs wrote:
       | Is it just me or does this sound a lot like the DPOS solutions
       | offered by many scammy ponzis under the name of a
       | blockchain/cryptocurrency?
        
       | GenericDev wrote:
       | So fudging sick and tired of having to defend free and open
       | information.
        
       | devsda wrote:
       | There are many arguments against this but not many brought the
       | implications for search engines.
       | 
       | If websites implement this, it will effectively make building a
       | web search engine impossible for new entrants. The current
       | players can whitelist/attest their own clients while categorizing
       | every other scraping clients as bots.
       | 
       | If not for other reasons, I can't see how Google a search company
       | can be allowed to push something that can kill competition using
       | its market dominance in other areas like browsers.
        
         | justcool393 wrote:
         | > If not for other reasons, I can't see how Google a search
         | company can be allowed to push something that can kill
         | competition using its market dominance in other areas like
         | browsers.
         | 
         | Because antitrust has been dead for a while. Chrome is a tool
         | to drive people to Google and Google ads and nothing more.
         | 
         | I will say, I did appreciate Microsoft having a browser engine
         | with IE and Edge, even if the former was notoriously a pain, it
         | gave competition in the space. Unfortunately, that's not the
         | case anymore and everything is either Chrome (Blink), Firefox
         | (Gecko), or Safari (WebKit). And it's pretty clear what Chrome
         | has done once that have amassed a dominant market share.
         | 
         | I'm sure there are Googlers who think they're legitimately
         | making the web a safer place, but I think the real reason is
         | pretty clear if you take a birds eye view.
        
           | retrac wrote:
           | Unfortunately it seems that nearly all software platforms
           | with a dominant market share, end up degenerating to serve
           | only one purpose: to shove advertisements and subscriptions
           | onto you.
           | 
           | My mother's new Windows 11 laptop's out-of-the-box
           | configuration had me clicking through half a dozen things
           | attempting to manipulate me or her into spending more money.
           | There are (I can only assume paid-placement) news and
           | adfotainment in the start menu! Repeat pop-up reminders from
           | Lenovo to subscribe to their protection package. Emotionally-
           | manipulative reminders to subscribe to virus protection
           | services. To Microsoft Office. Etc. etc.
           | 
           | It's been the same thing in the mobile market, where the move
           | to "apps" means you are running their software on your device
           | all the time, so they can optimally surveil you, and target
           | the advertisements and behaviourally-modifying nudges. Quite
           | a few messaging services now actively mess with delivery of
           | notifications, spacing them out, delaying them, according to
           | research that shows what maximizes engagement.
           | 
           | I saw the trend 20 years ago and switched to free software
           | around that time -- I liked Linux anyway, but it was partly
           | on principle. Still, the new laptop was eye-opening. The
           | degree of intrusion, the degree to which even desktop
           | computers have turned into user-hostile advertising terminals
           | serving the purposes of their manufacturer, rather than a
           | computer for the user to accomplish their work, is quite
           | shocking.
           | 
           | Everything networked is becoming like that - twisting the
           | user's hardware, turning it into nothing more than a
           | terminal, an extension of the corporation, serving their
           | interests at all times. Even smart TVs now have ads built-in
           | to their menus and such.
        
             | mrguyorama wrote:
             | >to shove advertisements and subscriptions onto you.
             | 
             | There is no other end state in capitalism. If you want
             | tools and products that serve you instead of an owner, you
             | must do it outside capitalism like with truly open source
             | stuff.
        
           | [deleted]
        
         | derefr wrote:
         | > The current players can whitelist/attest their own clients
         | while categorizing every other scraping clients as bots.
         | 
         | Can't they already do this by having scrapers send plain-old
         | client certificates? Or even just a request header that
         | contains an HMAC of the URL with a shared secret?
         | 
         | Actually, taking a step further back: why does anyone need to
         | scrape _their own properties_? They can make up an arbitrary
         | backchannel to access that data -- just like the one Google
         | uses to populate YouTube results into SERPs. No need to provide
         | a usefully-scrapeable website at all.
        
         | dontreact wrote:
         | Is it possible for them to implement this API in such a way
         | that it will fail 5% of the time or so, making it impossible
         | for websites to deny individuals based on failing attestation?
         | 
         | https://github.com/RupertBenWiser/Web-Environment-Integrity/...
        
           | FireBeyond wrote:
           | ... until Google decides to dial that down to zero for
           | "experience", or Hulu / Netflix makes you
           | disable/whitelist/whatever to access their site.
        
             | dontreact wrote:
             | But as mentioned above, isn't doing so against Google's own
             | self interest? It seems like the project is explicitly
             | stating their goal isn't to allow for websites to do this,
             | and they are implementing it in a manner consistent with
             | that.
             | 
             | One thing about your comment above: Hulu can't start
             | implementing attestation until Google turns the knob to 0
             | because they can't start randomly dropping 5% of Chrome
             | users. So in your comment above it should be "and" not
             | "or". If I understand correctly Hulu cannot act
             | unilaterally with the currently planned implementation of
             | this.
             | 
             | If let's say they did turn the knob for Chrome, wouldn't it
             | take a while for websites to start implementing this? For
             | me not knowing as much about this it feels like this is a
             | step in an ambiguous direction which could be good or bad
             | still. But since it's Google everyone is thinking ahead in
             | the causal chain. Can you help me understand why this is
             | such a big and clearly bad step against the open web? Thank
             | you!
        
               | WorldMaker wrote:
               | I think Hulu is a great example.
               | 
               | Hulu has DRM issues in Firefox and their DRM just fails
               | with unknown errors on about ~15% of content they host
               | (anecdotally, of course, I have no specific data).
               | There's no way for me to tell if a specific episode of a
               | show will fail or not, some succeed, others don't. I at
               | least find no pattern for this. From this perspective,
               | they are essentially randomly breaking 100% of Firefox
               | users some seemingly random percentage of the time.
               | 
               | They have "good" business reasons to require this DRM and
               | whatever this random broken user percentage is, I'm sure
               | it meets their bottom-line criteria as a business.
               | 
               | "95%" uptime for Chrome users is only "one-9", but it's
               | still got that one 9. That's an acceptable SLA to many
               | businesses. A business might easily decide attestation is
               | worth that "uptime risk" because it sells more ads or
               | makes the DRM vendors happier (and thus the content
               | owners are happier) or any other number of "good"
               | business reasons.
        
           | smarx007 wrote:
           | Have you seen bank "login redirects" when the system
           | redirects you for ca. 5-10 times before actually letting you
           | in? This proposal could be defeated in the same way: after
           | successful authn, the user is redirected to the page
           | '/wei_chk_1', then '/wei_chk_2' and so on until
           | '/wei_chk_$n', e.g. 10 or WEI check success. If the WEI
           | Javascript check succeeded on at least one page, you are
           | logged in. Otherwise, get lost.
        
           | devsda wrote:
           | I cannot trust a known thief and let them into my house based
           | on their promise not to steal.
           | 
           | I have no way of knowing if they are honest or not and even
           | if they are there's no guarantee that they won't change their
           | mind later.I cannot take the risk and be on guard forever.
           | 
           | I would much prefer not to allow them into the house in the
           | first place.
           | 
           | Google should not have brought this proposal but they did.So,
           | I will not place my trust in Google doing the right thing
           | irrespective of their claims and promises.
        
           | acrispino wrote:
           | From the explainer:
           | 
           | > However, a holdback also has significant drawbacks. In our
           | use cases and capabilities survey, we have identified a
           | number of critical use cases for deterministic platform
           | integrity attestation. These use cases currently rely on
           | client fingerprinting. A deterministic but limited-entropy
           | attestation would obviate the need for invasive
           | fingerprinting here, and has the potential to usher in more
           | privacy-positive practices in the long-term.
           | 
           | I think any holdback will eventually go away because of the
           | "critical use cases for deterministic platform integrity
           | attestation"
        
           | lxgr wrote:
           | Why would they?
        
           | JohnFen wrote:
           | I don't see how that fixes the problem.
        
         | bilekas wrote:
         | > The current players can whitelist/attest their own clients
         | while categorizing every other scraping clients as bots.
         | 
         | I hadn't really considered this. In a roundabout way, is there
         | a process for this to be rejected on grounds of "fair use"
         | limitations?
        
         | ivanstojic wrote:
         | How would this work against scrapers that are based on driven
         | anpproved browser instances, eg. something like Selenium?
        
           | therein wrote:
           | The browser instance knows it is being driven by an
           | automation agent. If you so wanted, you can actually comment
           | out the code that does that in the browser's code but since
           | this new setup will enable the page to check if you compiled
           | your own browser, they'll be able to incorporate the
           | "isUnderAutomation" flag under the attestation data and
           | that's sealed because you can't build your own browser and
           | have it attest.
        
       | rekabis wrote:
       | Will there be any way to disable it within Chrome?
        
       | pluc wrote:
       | This is a crisis of our own making. You don't want Google taking
       | decisions for the web at large? Then don't let them own 85% of
       | the browser market share. When that's the case they don't need
       | W3C or anything to implement whatever they want, they effectively
       | control the client-side internet.
        
         | j1elo wrote:
         | It's proven that mass marketing works. Tell me how a minority
         | of informed and caring users can avoid on their own that a
         | single large scale bad actor pours millions over millions of
         | dollars to convince the uninformed masses about whatever they
         | want. It even happens in actual elections when some factions
         | use misinformation campaigns to alter the average voter's
         | perception! So not an easy task to solve without help.
        
           | pluc wrote:
           | Totally. In most things, you need to have the ability to
           | trust that users will make (or at least see) the right choice
           | even over multi-million marketing initiatives. Given today's
           | people and today's marketing, I'd say we're properly fucked.
        
           | Dalewyn wrote:
           | >Tell me how a minority of informed and caring users can
           | avoid on their own that a single large scale bad actor pours
           | millions over millions of dollars to convince the uninformed
           | masses about whatever they want.
           | 
           | Firefox.
           | 
           | No, not Firefox of today; I'm talking about Firefox 20 years
           | ago that defeated IE6 by sheer force of nerds alone.
           | 
           | Of course, the landscape is vastly different now and Firefox
           | today is about the most not-nerd thing next to Chrome. If
           | there's a a browser here to save us anywhere, I'm not seeing
           | it.
        
             | arp242 wrote:
             | > Firefox 20 years ago that defeated IE6 by sheer force of
             | nerds alone.
             | 
             | Firefox was significantly better than IE though: it was
             | faster, had more features, and things like that. _This_ is
             | what made Firefox popular, not  "sheer force of nerds".
             | 
             | Chrome, when released, also had some significant
             | improvements to Firefox. In particular, it was loads
             | faster. This changed with "Firefox Quantum" (59 IIRC), but
             | "too little, too late" I guess.
        
               | Dalewyn wrote:
               | Firefox was better than IE6, but it was the sheer force
               | of nerds that dragged it across the finish line because
               | neither the enterprise nor the general population
               | otherwise cared.
        
               | arp242 wrote:
               | What does that even mean? People used Firefox because it
               | was better. It's that simple. No one forced anyone to use
               | anything.
        
               | Gud wrote:
               | People used Firefox because it was installed on their
               | computers by the neighborhood nerd. Something similar
               | must happen now. People have to cease using gmail, google
               | search and google maps.
               | 
               | Alternatives need to be built and advertised.
        
               | asadotzler wrote:
               | People used Firefox because their nerd friend or family
               | member helped them download and install it. We got to 100
               | million downloads almost exclusively on word of mouth.
               | It's not enough to have a better product, people have to
               | learn about it and we did that with SpreadFirefox and
               | other efforts I helped initiate so I'm very familiar with
               | this. You don't have to trust my appeal to my own
               | authority here, but I doubt you've got anyone closer to
               | Firefox's early growth than me so maybe worth listening.
        
               | asadotzler wrote:
               | Firefox was not faster than IE. We lost on pageload, cold
               | and warm start, new window, pretty much everything.
               | 
               | Firefox was better because it had tabbed browsing,
               | integrated search, pop-up blocking, and extensions, but I
               | was responsible for monitoring our perf back then and I
               | can say for certain that we were not faster.
        
         | strix_varius wrote:
         | One of the things that led to Google's current dominance is
         | folks like us (certainly me, at least) pushing folks to replace
         | their default IE installation with Chrome as soon as they set
         | up a new computer.
         | 
         | I hope, pragmatically, something similar might happen with
         | this: say that Brave (my daily driver) disables WEI in their
         | Chromium build, and a new Chromium-derived browser surges in
         | popularity... like judo, using their own power against them.
        
           | TremendousJudge wrote:
           | What's wrong with Firefox?
        
       | krabmagnet wrote:
       | [dead]
        
       | Gud wrote:
       | How do we kill Google? They were great for 10 years - so so for
       | another 10 - but now they're outright hostile towards the free
       | internet and must be put down. So how do we do it?
        
       | encody wrote:
       | It's small, but here's a real actionable item that you can do to
       | help:
       | 
       | Put a gentle "Use Firefox" (or any other non-Chromium-based
       | browser) message on your website. It doesn't have to be in-your-
       | face, just something small.
       | 
       | I've taken my own advice and added it to my own website:
       | https://geeklaunch.io/
       | 
       | (It only appears on Chromium-based browsers.)
       | 
       | We can slowly turn the tide, little by little.
        
         | 0JzW wrote:
         | i find this comment a bit funny given that you use
         | googletagmanager on your website :)
        
           | encody wrote:
           | Sorry, comes default with Hugo (sort of). Set it up when I
           | was playing around with the website configuration and never
           | bothered to remove it. I don't use the analytics, so I will
           | delete. Thanks for pointing out.
           | 
           | note to self: hn is a great place to debug & review your site
        
         | gdtfmaster wrote:
         | Good suggestion, did that, thank you.
        
         | freedomben wrote:
         | I like this idea, but has Mozilla said anything about their
         | position in all of this? I'm a Firefox user, but I haven't felt
         | great about Mozilla in quite a while. I'd love to know they are
         | on the right side of this issue before I start promoting them
         | like this.
        
         | dcchambers wrote:
         | > It only appears on Chromium-based browsers.
         | 
         | Small anecdote: I am not sure how you're detecting the browser,
         | but this note still appears in Orion (webkit-based browser)
         | while it does not in Safari. Persists even when I change user
         | agent explicitly to Firefox or Safari.
        
           | encody wrote:
           | I check for the existence of `window.chrome`. I've never
           | heard of Orion browser before, but based on a brief glance at
           | their website, my guess is that because they allow running of
           | Chrome extensions, they are also replicating at least some
           | functionality provided by Chromium-based browsers, including
           | `window.chrome`.
           | 
           | Thanks for pointing this out, but I won't fix this.
        
         | mdibaiee wrote:
         | For people who want to put something like this, here is the
         | code snippet:                 <span id='browser'
         | class='hidden'>         This website is designed for <a
         | target="_blank" rel="noopener noreferrer"
         | href="https://firefox.com/">Firefox</a>, a web browser that
         | respects your privacy.       </span>            <script>
         | if (window.chrome) {
         | document.getElementById('browser').className = '';         }
         | </script>
         | 
         | Class .hidden must hide the element somehow, in this case I do:
         | .hidden { display: none; }
        
           | returningfory2 wrote:
           | Thanks for the code! I would slightly change the phrasing.
           | "This website is designed for X" is traditionally, in my
           | opinion, a user-hostile statement which indicates the user
           | has to do something to accommodate the website. "We recommend
           | you use Firefox, a web browser that respects your privacy" or
           | something doesn't have this vibe IMO.
        
           | zzo38computer wrote:
           | I would make a few changes:
           | 
           | 1. Instead of using CSS to hide it by default, make the
           | script to only add it (perhaps by document.write, or
           | alternatively by adding text to an empty <div> or <span>) if
           | Chrome is detected. (This way it will be compatible even if
           | CSS is disabled (or not implemented).)
           | 
           | 2. Instead of Firefox, mention something else such as Line
           | Mode Browser (it has some features I had not seen in other
           | web browsers, but which I think are good and would like to
           | have), or some other uncommon one which doesn't have Google
           | and Mozilla etc, or more than one.
        
         | varispeed wrote:
         | I don't think most people know the difference between Chrome or
         | Firefox and if they can still use websites they use with that
         | change, they just won't bother.
         | 
         | Even if you explain what is the difference, 99% they'll forget
         | the next day.
         | 
         | It's just pointless. With this kind of overreach, only
         | government intervention and regulation can help. Google is not
         | something you can go against with your proverbial wallet - they
         | are too big.
        
           | JohnFen wrote:
           | As Gandhi said, "Whatever you do will be insignificant, but
           | it is very important that you do it."
           | 
           | Historically, many people making "insignificant" actions over
           | time is the primary way that things have been improved.
        
           | toyg wrote:
           | Microsoft was the same, and still they were humbled into
           | opening the space for others (with the browser-choosing
           | screen at first boot). If people are noisy enough, lawmakers
           | can be distracted from their payola.
        
             | varispeed wrote:
             | That was in 2001. It wouldn't happen today - see Apple and
             | their walled garden.
        
               | toyg wrote:
               | Antitrust authorities in both US and EU are literally
               | fighting these monopolies _right now_ , with huge fines
               | and increasingly vicious inquiries. Don't be defeatist.
        
         | Cthulhu_ wrote:
         | The issue with that is that most people here will only have
         | their own website or product, which is already aimed at more
         | tech-savvy people, who will already have made a conscious
         | decision to use Firefox, Chrome, or whichever browser they
         | prefer.
         | 
         | But we / this site only represents a small percentage. 85%
         | market share means there are hundreds of millions, if not
         | billions of users that would have to switch to make any kind of
         | impact.
         | 
         | And you can't do that without being a very large company with
         | an operating system or the most popular search engine or other
         | ways to constantly tell people to use your browser, no matter
         | how good or privacy conscious or whatever your own is.
        
           | TremendousJudge wrote:
           | Most web developers don't use Firefox. Changing that would be
           | a huge step. Many things are developed for Chrome first by
           | inertia at this point.
        
           | toyg wrote:
           | "We" already waged a grassroot browser-war campaign in the
           | late '90s-early '00s, when Mozilla was born and eventually
           | birthed Firefox. It was successful enough to seriously dent
           | the Microsoft monopoly, creating the political conditions for
           | antitrust authorities to deliver significant hits to their
           | power.
           | 
           | It can be done again. Just drop the fucking Chromium bullshit
           | now.
        
             | jamiek88 wrote:
             | While I don't want to be defeatist the web was smaller
             | then, we had a common enemy in Microsoft that actively made
             | the web worse.
             | 
             | Google makes it better for ordinary people. Or at least
             | gives them that impression due to sites targeting chrome.
             | 
             | Firefox was an easy sell because it was just better for the
             | user and importantly the dev tools were a quantum leap
             | ahead.
             | 
             | The web was largely still made up of enthusiasts, very few
             | people doom scrolled all day via apps like they do now.
             | 
             | Any fight back that isn't mobile first is doomed.
             | 
             | And mobile first takes resources and taking on Apple and
             | Google at once.
        
               | toyg wrote:
               | _> While I don't want to be defeatist the web was smaller
               | then_
               | 
               | Yeah, but that also means that fines can be much bigger
               | now, and make bigger headlines - which is what politics
               | is about.
               | 
               |  _> Any fight back that isn't mobile first is doomed._
               | 
               | This is actually a prime chance to highlight that mobile
               | needs serious antitrust work.
               | 
               | Firefox on mobile exists, btw. Are you using it?
        
         | idlewords wrote:
         | This advice has strong 1998 vibes.
        
           | ChatGTP wrote:
           | Yes, put it right near the "Under Construction" gif.
        
           | empty_banana wrote:
           | I don't think seeing something like "Works best on Chrome" is
           | rare. Also blocking websites at all for other browsers than
           | Chrome.
        
           | Tao3300 wrote:
           | That's high praise.
        
           | afandian wrote:
           | It makes up for all of the "your browser is outdated" banners
           | I see when using Firefox.
        
           | encody wrote:
           | to be fair, WEI has strong 1984 vibes
        
       | intrasight wrote:
       | Isn't this easily "defeated" by the use of a web proxy? Won't
       | corporate web proxy software just replace the token with a
       | generic company token?
        
       | mo_42 wrote:
       | I think this is a somewhat natural consequence of Google being a
       | powerful corporation.
       | 
       | And, I don't think we (somewhat loosely defined group of people
       | who like free software and information and have a user-friendly
       | computing environment) can and should work against this.
       | Probably, we should give the corporate web some sandbox where
       | they can play their games, while we develop alternatives.
       | 
       | For example, Gemini is becoming more popular. People are talking
       | about search engines that exclude the corporate web and favor
       | personal websites. IPFS or just switching to FF again.
        
       | suslik wrote:
       | In the end, I feel like there is a silver lining to all this. As
       | the world wide web becomes more sanitised with their codes of
       | conduct, corporate censorship, ads, witch hunts, all these
       | limitations - more and more, I hope, would the valuable,
       | interesting bits of it drift to alternative locations.
       | 
       | The internets of old were just that - a place where nerds,
       | freaks, outcasts, and other antisocial personalities congregated.
       | Everything was permitted and everything was possible. Many,
       | myself included, hoped that it would change the world. It didn't
       | - the world is winning again, as everyone can clearly see. Still,
       | I hope that the normalisation of the web might as well create a
       | critical mass of those who just want something more than just a
       | corporate safe space.
       | 
       | I sincerely wish that there is a future where protocols like
       | gemini - stripped from all the visual noise and 'dynamic'
       | features - get a critical mass of useres. If that doesn't happen
       | - as someone who doesn't use any mainstream social media, google
       | and microsoft services, llms and other modern (and some might add
       | - dystopian) stuff - I don't really loose much. There are enough
       | great books for a hundred lifetimes, enough hikes to walk and
       | friends to get blasted with. Maybe it'd even be for the better.
        
         | OfSanguineFire wrote:
         | That colourful internet of yore coexisted with doing your
         | banking at a bank. Now, banking has largely moved online and
         | banks have eliminated a lot of their physical locations. Ditto
         | for accessing government services in many countries. The
         | concern here is no longer being able to do important everyday
         | things without using a supported browser, even if a small
         | hobbyist internet for nerds, freaks, and outcasts survived out
         | there.
        
       | rolph wrote:
       | How to Email to the President and Members of Congress
       | 
       | https://www.einvestigator.com/government-email-addresses/ [2022]
       | 
       | this abuse of tech, potentially goes beyond antitrust, and
       | damages global economic wellbeing, as well as impoverishing
       | information systems on global scale, generating isolation,
       | ignorance, division, and radicalization.
        
       | supriyo-biswas wrote:
       | Instead of simply flailing our collective arms around complaining
       | about an evil corporation, has anyone written to the respective
       | competition authorities (such as the FTC in the US or CCI in
       | India) about the potential anticompetitive effects of this
       | proposal?
        
       | thunkshift1 wrote:
       | Can someone pls explain what is happening and why this is bad
        
       | tolmasky wrote:
       | Mozilla should call for Google's removal from the W3C over this
       | implementation of Web Environment Integrity. "But Chrome has 65%
       | market share, what good is the W3C without them?" If Google can
       | take unilateral action to fundamentally change the basic
       | principles of the web, then the W3C is _already_ useless. This
       | will give Google a clear choice: if they want to maintain the
       | idea that the W3C matters, they should withdraw this
       | implementation.
       | 
       | It is unbelievable that over the course of 3 days, the potential
       | future of the web has been put in such dire straits. There's
       | already an existing, far less troubling (while still bad),
       | proposal in the form of Private Access Tokens going through a
       | standards committee that Google chose to ignore. They presented
       | this proposal in the shadiest way possible through a personal
       | GitHub account. They immediately shut down outside contribution
       | and comments. And despite the blowback they are already shoving a
       | full implementation into Chromium.
       | 
       | What we need is _real_ action, and this is the role Mozilla has
       | always presented itself as serving. A  "true" disinterested
       | defender of the ideals of the web. Now is the time to prove it.
       | Simply opposing this proposal isn't enough. This is about as
       | clear and basic an attack on what fundamentally differentiates
       | the web from every walled garden as possible. If someone drafted
       | a proposal to the W3C that stated that only existing browsers
       | should be allowed to render web pages, the correct response would
       | not be to "take the stance that you oppose that proposal," it
       | would be to seriously question whether the submitting party
       | should even participate in the group. Make no mistake, that is
       | what is happening now.
        
         | izacus wrote:
         | It didn't happen when Apple did it with Safari (and you all
         | were quiet as a mouse as well, with HN actively defending Apple
         | Safari monopoly with this feature enabled)... so why would NOW
         | be any different?
        
           | danShumway wrote:
           | > and you all were quiet as a mouse as well, with HN actively
           | defending Apple Safari monopoly with this feature enabled
           | 
           | Citation? To be sure, there was not universal outrage over
           | Safari's attestation implementation, but out of curiosity I
           | looked up the only thread I was aware of, in part because I
           | couldn't remember what my reaction was at the time. That
           | thread was a year ago and the overwhelming sentiment of the
           | comments section is critical:
           | https://news.ycombinator.com/item?id=31751203
           | 
           | Here were my comments at the time:
           | 
           | - https://news.ycombinator.com/item?id=31752980
           | 
           | - https://news.ycombinator.com/item?id=31753257
           | 
           | - https://news.ycombinator.com/item?id=31752431
           | 
           | They're less forceful than they are now with Google,
           | partially because I know more now about how attestation works
           | than I did over a year ago, and partially because (as some
           | people have also pointed out) Chrome's implementation is
           | straightforwardly more dangerous than Apple's is.
           | 
           | But HN "actively defending" Safari? That's not the impression
           | I get from the overall comment section and it's definitely
           | not what I personally was doing. There are a lot of people in
           | these comments calling Apple's implementation DRM. So I'm a
           | little skeptical of the "nobody on HN cared about this with
           | Safari" narrative that has sprung up; from what I can see
           | media coverage was fairly positive, but people on HN were
           | rightly critical. I'm not sure the facts match the narrative:
           | Safari was criticized for this.
           | 
           | It's a fair critique that there wasn't a coordinated attempt
           | to outright stop Apple, but I would once again remind
           | everyone that attestation in Chrome is _way_ more dangerous
           | than attestation in iOS. The market matters, that 's not
           | context that can be ignored. So it's not really all that
           | weird to me that people are more willing to react more
           | strongly to abusive behavior in Chrome.
        
           | tolmasky wrote:
           | I am not HN, you'll find no comment of mine defending that
           | (despite, for the record, Apple's system being less bad than
           | this one, while still bad).
           | 
           |  _NOW_ would be different because, again, this system is
           | _worse than Apple 's_, and because Chrome has a larger
           | influence on the web than Safari (on Desktop, on mobile its a
           | foregone conclusion since you're not allowed a different
           | engine other than Safari anyways, so the real fight there is
           | allowing third party engines).
           | 
           | Does this answer your concerns? I can't tell if you are
           | defending Apple and Google, or are against both but are using
           | this what-about-ist accusation as a way to vent general
           | frustration.
        
             | gunapologist99 wrote:
             | > for the record, Apple's system being less bad than this
             | one, while still bad
             | 
             | Apple's just more subtle than Google.
        
           | kykeonaut wrote:
           | I think the main difference is that Apple already controlled
           | what operating systems can run Safari via other mediums.
           | Adding this to Safari effectively changes nothing regarding
           | the web ecosystem on Apple devices.
        
           | toyg wrote:
           | Apple don't have enough web properties to force this sort of
           | change.
           | 
           | Google can turn around tomorrow and say that no browser
           | without WEI can access GMail, GMaps, GSheets, Photos etc;
           | people will have to comply, effectively killing any browser
           | that does not support the feature.
           | 
           | This is the problem with the Chromium monoculture. "We", as
           | generic IT people and developers on HN, definitely have a
           | responsibility for not deprecating this monoculture earlier.
           | If you use Brave, you're guilty; if you use Ungoogled
           | Chromium, you're guilty; if you use Safari, you're guilty.
           | It's high time people start taking responsibility.
        
             | pjmlp wrote:
             | And everyone that ships an Electron app as well.
        
             | db579 wrote:
             | Google can also decide at any time to put those web
             | properties behind forced logins, or paywalls or just
             | shutter them altogether. If Google doesn't want them to be
             | part of the open web they won't be, regardless of whether
             | this particular set of things is implemented or not. If
             | we're all dependent on them enough that that's a problem
             | for us, then that dependency is the problem.
        
               | toyg wrote:
               | _> If Google doesn 't want [Gmail etc] to be part of the
               | open web they won't be_
               | 
               | The point is not that Google cares about those sites -
               | they don't. Those services are _leverage_ that they use
               | to control web standards, in order to enable their real
               | cash-cow: _AdSense_. They will use their web properties
               | to shove down our throats anything that makes AdSense
               | more profitable, from the anti-adblock measures in Chrome
               | to this one.
               | 
               |  _> If we 're all dependent on them enough that that's a
               | problem for us, then that dependency is the problem_
               | 
               | I don't disagree - and I use Firefox, keep my important
               | mail outside of Gmail, etc etc. But I recognize that
               | many, many people don't, so the technologically literal
               | out there have an ethical responsibility to push back
               | against corruption of the open web.
        
             | neuralRiot wrote:
             | If they do that then otrer browsers will appear
        
             | meepmorp wrote:
             | How are Safari users part of the Chromium monoculture
             | problem?
        
               | smoldesu wrote:
               | It's part of the KHTML monoculture that has been harming
               | our industry and holding us back from real progress.
        
               | mschuster91 wrote:
               | If you want a browser engine it's either one of the KHTML
               | descendants or Firefox. The problem is, both are
               | ridiculously complex, only one family has the backing of
               | _three_ multi-billion dollar giants, and the other
               | infamously suffers from  "progressive disease" aka
               | complete unwillingness to move fast and instead
               | preferring to engineer the "perfect" solution.
               | 
               | That even _Microsoft_ couldn 't manage to keep up with
               | progress only shows how utterly impossible it would be to
               | kickstart a browser engine.
               | 
               | (The fact that Mozilla as an organization is embedded in
               | constant infighting and utter incompetence doesn't help
               | either)
        
               | meepmorp wrote:
               | That's kind of a stretch.
        
               | smoldesu wrote:
               | It's kinda hyperbole, to demonstrate how taut of a claim
               | "Chrome monoculture" is.
               | 
               | We had a shot at open browser engine development with
               | limited scope. _Everyone_ said no, not just Chrome.
               | Mozilla and Apple both have blood on their hands too, if
               | we want to be reductive.
        
               | toyg wrote:
               | They support another monopolistic player that would do
               | _exactly_ the same thing.
               | 
               | ... oh wait, they already did. They force a monoculture
               | on all the platforms they can get away with, and even
               | shipped this WEI crap already.
        
         | SoftTalker wrote:
         | > It is unbelievable that over the course of 3 days, the
         | potential future of the web has been put in such dire straits.
         | 
         | "Move fast and break things." How many here used to cheer this
         | approach?
        
         | rabite wrote:
         | Good luck getting anything from Mozilla, Google is their
         | largest source of revenue by far. Over half.
        
         | solardev wrote:
         | It's far, far too late for this. The W3C is already irrelevant,
         | not that it ever mattered much.
         | 
         | The internet is made by big companies. Not standards bodies.
         | The WHATWG has the actual living standards, and Google, Apple,
         | Cloudflare and Amazon make the actual software. Nobody cares
         | about the W3C. And Mozilla is long past dead.
        
           | sdeframond wrote:
           | > The internet is made by big companies. Not standards
           | bodies.
           | 
           | Yes. However said companies may want to avoid too much
           | scrutiny from governments.
           | 
           | As long as they can pretend the web is an open standard, they
           | are good. If Google were to leave the w3c, it would expose
           | them to antitrust laws and so on.
        
           | rekabis wrote:
           | > And Mozilla is long past dead.
           | 
           | I have been using Netscape/Mozilla, in terms of heritage,
           | ideology, and codebase, for almost a third of a century now.
           | 
           | I was there 30 years ago using NCSA Mosaic when it was first
           | released for the VMS Vax system. The only break of any kind I
           | had was with Opera as a secondary browser in the few short
           | years between Netscape 4 and Phoenix (original Firefox). And
           | I was _still_ using Netscape 6, just not exclusively.
           | 
           | They can tear Mozilla (or any one of its forked variants) out
           | of my cold, dead hands.
        
           | [deleted]
        
           | matkoniecz wrote:
           | > And Mozilla is long past dead.
           | 
           | Mozilla is far from healthy but calling it dead is
           | overstating things.
        
             | slig wrote:
             | Less than 5% of global usage [1], and no presence
             | whatsoever on mobile. Pretty much dead.
             | 
             | [1]: https://radar.cloudflare.com/adoption-and-usage And CF
             | stats doesn't depend on JavaScript.
        
               | ConorSheehan1 wrote:
               | I'm writing this on firefox for android. It has 100M+
               | downloads on the play store.
        
               | blitz_skull wrote:
               | Pretty sure download statistics don't reflect usage. And
               | are we even sure those are unique downloads?
               | 
               | At any rate, 100M downloads across the lifetime of the
               | app isn't much to write home about when considering the
               | billions (plural) that use Google products. Furthermore,
               | there's an entire class of people that think Chrome IS
               | the internet. It's wildly more common than the average HN
               | would think.
        
               | solardev wrote:
               | So does Opera...
        
               | matkoniecz wrote:
               | 4% of global browser usage can be described in many ways
               | (defeated, miserable, collapse compared to the past etc)
               | but it definitely is not dead and is one of few developed
               | browsers.
        
               | jamiek88 wrote:
               | For many years what is now macOS hovered around 3% usage.
               | 
               | The phoenix can rise.
               | 
               | The frozen chicken can not.
               | 
               | Still breathing makes a huge difference.
        
               | solardev wrote:
               | Maybe if they replaced top Mozilla leadership. Apple had
               | to reinvent itself back into relevance. Mozilla refuses
               | to, and just keeps stagnating in a cesspool of rot and
               | nostalgia. They're less a browser maker these days and
               | more an ineffective think tank. I think Google keeps them
               | around just as a "useful fool" so they can look less like
               | a monopoly...
               | 
               | Probably better for a different org with different
               | leadership to start over. I wouldn't count on Mozilla to
               | miraculously reinvent itself.
        
               | slig wrote:
               | There's no plan, no growth, they don't have a mobile OS,
               | and users will use whatever browser (aka, "the internet")
               | comes with their device. On Windows, Edge is being
               | heavily "promoted". Most of the technical people I know
               | gave up, unfortunately.
        
               | derefr wrote:
               | Corporate + institutional mass installs on Windows and
               | Linux -- e.g. university computer labs -- are still
               | mostly Firefox. It's easier to lock down something that's
               | not part of the OS; and it's easier to create a local-
               | network roaming-user-profile experience that's seamless
               | between the machines that must run Windows (regular labs)
               | and the machines that must run Linux (CompSci labs.)
        
               | solardev wrote:
               | If we're arguing about whether 4% global usage
               | constitutes dead, then yes, it's truly dead and Mozilla
               | is completely irrelevant. Even Microsoft is more
               | important these days (again).
        
               | nobody9999 wrote:
               | >If we're arguing about whether 4% global usage
               | constitutes dead, then yes, it's truly dead and Mozilla
               | is completely irrelevant. Even Microsoft is more
               | important these days (again).
               | 
               | According to these folks[0], Firefox has a 3.29% market
               | share globally. They also claim there are 4.66 billion
               | browser users globally.
               | 
               | If those numbers are correct, Firefox has a bit more than
               | 150,000,000 users worldwide.
               | 
               | If my software had 150,000,000 users, I'd consider that
               | _wildly successful_.
               | 
               | Other folks have different ideas/takes on that, I
               | suppose. But it's food for thought nonetheless.
               | 
               | [0] https://backlinko.com/browser-market-share#worldwide-
               | browser...
               | 
               | Edit: Fixed prose.
        
               | nequo wrote:
               | The difference between 0% and 5% is that at 0%, if you
               | want an alternative, you have to write it yourself, but
               | at 5%, the alternative exists. Mozilla is not dead.
               | 
               | If you don't like what Google is doing, don't pretend
               | that Firefox does not exist. Do something instead. File
               | bug reports, send patches, donate to those who are
               | working on Firefox and countering Google.
        
               | solardev wrote:
               | Frankly I trust Mozilla's governance even less than
               | Google's. They took an amazing product (Phoenix) and
               | mismanaged it into irrelevance.
               | 
               | If there were a good browser run by a different nonprofit
               | org, I would support that.
        
               | nequo wrote:
               | Even if you don't trust Mozilla, they cannot do what
               | Google is already doing. Mozilla doesn't have nearly
               | enough market power to force something like WEI down our
               | throats.
        
               | matkoniecz wrote:
               | > If we're arguing about whether 4% global usage
               | constitutes dead, then yes, it's truly dead
               | 
               | I am posting from maintained Mozilla Firefox.
               | 
               | That would be impossible if FF would be dead.
        
             | ascendantlogic wrote:
             | Mozilla is dead as a doornail. Google succeeded where
             | Microsoft did not, they essentially control the entire web
             | now.
        
               | Rapzid wrote:
               | Yep, Firefox should have allowed styling their
               | scrollbars. Nobody wants those ugly ass scrollbars in
               | their apps.
        
               | redavni wrote:
               | San Francisco salaries and the removal of Brendan Eich is
               | what happened to Mozilla not Google and Microsoft.
        
               | slig wrote:
               | They get paid half a billion a year from Google, so
               | thanks to Google things are like this. There's no
               | incentive whatsoever to beat who pays them.
        
               | solardev wrote:
               | There's an active incentive NOT to disrupt that
               | relationship.
        
               | Kye wrote:
               | Firefox's market share was in freefall long before
               | Brendan Eich left.
        
               | nordsieck wrote:
               | > Google succeeded where Microsoft did not
               | 
               | Microsoft wasn't trying to control the web; they were
               | trying to hobble it so that everyone kept on developing
               | for win32. In retrospect, not a great strategy, but many
               | companies try to kick the can down the road, and it often
               | works, so I can't fault them too much.
        
               | wongarsu wrote:
               | Of course large companies are always a bit schizophrenic
               | with different departments moving in different
               | directions, but I think fundamentally 1995-2000's
               | Microsoft was trying to improve the web, and get people
               | to use it. Just as Google does now they tried to blur the
               | line between desktop and web, just that where Google is
               | trying to move all desktop functionality to the web
               | interface, Microsoft was trying to make all web
               | functionality accessible in a desktop interface.
               | 
               | Explorer and Internet Explorer were deeply married, with
               | the ability to set web pages as desktop background, the
               | Explorer of Windows 98 having a "sidebar" that was an
               | HTML page, the ubiquitous help format being compressed
               | HTML pages with index and search, ActiveX giving webpages
               | desktop-application-like powers, JScript being a powerful
               | javascript-compatible automation language for Windows.
               | Windows was full of web technologies in the dot-com era,
               | many bringing web and desktop closer together. This
               | stopped an reversed course in the early 2000s. You could
               | now say that's classic embrace-extend-extinguish, but the
               | collapse of the dot-com bubble explains explains the
               | sudden lack of investment and increasing distance between
               | desktop and web just as well.
        
               | mlyle wrote:
               | Eh-- I think that 2-3 years of breathing room they
               | bought-- and killing Netscape's "the browser is the
               | operating system" dreams-- was probably worthwhile from
               | their point of view.
        
             | solardev wrote:
             | It's only alive in the same sense that a zombie is...
             | constantly moaning and groaning while begging for brains,
             | shambling aimlessly along waiting to be put out of its
             | misery
        
               | oskarw85 wrote:
               | Spelling such nonsense makes you feel better over your
               | own insecurities?
        
             | gunapologist99 wrote:
             | Mozilla is on life support. Not quite dead. Perhaps in a
             | coma.
        
               | numpad0 wrote:
               | >85% funded by Google Search revenue share. Wheelchaired
               | around unconscious.
        
           | Eduard wrote:
           | > The W3C is already irrelevant, not that it ever mattered
           | much.
           | 
           | This sounds myopic, or what do you mean? W3C is not only
           | about HTML and CSS innovation, but is responsible for and/or
           | involved in a diverse set of relevant standards -- many of
           | which "big companies" don't show as much interest in
           | contributing to.
           | 
           | https://en.m.wikipedia.org/wiki/World_Wide_Web_Consortium#St.
           | ..
        
             | Analemma_ wrote:
             | WHATWG (meaning, the browser vendors) are the de facto
             | actual decision-makers of web standards. They tolerate the
             | W3C existing because it's less hassle than causing a big
             | fuss by getting rid of it, but make no mistake: the W3C is
             | a powerless figurehead organization.
        
             | solardev wrote:
             | How many of those are actually relevant?
             | 
             | The DOM is largely abstracted over by JS frameworks and
             | component libraries.
             | 
             | XML, XPath, XHTML, SOAP, etc gave way to haphazard JSON
             | that's easier to use.
             | 
             | JSON-LD is a tiny niche and mostly unknown.
             | 
             | SVG is used only trivially as a PNG replacement or for
             | vector graphics interchange, while Canvas is more common
             | whenever performance matters.
             | 
             | Aria is mostly an afterthought, put in at the last minute
             | with alt tags and roles on random elements.
             | 
             | Maybe MathML is still used on Wikipedia?
             | 
             | Can't comment on the other ones I've never heard of, but
             | the web ones all seem either dead or niche.
             | 
             | I think this illustrates what I meant by irrelevance. It's
             | not that they make bad standards or have bad ideas, it's
             | just that companies have always preferred their own
             | implementations of these ideas rather than some standard.
             | Over the last two decades, the W3C has been at times a
             | strong suggestion, at times a weak consideration, but never
             | an actual standard. It was always the big tech companies
             | making the actual standards. We were lucky when a W3C spec
             | actually reflected real world implementations.
             | 
             | And this isn't just my opinion... the WHATWG was created
             | specifically to bypass the W3C on purpose.
        
         | ffgghjjjj wrote:
         | [flagged]
        
         | easyThrowaway wrote:
         | Quite frankly, the W3C stopped having any say on the matter
         | when the WHATWG supplanted the XHTML standard with the HTML5
         | committee.
         | 
         | They had enough weight at the time to say "The Web is XHTML2,
         | you can make your own internet if you want " compared to what
         | they can bargain for these days.
         | 
         | Maybe at the time it was a somewhat reasonable decision to
         | abdicate their responsibility over to big internet companies,
         | but that's what brought us to the current state where we're
         | basically going back to original version of The Microsoft
         | Network[1].
         | 
         | [1]http://www.codersnotes.com/notes/the-microsoft-network/
        
         | tzs wrote:
         | > If Google can take unilateral action to fundamentally change
         | the basic principles of the web, then the W3C is already
         | useless. This will give Google a clear choice: if they want to
         | maintain the idea that the W3C matters, they should withdraw
         | this implementation.
         | 
         | It's pretty generally accepted that the correct way to do web
         | standardization is for proponents of some new thing to
         | implement that thing and deploy it and then once it has been
         | shown to actually work bring a spec to the the standards folks
         | for standardization.
         | 
         | That usually works fairly well, although sometimes if that
         | first pre-standard implementation does too well the original
         | implementor may have trouble replacing theirs with something
         | that follows whatever standard is eventually approved, because
         | there are often significant changes made during the
         | standardization process.
         | 
         | An example of that would be CSS grid layout. That was a
         | Microsoft addition to IE 10, behind a vendor prefix of -ms-.
         | Nearly everyone else liked it and it was standardized but with
         | enough differences from Microsoft's original that you couldn't
         | just remove the -ms- prefixes from your CSS and have it work
         | great with the now standard CSS grid.
         | 
         | It was 4.5 years between the time Microsoft first deployed it
         | in IE 10 and it appearing in other browsers by default (Chrome
         | had it within a year of Microsoft, and Firefox had it about two
         | years after that, but both as an experimental feature the user
         | had the specifically enable). In that 4.5 years enough sites
         | that only cared about IE were using the -ms- form that
         | Microsoft ended up stuck with that on IE 10 and 11 instead of
         | the standard.
        
           | troupo wrote:
           | > It's pretty generally accepted that the correct way to do
           | web standardization is for proponents of some new thing to
           | implement that thing and deploy it and then once it has been
           | shown to actually work bring a spec to the the standards
           | folks for standardization.
           | 
           | - Behind dev flags
           | 
           | - And then wait for consensus
           | 
           | - And then there have to be at least two independent
           | implementations
           | 
           | And only then does this become a standard.
           | 
           | Chrome doesn't care. They create a semblance of the spec,
           | create a semblance of a discussion, and then enable it APIs
           | in Chrome. And then pretend it's a standard.
        
             | joshuamorton wrote:
             | This links to the chromium repo where it _is_ behind a dev
             | flag.
        
               | troupo wrote:
               | They do origin trials (behind flags) for all new
               | features. They still release a bunch of them later
               | without any consensus etc.
        
             | derefr wrote:
             | How is a company that runs a public website supposed to
             | A/B-test marginal attach rates for a feature hidden behind
             | a dev flag?
        
               | troupo wrote:
               | A feature behind a flag in a browser isn't for the public
               | web sites. It's for devs (web devs and browser devs) to
               | figure out if the feature works, if an API is ergonomic,
               | the various edge cases etc.
        
           | deelowe wrote:
           | Basically, the ask for forgiveness approach. It's common in
           | large, dysfunctional organizations as well. Sometimes the
           | easiest way to get attention is to break things. Then once
           | enough pain is felt, everyone starts taking interest. Trying
           | to follow a proper change control based process only works
           | when everyone is invested in the process.
        
             | derefr wrote:
             | No, this is just "doing your own thing in a way that
             | doesn't affect anyone else, and allows you to gather data
             | to cite when designing the standard."
        
               | troupo wrote:
               | In the browsers anything that's not behind a flag is
               | immediately relied on by people.
               | 
               | So no, you shouldn't ask for forgiveness and pretend that
               | you're just gathering data.
               | 
               | That's why what Google is routinely doing now (releasing
               | APIs after a very short period in origin trial and
               | without ever reaching consensus) is so dangerous.
        
         | MildRant wrote:
         | There is no chance Mozilla does anything that actually matters
         | here. They may do some virtue signaling and put out a statement
         | about how they support the open web but nothing more.
        
           | [deleted]
        
       | A4ET8a8uTh0 wrote:
       | Can you give me an idea as to why WEI is a bad idea for the web?
       | Granted, it is morning, but as I am going through the notes
       | linked ( https://googlechrome.github.io/OriginTrials/developer-
       | guide.... ), I am not sure I understand why it is that bad.
        
         | shadowgovt wrote:
         | As a general rule of thumb, web technology has traditionally
         | separated the content and protocol from the browser ("user
         | agent") in terms of concerns. By which I mean, a user agent
         | needs to be able to handle any possible input without breaking,
         | and a web server needs to be able to handle any possible
         | request without breaking.
         | 
         | WEI tries to shortcut that process by creating a secured sign-
         | off system that would allow the server to only respond to
         | queries from a blessed hardware and software configuration.
         | This wildly constrains the user agents that would be possible.
         | The pro for web developers is that they wouldn't have to
         | concern themselves with whether their server or the HTML they
         | are. Emitting is broadly standards compliant and compatible;
         | they can just make sure it works with the target platforms they
         | care about and rest easy knowing no other platforms can touch
         | their system. But this is bad for anybody who, for whatever
         | reason, can't use the blessed platforms (user agent and
         | hardware combinations).
         | 
         | Immediate practical consequences are that a lot of the screen
         | reader solutions people use would probably break (because the
         | screen readers wouldn't be certified user agents), a lot of
         | clever hacks would be far less feasible (the website somebody
         | hacked together to track whether the ice cream machine was
         | broken at McDonald's restaurants relied upon being able to
         | pretend it was the McDonald's smartphone app well enough to
         | attempt to put ice cream in the shopping bag), and it would
         | basically become impossible to build a new browser or operating
         | system from scratch compatible with the web (they wouldn't work
         | with the websites people wanted to use because they wouldn't be
         | certified as authentic on any of those sites).
         | 
         | This proposal grossly changes the balance of power on how the
         | web works and places most of it in the hands of the incumbent
         | browser and computer hardware vendors.
        
           | A4ET8a8uTh0 wrote:
           | Thank you. I can see why there is a pushback for it and also
           | why Google would want to make it a standard. It has a feel of
           | systemd to it ( making things easy enough that if it does
           | manage to become a standard, people will likely accept it en
           | masse )
        
         | hot_gril wrote:
         | Basically aims to make desktop browsers work like non-
         | jailbroken iPhones: locked down and outside the user's control,
         | for better and worse. You could also compare it to client-side
         | anticheat in PC games.
        
       | rdevsrex wrote:
       | I wish Google would solve real developer pain points like having
       | secure client side storage. That would be useful to developers.
       | But heaven forbid they take a break for a moment from trying to
       | squeeze every ounce of profit out of their users.
        
         | nfw2 wrote:
         | In order to have secure client-side storage, it seems like you
         | would need to be able to verify that the client-side
         | application that is accessing it is unmodified -- which is what
         | WEI would allow for.
        
       | knaik94 wrote:
       | Since Google controls the implementation and the featureset of
       | this API, they are effectively controlling the entire chain of
       | access.
       | 
       | Having open source implementions does not make a difference,
       | because a Google, or implementing website, server will control
       | whether the content is served. Having the mechanism of access
       | open sourced makes no difference in this situation.
       | 
       | It is the same situation with the "latent" passkey attestation
       | mechanism. Apple and Google have general guidelines that the
       | feature will not be used, but that only true currently. This
       | should not be part of the browser for the same as with passkeys,
       | it gives corporations final say in what you are allowed to use.
        
       | [deleted]
        
       | doliveira wrote:
       | I was watching a video about nesting in CSS and how it's just in
       | Chrome and comments were all about how cool it is and how they
       | can't wait to use it, and so on, and so forth. I think it's quite
       | a representative example: we can do that much better with SASS
       | today, but I guess Google needs to keep features pushing at full
       | speed so no one else can keep up.
       | 
       | We developers are so gullible. Just give us some shiny things and
       | we don't even realize they're heating up the pan.
        
         | JimDabell wrote:
         | > I was watching a video about nesting in CSS and how it's just
         | in Chrome
         | 
         | Nested CSS is supported in the latest version of all major
         | browsers.
         | 
         | https://caniuse.com/css-nesting
        
           | Izkata wrote:
           | It will be supported in Firefox 117, the latest release is
           | 115 and needs you to manually enable a feature flag.
           | 
           | The center row of versions with the gold border is how
           | caniuse indicates the current release.
        
             | JimDabell wrote:
             | Thanks for the correction!
             | 
             | I hovered over the green box for Firefox 117 and it said
             | "Released". I see now that for browser versions that have
             | actually been released, it says "Released <release date>"
             | and it's just a very misleading bug because all unreleased
             | browser versions will just say "Released".
        
           | doliveira wrote:
           | That's not the point...
        
       | londons_explore wrote:
       | One of the proposals for WEI is to make it probabilistically
       | fail.
       | 
       | Ie. on a given device, for 10% of websites, WEI pretends to be
       | unsupported.
       | 
       | That means websites can't deny service where WEI is unsupported.
       | Yet it still allows statistical analysis across bulk user
       | accounts.
       | 
       | If WEI was implemented like this, I would support it as being
       | good for the web ecosystem.
        
         | phpnode wrote:
         | This is the bait to make it sound reasonable. Of course this
         | hold-back feature will be quietly disabled at some point in the
         | future. The whole proposal is full of weaselly half truths and
         | misrepresentation about their real plans
        
           | londons_explore wrote:
           | > this hold-back feature will be quietly disabled at some
           | point in the future.
           | 
           | Will it though? Googles main reason for WEI I assume is to
           | combat ad-fraud. Ie. to prevent someone making a bot farm to
           | click ads to earn money from advertising or exhaust
           | competitors ad budgets or manipulate search engine user
           | ranking signals.
           | 
           | With WEI, all ad clicks without WEI could just be ignored
           | (ie. not billed to advertisers, ignored when calculating
           | statistics and signals). If 10% of clients have WEI
           | 'cloaking', you just inflate the final advertising bill by
           | 10% to account for those users - the end result is the same
           | as billing for all real users and no bots.
           | 
           | WEI still achieves all of Googles goals even with cloaking.
        
             | phpnode wrote:
             | As the middle man Google benefits from ad-fraud and has few
             | incentives to really stop it. Ad-blocking is a real problem
             | for them however, and they have huge incentives to prevent
             | that. Ignore what they say - that's what WEI is actually
             | about.
        
               | londons_explore wrote:
               | Googles main business is ads on google search. Here they
               | aren't a middle man.
               | 
               | Companies give google $X, and hopefully sell Y extra
               | products. X/Y is the cost per sale. Google competes with
               | other advert forms (eg. TV/radio/newspaper ads) on that
               | X/Y number.
               | 
               | If there is ad fraud, that Y number gets decreased
               | (budget is used up on fraud that doesn't translate to
               | sales), and their revenue decreases as advertisers spend
               | their ad budget on other mediums.
        
             | nobody9999 wrote:
             | >Will it though? Googles main reason for WEI I assume is to
             | combat ad-fraud. Ie. to prevent someone making a bot farm
             | to click ads to earn money from advertising or exhaust
             | competitors ad budgets or manipulate search engine user
             | ranking signals.
             | 
             | Right. And so I ask this question: Why should _I_ be forced
             | to _donate_ my data, CPU cycles, network bandwidth and
             | privacy to one of the largest corporations in the world so
             | they can address an issue (ad fraud) between them and their
             | customers?
             | 
             | I'd note that I am not a customer of Google or their
             | advertisers. Because advertisers are the only real
             | customers of Google.
             | 
             | Edit: Clarified my point.
        
         | wzdd wrote:
         | The attitude from Google towards this has changed significantly
         | over the last few days (unsurprisingly).
         | 
         | From the "explainer": "we are evaluating whether attestation
         | signals must sometimes be held back [...] However, a holdback
         | also has significant drawbacks [...] a deterministic but
         | limited-entropy attestation [i.e. no holdback] would obviate
         | the need for invasive fingerprinting".
         | 
         | From the Google worker's most recent comment on the issue: 'WEI
         | prevents ecosystem lock-in through hold-backs [...] This is
         | designed to prevent WEI from becoming "DRM for the web"'
         | 
         | So, in other words, WEI could be used to prevent
         | fingerprinting, but won't be able to if holdback is introduced
         | -- 5-10% of clients would still get fingerprinted.
         | 
         | Looking at the list of "scenarios where users depend on client
         | trust", all of them would be impacted by a holdback mechanism:
         | 
         | - Preventing ad fraud: not for the holdback group
         | 
         | - Bot and sockpuppet accounts on social media: not for the
         | holdback group
         | 
         | - Preventing cheating in games: not for the holdback group --
         | and thus not for anyone playing against someone in the holdback
         | group
         | 
         | - Preventing malicious software that imitates a banking app:
         | not for the holdback group
         | 
         | In other words, if there was holdback, WEI would require places
         | which currently fingerprint to retain and maintain the
         | fingerprinting code and apply it to fewer users, in the best
         | case, or would be completely useless in the worst case (for
         | things like games).
         | 
         | However, it's also quite interesting to look at the
         | implications of successfully attesting a browser which supports
         | arbitrary extensions:
         | 
         | - Preventing ad fraud: install an automation extension
         | 
         | - Bot and sockpuppet accounts: as above
         | 
         | - Cheating in games: install an extension which allows cheating
         | 
         | - Malicious software which imitates a banking app: a malicious
         | browser extension could do this easily.
         | 
         | In other words, unless you attest the browser _with its
         | extensions_ , none of the trust scenarios outlined in the
         | explainer are actually helped by WEI. It's not obvious whether
         | the Google employee who wrote this deliberately didn't think
         | about these things, or whether the 'explainer' is just a
         | collection of unconnected ideas, but it doesn't appear to hold
         | together.
         | 
         | It is not surprising that the first target of WEI -- Chrome on
         | Android -- does not support extensions.
        
         | throwaway375758 wrote:
         | That's a silly proposal that will eventually be turned off as
         | it causes issues. Users will complain that sometime websites
         | are broken for no reason and the first proposed fix would be to
         | turn the failure probability to zero. Then the zero failure
         | setting will become the default.
        
           | throwaway375758 wrote:
           | Also if Netflix or Twitter decide to require device
           | authentication they can give you an error message and
           | instruct you how to turn the holdback feature off
        
         | maest wrote:
         | And what guarantees do you have that the probabilistic failure
         | rate won't be turned to 0 at some point in the future?
         | 
         | Except for Google's pinky swear, I mean.
        
         | ohgodplsno wrote:
         | Here's how this goes:
         | 
         | WEI randomly fails, website sees it, has never implemented any
         | error checking (or fails on purpose without WEI), WEI becomes
         | effectively mandatory.
         | 
         | Google is a gun manufacturer telling people on the other end of
         | it "don't worry, every one in 20 bullets doesn't fire".
        
         | Koffiepoeder wrote:
         | Workaround: check WEI across 4 domains, P(failure) = 0.000001%
        
         | pimterry wrote:
         | That's currently just an idea in the 'Open questions' section
         | of the spec, but there is already pushback against it from
         | others closely involved in the spec & discussion around this
         | (https://github.com/RupertBenWiser/Web-Environment-
         | Integrity/...) and notably the attestation feature Google
         | already shipped on Android for native apps in the same
         | situation does _not_ do this.
        
         | pzo wrote:
         | If you have 50% of people having adblock then websites loosing
         | 10% of traffic because of WEI probabilistically fail it still
         | seems like win for big tech if they force user to their
         | approved unmodified OS/browser.
        
         | kmeisthax wrote:
         | The antifraud company that worked with Google on the WEI
         | proposal is already calling for the removal of holdouts from
         | the spec[0], because:
         | 
         | - Attestation does not work as an antifraud signal unless it is
         | mandatory - fraudsters will just pretend to be a browser doing
         | random holdout otherwise.
         | 
         | - The banks that want attestation do not want you using niche
         | browsers to login to their services.
         | 
         | [0] https://github.com/RupertBenWiser/Web-Environment-
         | Integrity/...
        
       | Arch-TK wrote:
       | I predict that hardware attestation will in 10-30 years become a
       | requirement to maintain an internet connection.
       | 
       | Given Microsoft's push to make their OS support hardware
       | attestation as well as Google's push for technologies which use
       | hardware attestation in broader and broader scopes (Android and
       | iOS has supported this for apps for a long time), the technology
       | to make this possible is increasingly becoming widespread.
       | 
       | Hardware which supports hardware attestation is expensive and
       | some people who can't afford it would therefore be excluded. But
       | I don't think this matters.
       | 
       | If Google forces you to see all their ads then they can sell the
       | ad space for more money. This can make it increasingly profitable
       | to sell devices at an ever increasing loss. Likewise for
       | Microsoft.
       | 
       | As a side note, this will make it incredibly difficult for anyone
       | to compete in the hardware space. Why would someone spend even
       | PS500 on a phone or computer from a non adtech company when the
       | adtech company can sell the same device for PS100 or PS50 or
       | maybe even give it away for free?
       | 
       | By making hardware attestation more mainstream, it will become
       | increasingly difficult to argue that enabling it for things would
       | cut off customers.
       | 
       | I think it's easy to argue in favor of requiring hardware
       | attestation for internet connections from the point of view of a
       | government or an ISP. After all, if your customers can only use a
       | limited set of hardware which is known and tested for security,
       | it decreases the chance of security problems. For a police state
       | like the UK it also seems even easier to justify too.
       | 
       | Even if things don't go that far, in a few years you will become
       | a second class citizen for refusing to allow this on your
       | devices. I can easily imagine banks requiring WEI for their
       | online banking portals (they already do it for all their apps).
       | Likewise I can also imagine my water, gas and electricity
       | companies, or really any company which handles payments,
       | considering this technology.
       | 
       | The worst part is, I don't think most people will care as long as
       | it keeps working seamlessly on their devices. Likewise I don't
       | think governments or the EU will do anything about it. I am not
       | even sure what I can do about it.
        
         | JohnFen wrote:
         | > I predict that hardware attestation will in 10-30 years
         | become a requirement to maintain an internet connection.
         | 
         | I fear you're right. But if the current trends keep up, I'll
         | have abandoned the internet entirely before that happens.
         | 
         | I mourn for what we have already lost, and we are poised to
         | lose even more.
        
         | derefr wrote:
         | > I predict that hardware attestation will in 10-30 years
         | become a requirement to maintain an internet connection.
         | 
         | What you fail to take into account, is that geeks like being
         | able to freely goof around with stuff; and that new disruptive
         | tech evolves precisely in the ecosystems where geeks are
         | goofing around with stuff.
         | 
         | Consider the dichotomy between iPadOS and macOS. macOS still
         | exists -- and still has things like the ability to disable
         | Gatekeeper, enable arbitrary kernel-extension installation,
         | etc. -- because the geeks _inside Apple_ could never be
         | productive developing an OS on a workstation that is itself a
         | sealed appliance. They _need_ freely-modifiable systems to hack
         | on. And they may as well sell other people those free systems
         | they 've developed -- with defaults that make the tool
         | appliance-esque, sure, but also with clear paths to turning
         | those safeties off.
         | 
         | The same thing was true in the 90s with the rise of walled-
         | garden ISPs. The average consumer might be happy with just
         | having access to e.g. AOL, but the people who work with
         | computers (including the programmers at AOL!) won't be happy
         | unless they can write a program that opens a raw IP socket and
         | speaks to another copy of that program on their friend's
         | computer halfway around the world. And so, despite not really
         | mentioning as a feature, every walled-garden ISP _did_
         | implicitly connect you to the  "raw" Internet over PPP, rather
         | than just speaking to the walled-garden backend BBS-style --
         | because that's what the engineers at each ISP wanted to happen
         | when _they_ used their own ISP, and they weren 't going to
         | tolerate anything less.
         | 
         | And then, gradually, all the most interesting stuff _for
         | consumers_ on the Internet -- all the  "killer apps" -- started
         | being things you could only find the "raw" web, rather than in
         | these walled gardens -- precisely because the geeks that knew
         | how to build this stuff, had enthusiasm for building it as part
         | of the open web, and _no_ enthusiasm for building it as part of
         | a walled-garden experience. (I would bet money that many a
         | walled-garden developer had ideas for Internet services that
         | they wrote down at work, but then implemented at home -- maybe
         | under a pseudonym, to get out from under noncompetes.)
         | 
         | Even if there comes about an "attested Internet", and big
         | companies shift over to using it, all the cool new stuff will
         | always be occurring off to the side, on the "non-attested
         | Internet." You can't eliminate the "non-attested Internet" for
         | the same reason that you can't develop an Operating System
         | purely using kiosk computing appliances.
         | 
         | The next big killer app, after the "attested Internet" becomes
         | a thing, will be built on the "non-attested Internet." And then
         | what'll happen? Everyone will demand an Internet plan that
         | includes access to the "non-attested Internet", if that had
         | been something eliminated in the interrim. (Which it wouldn't
         | have been, since all the engineers at the ISPs would never have
         | stood for having their _own_ Internet connections broken like
         | that.)
        
           | BizarroLand wrote:
           | Hell, as soon as the federated systems started getting
           | traction, Meta's Threads got set up to interface with them.
           | 
           | The companies have an imperative, since I guess calling it a
           | vested interest would be an understatement, to not let you
           | escape from their clutches.
           | 
           | They can't force you to come inside, and they can't force you
           | to stay, but they can make it so that it's almost impossible
           | to go anywhere where they are not already there. It's creepy
           | and predatory vulpine super stalker behavior, but unless we
           | establish a system of government that puts our desires above
           | theirs there is not much we can do about it other than stay
           | away to the best of our abilities.
        
           | Arch-TK wrote:
           | You have opened up my eyes to an important aspect. I hope
           | you're right.
        
       | siquick wrote:
       | Is Brave browser safe from this considering it uses Chromium?
        
         | lagrange77 wrote:
         | I guess they could un-cherrypick this 'feature', but that
         | doesn't mitigate google or publishers requiring a response from
         | this API, in order to serve a request.
        
       | mble wrote:
       | Stop
        
       | asmor wrote:
       | A good way to measure how annoying this would get is to look at
       | the handful of applications demanding SafetyNet on Android. It is
       | not quite as much as one would assume, since adding friction of
       | any kind is a retention killer. On the open web this would likely
       | be worse, since you are locking out more than jailbreakers and
       | emulator users.
        
       | exceptione wrote:
       | Wondering what you can do?
       | 
       | First:
       | 
       | - ban Google all together in your personal life. No chrome and no
       | excuses. Stop your bullshit or leave this profession.
       | 
       | - develop with and for firefox and friends only, introduce
       | usability problems for chrome
       | 
       | - employ the same tactics as google.                 -> Bundle
       | firefox with the software you are distributing.             ->
       | Like google did, remove the competition altogether from the users
       | device.            -> make your npm-module or your website slower
       | in chrome            -> show a popup urging users to download
       | firefox, provide a link.      Refer to their current chrome as
       | malware.            -> use as many tricks as you can think of to
       | spoil the well for google.           Destroy search results, fill
       | their storage with /dev/random, whatever your imagination leads
       | you too. You keep telling us you are so smart. Show it.
       | 
       | - remember, Google's capital is data. Hit that and the beast will
       | die.
       | 
       | If you are not ready to do this, you are part of the problem.
       | "Maybe later". No, people have warned for years. I wrote that
       | using chrome is "less than smart" years ago, and some people took
       | real offense when I wrote that. If you don't act now and update
       | your projects like I wrote above, you will never do it.
       | 
       |  _Secondly, tweet, write to tech journalists._ But only after you
       | did the above.
       | 
       |  _Thirdly, Google is evil and they know it._ They care only about
       | money and they trust you to find excuses. There are already some
       | people who talk to themselves  "Well, I see both sides really".
       | Don't be that one.
       | 
       |  _Fourthly, I am very worried that the window of opportunity is
       | closing now rapidly._ It is late to defend our values, rights and
       | future all by ourselves while all political parties gladly take
       | donations by the millions. I am not an anarchist (nor a
       | libertarian), and I would rather sit on my lazy ass like you.
       | However, the amalgamation of tech oligarchs and ruthless
       | political factions is accelerating. They are happy to trade civil
       | rights for something more tangible. Your legal rights are being
       | eroded one after the other and you might lose the right (or
       | means) to stand up for them.
       | 
       | If things go really wrong, keep in mind that while in theory one
       | could burn the whole thing down, well, yes, a statement in public
       | life would help for publicity. But PR is a hard thing if you
       | don't have money. The easiest steps are outlined above.
        
       | pzo wrote:
       | Not sure how exactly ad fraud works but why this WEI supposed to
       | even prevent it? There are many tools that allow to control your
       | mouse and keyboard programatically like pyautogui [0].
       | 
       | Will OS check if such python lib is installed or script running
       | in the background? Then those that doing ad fraud will move to
       | programmable board as BLE keyboard/mouse/hid. Even microbit can
       | can be programmed as BLE HID device [1]. Add external camera on
       | unattested device that will stare at attested device screen and
       | you can automate lots of thing. Sure this is more complicated to
       | pull off but will probably eventually happen anyway if this is a
       | lucrative business.
       | 
       | In the end WEI wouldn't prevent ad fraud / fakes but would end up
       | used for restricting other things.
       | 
       | [0] https://github.com/asweigart/pyautogui
       | 
       | [1] https://github.com/bsiever/microbit-pxt-blehid
        
         | jimkoen wrote:
         | > Will OS check if such python lib is installed
         | 
         | Most computers come with a trusted platform module which
         | increasingly runs more and more services related to media
         | handling. On modern Macs the T2 chip is an A8 or A9, meaning it
         | has the same power of a modern iPhone and handles everything
         | from device input (mouse & keyboard), to webcam decoding to
         | media decoding. When you watch netflix on a modern macbook, the
         | video buffer that is displayed is actually a shared memory
         | buffer from the T2 chip, which the main SoC can't actually see.
         | If you take a screenshot you will see that the screen stays
         | black, since audio and video come purely from the chip.
         | 
         | You could run a Browsers Renderer in there and you would never
         | notice.
        
         | tantalor wrote:
         | The term for this is "cat and mouse"
        
       | thrawa8387336 wrote:
       | How to turn it off? For real
        
       | _fat_santa wrote:
       | Not a lawyer but this seems ripe for antitrust action. Microsoft
       | got sued back in the 2000's for simply bundling IE with their
       | operating system. The behavior of Google (and quite frankly
       | Microsoft with Edge) seems way way worse than whatever MS was
       | doing when they got sued.
        
         | hot_gril wrote:
         | But MS still bundles IE, and they've gotten more pushy about it
         | lately.
        
       | andrecarini wrote:
       | What's stopping a non-complying browser from sending forged
       | attestation tokens? Honest question.
        
       | mmastrac wrote:
       | I've been holding on to my Firefox installation after switching
       | back around ~2016 or so. I was on the Chrome bandwagon when they
       | were the upstart (still have the comic from the launch!) but it
       | didn't take long to see how dangerous things were getting with
       | monoculture.
       | 
       | If you want to help, push back on all the anti-Firefox rhetoric
       | that amplifies every little misstep that they take. Firefox is so
       | much better from a user-respect perspective and the vitriol over
       | little things (a couple of anonymous, tracking-free sponsored
       | links on a new tab page?) are losing the plot.
        
         | hot_gril wrote:
         | Maybe they shouldn't have added the Pocket links if they didn't
         | want the vitriol. Tracking or not (I'm still not 100% convinced
         | that they're not), it doesn't look good when your browser
         | greets you with that stuff. It's like entering a neighborhood
         | and seeing a "checks cashed" store.
        
           | mmastrac wrote:
           | Thank you for providing an excellent example of what sort of
           | comments contributed to our current situation.
        
             | hot_gril wrote:
             | Sure, instead of blaming the people who added the feature,
             | blame the people who don't like it.
        
               | mmastrac wrote:
               | And now we have WEI, thanks to the constant nitpicking
               | and anti-evangelism from people like you.
        
               | hot_gril wrote:
               | If those people seriously switched to Chrome just cause
               | of Pocket, which I doubt, then sure. Otherwise, we're
               | allowed to complain about a bad feature in the browser we
               | use. Maybe the problem is people treating Firefox like a
               | religion instead of just a better alternative to Chrome.
        
       | lemper wrote:
       | this is where you should vote with your wallet and feet. and I
       | think it's not really a stretch to ask Google's engineers who
       | work on chrome/ium to get a job somewhere else.
        
         | djaychela wrote:
         | I think it would be interesting to get their views on it. I
         | wouldn't be surprised if a lot think this is a good idea. Not
         | that I agree, but I think it's unlikely that everyone sees it
         | the same way as those outside the organisation.
        
           | fps_doug wrote:
           | Obviously, if you get paid to implement this you don't want
           | the cognitive dissonance of knowingly doing something bad, so
           | I'm sure those folks have already laid out their
           | justification for this technology.
           | 
           | I wish Google could and would make Chrome closed source. It
           | would at least give all those rebranded Chromiums (Opera,
           | Vivaldi, Brave) a strong reason to reconsider their choice of
           | engine, or at least maybe work together on a more divergent
           | fork of it that stays away from Google's evil stuff.
        
           | serial_dev wrote:
           | "It is difficult to get a man to understand something, when
           | his salary depends upon his not understanding it".
           | 
           | I imagine it's hard to push back against it even internally.
           | Not to be jaded, but one or two people raising a stink about
           | it will only achieve them screwing up their career prospects
           | within Google.
        
             | Silhouette wrote:
             | A cynic might observe that the tech sector - and US big
             | tech in particular - has just seen the biggest round of
             | layoffs that many of the developers in that market will
             | remember. Many of those same developers might have been
             | thinking even 18 months ago that their extremely high
             | compensation was guaranteed because finding another
             | extremely well compensated job was easy. Now they know
             | better and I'm sure a lot of people are scared. Seems like
             | a good time for management to push bad ideas that their
             | remaining employees might not like.
        
       | ailef wrote:
       | Can somebody explain what are the practical implications of this?
        
         | csomar wrote:
         | You'll need an "approved" browser and potentially "approved"
         | hardware to access the web. Since Cloudflare is on this too,
         | most of the web will be locked for anyone who doesn't use
         | mainstream hardware.
        
           | xyzal wrote:
           | This needs to get to the European Parliament, we need
           | legislation to protect web interoperability ASAP.
        
             | zaggynl wrote:
             | Have at it: https://european-union.europa.eu/contact-
             | eu/write-us_en
             | 
             | I'm having trouble grasping how WEI works, providing
             | examples of what would and could happen and what to
             | ask/tell the EU specifically.
             | 
             | From my limited understanding it would mean the lockout of
             | people with non-compliant hardware/software, greatly
             | increase the fingerprinting of web browser users and
             | further vendor lock in to Google as a company?
        
           | leesalminen wrote:
           | But why do they care so much about this? Is it only for DRM
           | on media playback?
        
             | rpdillon wrote:
             | I think there are a lot of parallels with what Reddit did.
             | 
             | Reddit wanted to control how users consumed content on
             | their site. To control the experience (i.e. monetize with
             | ads), they had to shut down third-party clients, since
             | those could remove ads.
             | 
             | Google appears to be doing the same thing, but for the
             | entire web. WEI is a way for sites that want to monetize
             | with Google ads to prevent folks from accessing their site
             | unless they can cryptographically assure that the user's
             | browser will follow all the rules Google sets. We don't yet
             | know exactly what all those rules will be, but it isn't
             | hard to guess that they'll be along the lines of whatever
             | makes Google the most money.
             | 
             | This applies to desktop browsers, but also affects
             | automated tools like wget and curl. It could kill web
             | scraping altogether.
        
               | kmeisthax wrote:
               | Third-party clients could have been made to display ads,
               | or they could have gated third-party client access behind
               | Reddit Gold. That wasn't the problem.
               | 
               | The problem was that if you used a third-party client,
               | Reddit would have to coordinate with them to launch
               | whatever new stupid cryptocurrency scam they wanted to
               | push that week. On a web browser they can just push new
               | code into it[0], and their first-party mobile clients can
               | be updated ahead-of-time with support for the feature.
               | But third-party clients would have to spend their own
               | development time adding stupid "click here to get your
               | Snoovatar[1]" links. They could slow-walk that, or just
               | not implement that, and Reddit would have to spend time
               | and money kicking users off that third-party app.
               | 
               | This, incidentally, is why every other major social media
               | platform bans third-party clients. Third-party clients
               | are user agents, not platform agents.
               | 
               | [0] Which, incidentally, makes web browsers _not user
               | agents_
               | 
               | [1] An NFT scam Reddit tried to pull
        
             | Aaargh20318 wrote:
             | No, this is for DRM on web pages. End game is probably to
             | force ads down your throat.
        
             | yetihehe wrote:
             | It's so that you don't modify their precious page content
             | (ads and trackers) with "unwanted" software hacks.
        
             | jiggawatts wrote:
             | They can finally, _finally_ get rid of those pesky ad
             | blockers.
             | 
             | Google is an ad company. They're not a browser company.
        
               | xp84 wrote:
               | Indeed. Nor a search company, nor a phone operating
               | system company, nor a maps company, nor an email
               | provider, nor a business software company.
               | 
               | Whatever someone may think of Google or even of ads, it's
               | smart to keep that important thing in mind and remember
               | their alignment is and must always be toward maximizing
               | and improving advertising.
        
             | goalieca wrote:
             | It's far worse. If you go back to to the html and http
             | protocols, they are extremely open and friendly. I would
             | say extremely elegant and helped build the web we know
             | today. But google has been iterating away from open and
             | accessible standards in favour of controlling experiences
             | (see amp, WEI, etc). I'm all in favour of secure boot
             | chains with options for unlocking because of the security
             | benefits. There's absolutely no good user reason to apply
             | this to web resources though.
        
               | AshamedCaptain wrote:
               | I know it's not exactly what you mean, but this is why I
               | dislike HTTP2 and 3 (both also heavily pushed by Google
               | but also others). While open, they are the opposite of
               | "welcoming and friendly".
        
             | kalleboo wrote:
             | The stated reason is to stop bots from being counted as ad
             | views and make sure that all ad views are done by actual
             | humans. This is likely even honest reasoning from the
             | people developing it.
             | 
             | The same technology could easily be applied to simply
             | blocking anyone who isn't verified (in the name of stopping
             | spam, DDoS, bank security, you name it), meaning anyone not
             | using an approved install of Windows/macOS/Android/iOS is
             | shut out from the internet.
             | 
             | In the long term, in the name of "banking security",
             | they're likely to add a mode that also lets you ensure your
             | pages aren't tampered with by extensions, and there go all
             | the ad blockers.
        
               | thesuperbigfrog wrote:
               | >> The same technology could easily be applied to simply
               | blocking anyone who isn't verified
               | 
               | Sounds like a great way to enforce censorship:
               | 
               | - websites can deny access to unverified web browsers /
               | web clients
               | 
               | - WEI-enforcing web browsers / web clients can refuse to
               | go to unverified websites (not a stated goal, but it is a
               | logical next step to boost website adoption of WEI APIs
               | once a critical mass of clients is reached)
               | 
               | Google wants to build a wall around the Web and have
               | their own walled garden:
               | 
               | https://youtu.be/Ag1AKIl_2GM?t=57
        
               | [deleted]
        
               | xp84 wrote:
               | Oh, so it's like the HDMI DRM that attempts to let
               | displays certify "I'm a real honest-to-goodness TV, not a
               | capture card."
               | 
               | That one is in the category of things that is little more
               | than a nuisance in practice since it's so easy to
               | circumvent, but that's a hardware thing and therefore
               | it's easier to plug something in that is unauthorized.
               | Things are getting so tightened up on the software side
               | with secure boot, Apple's read-only system partition and
               | by-default App Store Only policy on the Mac, etc. that I
               | suspect this type of thing will be a pain for normal
               | people, though actual at-scale bad actors will probably
               | figure it out.
        
           | thejosh wrote:
           | Cloudflare want to be the internets backbone. And they've
           | honestly succeeded.
           | 
           | Now it's almost impossible to access websites in an automated
           | way -- the CTO posted you can just email him
           | (https://news.ycombinator.com/item?id=34639212) and he'll
           | sort it. Because that scales.
           | 
           | edit: Mispoke about the CTO, said he would approve you, I was
           | wrong. Apologies.
           | 
           | Their DNS is "privacy focused", but they provide "aggregated
           | results" of domains. How is that privacy focused?
           | 
           | Cloudflare came from the approach of being a developers
           | friend ("Look! SSL is now free!") but was given the internet
           | on a silver platter.
        
             | redman25 wrote:
             | I've never understood why so many tech oriented people have
             | turned a blind eye to Cloudflare.
        
             | jgrahamc wrote:
             | I don't have a mechanism to "approve you". We don't have
             | any clue who people are and so even if I wanted to "approve
             | you" I couldn't.
        
               | thejosh wrote:
               | Sorry, this was wrong. I was a fool to post that without
               | providing context and I apologise. I have updated my
               | comment. I sometimes forget there are real people on the
               | other side of the computer sometimes.
               | 
               | It was this thread, where you mentioned emailing:
               | https://news.ycombinator.com/item?id=34639212
        
               | jgrahamc wrote:
               | Ah. Makes sense now. I did wonder what you were talking
               | about.
        
             | CalRobert wrote:
             | Don't worry, Gmail is breaking email too and the CTO will
             | never see your non-google email.
        
             | tenpies wrote:
             | Also remember, Cloudflare is de-facto the moderator of the
             | internet.
             | 
             | Whatever you may think of Kiwifarms, we all saw how that
             | narrative unfolded from a technical perspective.
        
               | kmeisthax wrote:
               | Yes. Cloudflare was irresponsible in fighting to keep
               | 8chan, Daily Stormer, and Kiwifarms up as long as they
               | did. Every other ISP with a competent abuse desk dropped
               | them. If you don't think that's bad, then let me remind
               | you that back in 2012, Malwarebytes actually had a policy
               | of blocking all Cloudflare services specifically because
               | they were hosting malware and refused to remove it[0].
               | The excuse Cloudflare used for not removing malware from
               | their network was the same language used to justify
               | keeping the aforementioned sites operational. If
               | Cloudflare was paid to run the Great Firewall of China
               | they'd bend over backwards to try and claim it was to
               | protect Xi Jinping's freedom of speech.
               | 
               | Remember that moderators can be abusive not just in terms
               | of removing content that shouldn't be removed, but also
               | by forcing you to accept things that harm you. Moderation
               | is a trust relationship because I'm delegating my own
               | personal decision to accept or block traffic/content/etc
               | to someone else. Cloudflare is not trustworthy.
               | 
               | Cloudflare also used to be a big pain in the ass for
               | Tor/VPN users because competent DDoS protection requires
               | some kind of traceable identity. Their solution was
               | Privacy Pass - an extension that let you pre-solve their
               | CAPTCHAs. However, this wasn't good enough, so their next
               | solution... was to literally partner with Apple to
               | implement Web Environment Integrity, years before Google
               | even proposed it. Nobody noticed this - not even _me_ -
               | because it was sold as a way to make CAPTCHAs less
               | annoying. It was literally the trojan horse Google could
               | only dream of building.
               | 
               | [0] https://forums.malwarebytes.com/topic/108447-my-site-
               | using-c...
        
               | tzs wrote:
               | Kiwifarms did not have to use Cloudflare.
        
         | knaik94 wrote:
         | From a very top level view, this gives Google, and other
         | websites, the ability to block requests from devices/browsers
         | they don't approve.
         | 
         | This implements device level verification of the code running
         | your browser. If the device identifies as something Google, or
         | other implementing websites, don't approve, you'll get an error
         | similar to how you see 404 errors for missing/wrong links.
        
           | [deleted]
        
         | asciimov wrote:
         | Unblockable ads, sites can serve you data that you can't
         | manipulate or copy, micropayments can exist, invasive
         | surveillance.
         | 
         | Surveillance is possibly the worst of the bunch. They say it's
         | just to do a better job of serving ads, but that's only the tip
         | of the iceberg. Governments could easily use it to know and
         | track everything you do online. Just wait till the next elected
         | nut job wants a list of everybody that has ever looked at or
         | searched for a certain type of information, maybe they don't
         | like that you looked up info on abortions or lgbt info, now
         | they can know the full extent of what you saw and when.
         | 
         | Ads will be worse. You think YouTube ads are bad now, just wait
         | till you can't visit any page without the mandatory viewing of
         | their ads. They can require a cam installed to make sure your
         | eyes are on the ad, helpfully pausing the video when you look
         | away.
        
           | beckler wrote:
           | Getting some "PLEASE DRINK VERIFICATION CAN" vibes...
           | 
           | https://imgur.com/dgGvgKF
        
         | smallstepforman wrote:
         | The Browser application needs to pass a binary image check, and
         | if the browser hash doesn't match Google database, you cannot
         | proceed to the website (since your browser may be corrupted). A
         | major big deal for non main-stream browser, and for non Google
         | browser developers, extension developers (eg. AdBlock), etc. In
         | summary, some websites (like banks, Netflix, etc) will no
         | longer be available for non mainstream browser users. Also,
         | even if you're using Google Chrome, you may need to run the
         | latest version to satisfy the hash check. Every day, the number
         | of broken websites will continue growing until all non Google
         | Chrome users have a blocked internet.
        
           | nonane wrote:
           | Can you please explain why a third party browser can't lie
           | about its hash, just like it can lie about it's user agent?
        
             | ndriscoll wrote:
             | The idea is that an operating system service provides the
             | attestation. In turn, the OS is signed, with the bootloader
             | verifying the signature. The bootloader is also signed,
             | with a hardware chip verifying the signature.
             | 
             | The infrastructure to do signed OS loading is already in
             | place, and on some operating systems (e.g. Android), the OS
             | attestation service is already in place. So everything is
             | mostly in place already to have your browser attest that it
             | is official Google chrome on Google Android on an approved
             | device with a hardware chip that verifies a Google approved
             | boot signature. That hardware chip contains a Google
             | approved private key (a key that's signed by a manufacturer
             | that Google has in turn approved/signed) that can't be
             | extracted, and that's the key that makes the attestation.
             | Replace the hardware boot verify chip with one that will
             | verify software you want, and you lose your attestation
             | key.
             | 
             | They could also make the OS service reach out to a web
             | service to get an attestation that the attestation key
             | hasn't been revoked, so even if someone did physically
             | extract the key from hardware and share it, it could be
             | revoked (assuming each device gets its own key).
             | 
             | In effect, wide use of this kind of thing means that open
             | source software is no longer free since even if you can
             | look at the code, you must be part of the anointed class
             | (i.e. working within our approved by a major corporation)
             | to edit it and run your edits.
        
             | kmeisthax wrote:
             | Because the encryption key you need to sign the hash lives
             | in EL3[0] and only Google and ARM can load code there. In
             | order to lie about your hash, you have to break ARM
             | TrustZone, and if you do that you can be sued under section
             | 1201 for trafficking in copy protection circumvention
             | tools. In other words, the law that prohibits you from
             | selling DVD copiers can be used to give literally any
             | bullshit the backing of law.
             | 
             | [0] An ARM exception level that sits above hypervisors and
             | is specifically intended to support trusted execution modes
             | for isolated mini-operating-systems that do this sort of
             | shit
        
             | throw_m239339 wrote:
             | > Can you please explain why a third party browser can't
             | lie about its hash, just like it can lie about it's user
             | agent?
             | 
             | Because that thing basically describes a proprietary plugin
             | like Activex, Silverlight or Flash before it, so a third
             | party browser which doesn't have that proprietary tech
             | can't fake it, under pretense of "standard". The code of
             | that plugin will not be open source, worse, it will act as
             | a spyware on people's computers at the OS level.
             | 
             | It's like EME before and these proprietary techs have no
             | place in a open standard spec.
        
         | px43 wrote:
         | Nothing will happen. People have been making the same
         | complaints about every new crypto standard for decades, and yet
         | here we are. TPMs are a thing, EME has been around for over a
         | decade now, DRM on the web is as pervasive as it's ever going
         | to get, and yet no one's user experience is any worse than it
         | was before these technologies existed.
        
           | jiggawatts wrote:
           | Yes, and I am still unable to play 4K Netflix on a PC that
           | has been able to play 4K videos for about 7 years now.
           | 
           | It's permanently blocked to prevent piracy, or something,
           | mumble, mumble...
        
             | Silhouette wrote:
             | It really does feel like something is fundamentally wrong
             | when we're trending towards getting our video and audio
             | content via online streaming but the streaming services are
             | trending towards being gatekeepers more than facilitators.
             | 
             | The temporary nature of any licensing deals behind these
             | services and the resulting lack of reliable long-term
             | access to content have become more and more obvious.
             | 
             | Increasingly the streaming services seem to be so paranoid
             | about piracy that they are blocking "unapproved" players
             | from getting the highest quality versions of the content -
             | as if anyone who wants to pirate any blockbuster movie
             | can't already find a way to get it in 4K somewhere else if
             | they really want to. Meanwhile you can't watch your 4K
             | movie on a service you're literally paying to provide that
             | movie. IIRC Amazon Prime Video still won't even let you
             | have HD content if you're on Linux.
             | 
             | It feels like the commercial incentives for tech firms to
             | create walled gardens and a culture of never owning
             | anything permanently are going largely unchecked and by now
             | the governments who are supposed to act in the interests of
             | their people should really be stepping in with regulation
             | to counter those negative trends.
        
             | hot_gril wrote:
             | So, no 4K Netflix on Linux (and not even 1080p without
             | light hacks), presumably because of some incompatibility
             | with the DRM. Still handily beats the situation that
             | existed before. "Similar to video DRM" doesn't scare me.
             | Mass surveillance is scarier.
        
             | px43 wrote:
             | There are several ways to play 4k Netflix videos on any
             | platform you want, because nothing they are doing actually
             | prevents piracy.
        
               | skydhash wrote:
               | It's not about preventing, it's about controlling. Making
               | everything as an appliance is the backbone of
               | consumerism.
        
           | [deleted]
        
           | jjulius wrote:
           | >DRM on the web is as pervasive as it's ever going to get...
           | 
           | Apple and Google only _just now_ implemented this kind of web
           | DRM, which absolutely _can_ have further restrictions added
           | to it. Careful with your absolutes.
        
         | DoItToMe81 wrote:
         | ENORMOUS fingerprinting potential and capability to disrupt the
         | user's ability to block content. Or access it.
        
         | gorhill wrote:
         | To turn your browser (an agent acting on your behalf) into a
         | proprietary application (an agent acting on behalf of a
         | website) -- i.e. the equivalent of forcing you to install a
         | proprietary application in order to visit a website.
        
           | omoikane wrote:
           | If websites wanted this feature, and the choice is between
           | Chrome implementing it versus me installing proprietary
           | software, I would rather choose Chrome, especially since
           | Chrome is implementing it in the open.
           | 
           | There are already various services that require proprietary
           | applications to be installed, most of which are closed-source
           | with dubious security track record. Replacing those propriety
           | apps with a common web browser is not necessarily a bad
           | outcome.
           | 
           | Personally I am voting with my money and just avoid services
           | that are user-hostile, independent of which user-agent I use
           | to access those services.
        
         | amalcon wrote:
         | This is essentially a backdoor attempt to TiVoize[0] web
         | browsers. The only difference is that, instead of directly
         | using hardware to prevent you from running a modified browser,
         | the intent is to use network effects to accomplish the same
         | thing.
         | 
         | [0]- https://en.wikipedia.org/wiki/Tivoization
        
         | gostsamo wrote:
         | If adopted by publishers, the web will be closed to everyone
         | but allowed browsers on allowed OSes on allowed hardware. No ad
         | blockers, no extensions, no customizations beyond what the few
         | chosen browsers allow explicitly.
        
           | criddell wrote:
           | I have a website so I guess that makes me a publisher. Say I
           | wanted to block Chrome on Windows and Firefox on Debian? How
           | would I use this?
        
             | gostsamo wrote:
             | The browser would provide an api which returns a signed
             | token which will be confirmed by an atestation authority.
        
         | jedisct1 wrote:
         | [flagged]
        
       | easyThrowaway wrote:
       | Get the Wikipedia Foundation on board and make sure the wikipedia
       | or other big mediawiki hosts refuse to show any kind of content
       | if such feature is detected in the browser.
       | 
       | Also, if you're a distro mantainer, configure apache and nginx
       | defaults to make this is the default behaviour.
       | 
       | Even better: instead of redirecting to any wall of text with a
       | long explanation of the political and technical reasons of this
       | choice, just display a big, loud "ERROR" message stating that
       | their browser is unsupported due to the presence of this module,
       | and a small tutorial on how to deactivate it from the
       | about:config page, if available.
        
         | zzo38computer wrote:
         | I do not agree with configuring apache and nginx to do that by
         | default, unless WEI would somehow prevent a server that doesn't
         | understand it from working properly (as far as I can tell, that
         | is not the case). (A system administrator could still change
         | the configuration; this is only about the default setting.)
         | 
         | However, I think the other stuff that you had mentioned would
         | be OK.
         | 
         | Furthermore, a distro maintainer could configure clients by
         | default to disable WEI (or to not include client programs that
         | have WEI).
        
       | c0l0 wrote:
       | I feel like I have to repeat this, since so much is at stake
       | here, where it is about the preservation of the web as we know it
       | today, at the peril of having it turned into yet another walled
       | garden:
       | 
       | The only way around the dystopia this will lead to is to
       | constantly and relentlessly shame and even harass all those
       | involved in helping create it. The scolding in the issue tracker
       | of that wretched "project" shall flow like a river, until the
       | spirit of those pursuing it breaks, and the effort is disbanded.
       | 
       | And once the corporate hydra has regrown its head, repeat.
       | Hopefully, enough practise makes those fighting the dystopia
       | effective enough to one day topple over sponsoring and enabling
       | organisations as a whole, instead of only their little
       | initiatives leading down that path.
       | 
       | Not a pretty thing, but necessary.
        
         | em1sar wrote:
         | [dead]
        
         | doliveira wrote:
         | Yeah, financial and social pressure is basically the only
         | weapons we have against corporations when regulations don't
         | exist. And honestly, financial pressure doesn't work at this
         | scale or in this case.
        
           | hartator wrote:
           | > when regulations don't exist
           | 
           | It's very likely governments will make this mandatory if they
           | have the chance to regulate over this.
        
             | kevmo wrote:
             | [flagged]
        
               | tmpz22 wrote:
               | Which executive orders, federal appointments, and other
               | executive branch actions, would you attribute to Eric
               | Schmidt?
        
               | docmars wrote:
               | From this article:
               | 
               | "At the same time, Schmidt has been appointed to numerous
               | White House advisory positions, giving him privileged
               | insight into the administration's policies in technology,
               | science and military defense, as well as unusual access
               | to top policymakers."
               | 
               | https://www.techtransparencyproject.org/articles/eric-
               | schmid...
               | 
               | A quick Google of "eric schmidt obama" brings up a lot of
               | articles discussing their close political relationship.
        
               | signatoremo wrote:
               | And that makes him "shadow president" how? Was he the one
               | with the most access as opposed to, says, David Axelrod?
        
               | docmars wrote:
               | I don't want to put words into the OP's mouth with
               | regards to his assertion about Schmidt, but given the
               | loose wording: "basically shadow president", it's fair to
               | say it isn't meant literally, and it usually comes with a
               | negative connotation and to imply that Schmidt was so
               | deeply involved, from a standpoint of strong biases in
               | favor of Google and the obvious potential for corruption
               | in participating as an advisor to someone (Obama) who
               | doesn't have the same grasp on technology -- and the
               | extent and length of Schmidt's involvement throughout
               | Obama's terms.
               | 
               | It could be said that Schmidt disproportionately
               | influenced important decisions in the tech realm, to a
               | degree nearly equal to executive authority, because it
               | presumably (and greatly) outweighs the opinions of the
               | other heads of Big Tech, so long as Obama was naive
               | enough to agree with him on key issues he didn't fully
               | understand.
               | 
               | This is especially damning in light of the NSA / Prism
               | scandal during Obama's term, and Big Tech's involvement
               | and compliance with that.
               | 
               | Of course, anyone could assert this about an advisor to a
               | President depending on the President's level of knowledge
               | and outright willingness to apply their advice, even if
               | in spite of fairness (competition), rights, laws, or
               | precedents.
        
               | tmpz22 wrote:
               | I appreciate the link - but "Schmidt has been appointed
               | to numerous White House advisory positions" != "basically
               | a shadow president".
               | 
               | There have been many questionable advisor appointments by
               | previous presidents. Including the last president.
        
               | PaulDavisThe1st wrote:
               | Very good, but that doesn't answer the question.
        
           | varelse wrote:
           | [dead]
        
           | jjoonathan wrote:
           | Yes, but this will be an uphill battle. Every campaign must
           | be financed, so every politician must effectively be vetted
           | by monied interests. The same monied interests that we see
           | here on a strategic offensive against the rest of us.
           | Regulators will tend to be sympathetic to them, not us, until
           | things get really bad.
           | 
           | Is EFF still the place to send money?
        
             | Brian_K_White wrote:
             | I think so. I don't know of any better.
        
               | nequo wrote:
               | Are they actively pursuing WEI? Is there anyone who is?
        
           | amalcon wrote:
           | If you live in a representative democracy, and Google has a
           | presence there, contact the offices of those representatives.
           | These things don't always seem like they matter, but
           | sometimes they do. Big tech generally (and Google
           | specifically) is a pretty popular target right now --
           | seemingly worldwide and across most ideological divisions.
        
             | docmars wrote:
             | This is true, but I think the main issue is whether people
             | are quick enough to call for congressional hearings and
             | decisive actions / lawmaking that would have any impact
             | before it's too late. It's a race to the finish, and big
             | tech companies always have the advantage. Of course, that
             | doesn't mean regulation couldn't call for a reversal on
             | what's been implemented.
             | 
             | The other side to this issue is despite the scrutiny
             | towards big tech, they can still lobby and make any
             | regulatory actions seem effective, when in practice,
             | they've already gotten their fingers into influencing
             | policy in such a way that doesn't ultimately address the
             | consumers' concerns.
        
           | mwint wrote:
           | Regulation is just social pressure enforced by guns.
        
           | api wrote:
           | Financial pressure won't work because you are not Google's
           | customer. Google's customers are its advertisers.
        
             | JohnFen wrote:
             | And you are the customers of those companies advertising.
             | That's leverage, too.
        
           | alexb_ wrote:
           | Financial and social pressure are the only ways you convince
           | anybody to do anything that isn't biological.
        
           | xeonmc wrote:
           | Speaking of regulations, I think an angle that can help
           | spread awareness to the general public is casting this as
           | essentially being the equivalent of SOPA/PIPA but being
           | pushed by Big Tech rather than Big Gov.
        
         | Mountain_Skies wrote:
         | All they'll have to do is make a pronouncement of support for
         | some trendy social issue and everything will be forgiven and
         | forgotten. Virtue signaling has turned into the most effective
         | corporate tool for manipulating society into allowing
         | corporations to do almost anything they want. And the public's
         | addiction is so strong that even when this is pointed out and
         | agreed that it is happening, the addiction still must be fed,
         | so corporate sociopathic parasitism on society continues with
         | the joyous approval of society in general.
        
           | orangecat wrote:
           | Yeah. I won't be surprised if the marketing for this
           | misfeature pivots to "it will prevent harassment of
           | marginalized groups".
        
         | userbinator wrote:
         | Indeed. Negotiations have already turned out to be completely
         | ineffective. The next step is war.
         | 
         | Cory Doctorow came up with the phrase "The War on General-
         | Purpose Computing", which describes the situation perfectly.
        
           | teddyh wrote:
           | Even before that, there was "The Digital Imprimatur":
           | <https://www.fourmilab.ch/documents/digital-imprimatur/>
        
           | PaulDavisThe1st wrote:
           | He came up with it more than 9 years ago, during which time
           | no such war has been generally apparent, and if anything, the
           | conditions for general purpose computing have improved.
        
         | foobarbecue wrote:
         | Is https://github.com/RupertBenWiser/Web-Environment-
         | Integrity/... the best place to shame?
        
           | dang wrote:
           | > _the best place to shame?_
           | 
           | Please don't do this here. It's not what this site is for,
           | and destroys what it is for.
           | 
           | Edit: I suppose I need to add--no, we're not pro-$MegaCorp or
           | pro-$web-destroying-dystopia. We're just trying to have an
           | internet forum that doesn't suck, and you guys need to make
           | your substantive points without degenerating into mob
           | behavior.
           | 
           | https://news.ycombinator.com/newsguidelines.html
        
           | shmde wrote:
           | https://github.com/chromium/chromium/commit/6f47a22906b28994.
           | ..
           | 
           | Here.
        
           | elbybasolis wrote:
           | Attempting to open an issue yields this message:
           | 
           | "An owner of this repository has limited the ability to
           | comment to users that have contributed to this repository in
           | the past."
        
             | bsza wrote:
             | You can still report it as malware (which it actually is)
        
               | yomlica8 wrote:
               | If only they had some sort of attestation scheme to root
               | out dissent at the source.
        
           | [deleted]
        
           | jjoonathan wrote:
           | Yoav Weiss is closing concern threads, calling them "spam."
           | 
           | Ben Wiser ( https://benwiser.com ) turned off comments
           | altogether.
        
             | rapnie wrote:
             | May their names reach eternal infamy on Wikipedia.
             | 
             | The Open Web. Creators: TBL et al, Destroyed-By: Google et
             | al.
        
               | jjoonathan wrote:
               | > The goals of the advertising business model do not
               | always correspond to providing quality search to users.
               | 
               | - Sergey Brin and Lawrence Page, The Anatomy of a Large-
               | Scale Hypertextual Web Search Engine
        
             | dang wrote:
             | Please don't do this here. It's not what this site is for,
             | and destroys what it is for.
             | 
             | Edit: I suppose I need to add--no, we're not pro-$MegaCorp
             | or pro-$web-destroying-dystopia. We're just trying to have
             | an internet forum that doesn't suck, and you guys need to
             | make your substantive points without degenerating into mob
             | behavior.
             | 
             | https://news.ycombinator.com/newsguidelines.html
        
             | qjx wrote:
             | Yoav Weiss has a blog post from 6 days ago on his website.
             | https://blog.yoav.ws/
             | 
             | for a personal blog it has quite a lot of PR speak
        
               | nobody9999 wrote:
               | HN Discussion of the blog post:
               | 
               | https://news.ycombinator.com/item?id=36857676
               | 
               | 85 points by KoftaBob 1 day ago | flag | hide | past |
               | favorite | 109 comments
        
               | jjoonathan wrote:
               | Oof. It does check, though, that the guy CoC-blocking all
               | the github comments would have blog posts like the
               | Professor Umbridge of the W3C.
        
               | shadowgovt wrote:
               | I think people like to take the easy way out of declaring
               | those with a different mindset "evil." Everyone is the
               | hero of their own story, and honestly there are multiple
               | incompatible-but-internally-consistent models of how
               | technologies can and should work. I think it's more
               | useful to recognize these things than to write off a
               | competing mindset (especially when the competing mindset
               | is in a position of power).
               | 
               | Consider incentives from Google's standpoint. They want
               | to provide users a safe and secure experience. They want
               | to simplify maintenance of software and provide
               | developers the ability to simplify maintenance of
               | software (a problem simplified by chopping the unbounded
               | set of possible user agents down to a blessed, vetted
               | subset). They have the resources to make their site
               | screen-reader compatible, so they're not concerned about
               | damage that could be done to screen-readers because
               | they'll just bless one and support it. And, of course,
               | they implicitly trust themselves to do all this.
               | 
               | In that ecosystem, Weiss's viewpoint is completely
               | reasonable. The old model of the web is old, and led to
               | _gestures broadly at all the bad things about the web
               | today... fraud, users getting owned, CP, botnets,
               | misinformation factories._ I can definitely see the
               | viewpoint where someone concludes  "It's time for a new
               | model, and this company has the resources to do it."
               | 
               | I don't agree with him (and in fact I think the idea will
               | fail; I think Google actually overestimates its ability
               | to provide an equivalently-good user experience to what
               | we have now if they aren't leveraging the unpaid labor of
               | other vendors putting the effort into making their own
               | houses work with Google's house without Google even being
               | aware of their work). But I think it's useful to wrap our
               | heads around how one gets into that headspace without
               | thinking oneself a monster.
        
               | saurik wrote:
               | As they say: "the road to hell is paved with good
               | intentions". Wanting to fix the world _by taking complete
               | control of it_ is one of the most trivial examples of a
               | plan that should be immediately labeled  "evil", as, if
               | nothing else, "absolute power corrupts absolutely".
        
               | shadowgovt wrote:
               | This plan doesn't take complete control. It provides a
               | mechanism for a web site to delegate trust on UA
               | configuration authenticity to a third party, or even to
               | itself via side-channel.
               | 
               | Nothing in the proposal requires the third party be
               | Google. The proposal _does_ decrease the control the user
               | has over their own hardware, in the sense that it
               | provides a channel for a site to decide the user-agent  /
               | hardware stack is the wrong pedigree to serve; that's not
               | universally considered evil either (few people really get
               | bent out of shape that you need a Nintendo Switch to use
               | Nintendo Switch Online services).
        
               | jjoonathan wrote:
               | > Consider incentives from Google's standpoint.
               | 
               | Google sells ads. They want to kill ad blockers. This is
               | how.
               | 
               | > Weiss's viewpoint is completely reasonable
               | 
               | Chasing diversions around in circles is not neutral.
               | Someone wins by default. Diversions exist and they exist
               | to tempt you into poor attention allocation decisions.
               | This is not about safety, security, and providing an
               | excellent experience. It's about ads and making sure you
               | can't stop them.
        
               | shadowgovt wrote:
               | It's extremely likely it's about both. It can be both
               | about making it hard to skip ads on YouTube and about
               | making it hard for somebody to replace human users with
               | automated devices.
        
               | carapace wrote:
               | > When thinking about a new proposal, it's often safe to
               | assume that Occam's razor is applicable and the reason it
               | is being proposed is that the team proposing it is trying
               | to tackle the use cases the proposal handles.
               | 
               | Ockham's Razor doesn't apply in an adversarial situation.
        
               | TheCoelacanth wrote:
               | It is also for when you are comparing two explanations
               | that do an equally good job of explaining empirical data.
               | 
               | "Google is an advertising company and does whatever leads
               | to more profitable advertisements" does a much better job
               | of explaining Google's actions than "Google just wants to
               | build the best possible browser", so it should be
               | preferred even though it is a more complicated
               | explanation.
        
               | jjoonathan wrote:
               | Yep. You'll cut yourself on Ockham's Razor if you bring
               | it to a fight.
        
           | 38 wrote:
           | https://support.github.com/contact/report-
           | abuse?category=rep...
        
             | smarx007 wrote:
             | I think the right avenue is to complain to W3C instead.
             | Especially in the light of https://www.w3.org/TR/2023/DNOTE
             | -w3c-vision-20230725/#princi... and violation of CoC
             | https://www.w3.org/Consortium/cepc/#unacceptablebehavior
             | ("Sustained disruption of discussion.")
             | 
             | The problem is that the proposal has not yet been brought
             | to W3C.
        
         | boondoggle16 wrote:
         | [flagged]
        
           | dang wrote:
           | You can't do this here. We've banned this account for
           | breaking the site guidelines and ignoring our request to
           | stop.
           | 
           | https://news.ycombinator.com/newsguidelines.html
        
         | Mindwipe wrote:
         | The battle is already lost legislatively.
         | 
         | Multiple US states, France, Germany and the UK are going to
         | make the web unnavigable unless you type your credit card
         | number or scan your face for age verification in two out of
         | every three sites.
         | 
         | We are going to need to at least try to create ways to secure
         | those credentials in as zero trust model as possible.
         | 
         | (Note that the legislation is a disaster, but it is done.
         | Nobody paid enough attention. It has passed or will pass in
         | weeks.)
        
           | prox wrote:
           | Time to build a fresh web. Get me my hypercards!
        
             | Mindwipe wrote:
             | > Time to build a fresh web. Get me my hypercards!
             | 
             | A fresh web doesn't exempt you from the legal requirements
             | unfortunately.
             | 
             | This year has seen the biggest state attacks by legislators
             | on any electronic distribution of speech across most
             | Western states for fifty years, and by and large the
             | technology community has completely failed to even engage
             | with that never mind stop it. We are all going to have to
             | live with the consequences for decades.
        
         | zeteo wrote:
         | It won't do anything. You don't think they've anticipated
         | random angry outbursts going into this? Plus, the people you're
         | harassing are simply implementing a policy that they don't have
         | the power to change.
         | 
         | The only pressure that Google has been shown to consistently
         | respond to is _political_. Get a couple of senators (... of the
         | right party) to send them a mild rebuke and they will indeed
         | retreat a little (... and try something else later). But that
         | 's a lot harder than posting angry comments until the next
         | piece of outrageous news comes along, isn't it?
        
           | cliffy wrote:
           | I was just following orders!
        
           | userbinator wrote:
           | Directly sending a message to the implementers doesn't
           | preclude involving politicians in this too, and I absolutely
           | agree that the latter should be involved.
        
           | JohnFen wrote:
           | > the people you're harassing are simply implementing a
           | policy that they don't have the power to change.
           | 
           | I'm not on board with harassing people (sad that I have to
           | include this disclaimer).
           | 
           | That said, the people are not simply implementing this.
           | They're actively and publicly justifying and defending it.
        
         | ParetoOptimal wrote:
         | Has anyone compiled a list of those pushing forward and/or
         | working on WEI?
        
           | mwill wrote:
           | https://github.com/RupertBenWiser/Web-Environment-
           | Integrity/...
        
             | mort96 wrote:
             | Probably also consider all Google employees complicit. All
             | of them -- especially those who could easily just choose to
             | work someone else, like their developers -- are either in
             | favor of, or okay with, Google's mission to destroy the
             | web.
        
         | magic_hamster wrote:
         | I don't like Google's grasp on so many vital parts of the web
         | but somehow, it seems like google is actually in trouble.
         | 
         | AI is going to completely change search if it hasn't already,
         | and google is not even close to compete in this space.
         | 
         | Video has some massive competition from the likes of TikTok.
         | Anyway, YouTube isn't the only option on the market.
         | 
         | Gmail is still popular but since google has been pressuring
         | users to pay, it's been easier than ever to find a reason to
         | try another service.
         | 
         | Chromium can always be forked and have some parts removed or
         | added, and as we all know quite a few browsers do this, some
         | are quite popular.
         | 
         | Is google also losing IOS ads like Meta? If they do, that's
         | another reason for alarm for them.
         | 
         | I'm not sure google is in the best position for the future and
         | WEI is not going to be their golden ticket either.
         | 
         | And, if your prediction that web will change actually comes to
         | pass, well then it'll be just another cycle for this space that
         | has changed countless times since the age of dialup. The web is
         | going to change, again and again, but as long as people are
         | still free to set up a server and let the world access it, we
         | can still do what we like with it.
        
           | knewter wrote:
           | Except increasingly the world will access it via drm aware
           | browsers because their banks require it, and the open web
           | audience will subsequently dwindle.
           | 
           | The Halloween memos called this "Embrace, Extend,
           | Extinguish". Google didn't just ignore the moves that
           | provided M$ dominance.
        
           | teddyh wrote:
           | To paraphrase John Maynard Keynes: Google can stay irrational
           | a lot longer than you or I can retain our freedoms. And when
           | the precedents have been set, a new normal has been
           | established, and when/if Google _does_ finally fail, the next
           | actor will step in and keep those freedoms from us all.
        
         | insanitybit wrote:
         | That sounds entirely unhelpful. They can just close the issue
         | tracker + people will obviously just move on. This sounds like
         | the Reddit 'blackout' that did nothing and is already
         | forgotten.
         | 
         | What we really need is for the collective browser vendors to
         | refuse to implement this and, if Chrome pushes forward, to
         | bring Google to court over it. Nothing short of legal
         | intervention is going to help here.
        
           | zoul wrote:
           | Similar feature is already in production Safari, alas:
           | https://httptoolkit.com/blog/apple-private-access-tokens-
           | att...
        
             | insanitybit wrote:
             | That's not really surprising. Limited attestation of device
             | state has been a thing for a long time and it's why Chrome
             | is used at so many companies.
        
           | shadowgovt wrote:
           | What sort of regulation do we imagine a government putting
           | into place to stop this? If anything, governments tend to
           | lean in favor of identification and verification systems
           | because they make corporate commerce run more smoothly.
        
             | insanitybit wrote:
             | It's not hard to imagine legislation around a user right to
             | ownership of their device. For example, it could be made
             | illegal for a website to attest that a user is not running
             | specific software.
             | 
             | Legislation around device ownership rights are already
             | present, especially in the EU.
        
           | account42 wrote:
           | Or we could show Chrome users what the future will look like
           | for alternative browsers - by blocking Chrome now.
        
             | insanitybit wrote:
             | OK? That has nothing to do with what the parent said, which
             | is that the issue tracker should be flooded.
        
         | larata_media wrote:
         | I agree with your overall ideal of free access to information
         | but I disagree that harassment is a necessary or even effective
         | option to push against this. I think the harassment puts us in
         | a category of ineffective, bitter malcontents and that's not
         | what we are.
         | 
         | We are capable of going to elsewhere to free and open access to
         | information, and we would be better off spending our energy on
         | positively influencing others to follow us in that direction.
         | They can't take away tcp, http, ftp, irc and all the other
         | protocols that these megaliths have built their empires on, and
         | we can still use those tools even if it's a demoralizing
         | regression to move back to the basics. Giants like google,
         | Amazon and others depend on our unwillingness to rebuild. Let's
         | use our efforts and our ingenuity to show them that they've
         | underestimated us.
         | 
         | We have the tools, we have the knowledge. Let's be builders
         | instead of petty complainers.
        
           | MSFT_Edging wrote:
           | Every time you see someone abandon an open source project,
           | one of the biggest reasons is people suck and ask too much,
           | harass, etc.
           | 
           | Therefore, one of the most efficient ways to kill a dangerous
           | new standard is to endlessly harass anyone who works on it.
           | 
           | Sorry, the poor individual can not hide from their
           | responsibility.
        
             | dang wrote:
             | Please don't do this here.
             | 
             | More explanation:
             | 
             | https://news.ycombinator.com/item?id=36881929
             | 
             | https://news.ycombinator.com/item?id=36881081
             | 
             | https://news.ycombinator.com/item?id=36881034
        
           | nvm0n1 wrote:
           | > a category of ineffective, bitter malcontents and that's
           | not what we are
           | 
           | There are enough top voted people demanding harassment in
           | this and other threads to say that well, maybe that's what HN
           | is, actually.
        
           | MetaMalone wrote:
           | We must believe in ourselves. We are too quick to be cynical
           | about the future of the web - too quick to forget our
           | ingenuity in the face of adversity.
        
           | otikik wrote:
           | https://www.purewow.com/wellness/what-is-tone-policing
        
           | pseg134 wrote:
           | Well we can build something too but first we need to get rid
           | of these people.
        
             | dang wrote:
             | Please don't do this here.
             | 
             | More explanation:
             | 
             | https://news.ycombinator.com/item?id=36881929
             | 
             | https://news.ycombinator.com/item?id=36881081
             | 
             | https://news.ycombinator.com/item?id=36881034
             | 
             | In addition: could you please stop posting unsubstantive
             | comments and flamebait generally? You've unfortunately been
             | doing it repeatedly. It's not what this site is for, and
             | destroys what it is for.
             | 
             | If you wouldn't mind reviewing
             | https://news.ycombinator.com/newsguidelines.html and taking
             | the intended spirit of the site more to heart, we'd be
             | grateful.
        
           | LikelyABurner wrote:
           | We've been doing that for years, larata_media. Decades, even.
           | 
           | And what do we have to show for it? Our tools power their
           | botnets and they flaunt the CoCs in our faces when we try to
           | do something about it as "not constructive".
        
           | [deleted]
        
         | smashah wrote:
         | Oh but that would be against the respective projects' code of
         | conduct. /s
        
         | dang wrote:
         | > constantly and relentlessly shame and even harass all those
         | involved in helping create it
         | 
         | Not on HN, please. I realize that you're trying to protect
         | something you care about (and that maybe we all care about) but
         | this leads to ugly mob behavior that we don't want and won't
         | allow here.
         | 
         | https://news.ycombinator.com/newsguidelines.html
        
         | lopis wrote:
         | > constantly and relentlessly shame and even harass all those
         | involved in helping create it
         | 
         | If this ever helped, we wouldn't have absolutely unethical
         | products created. Turns out people's morals have a price tag,
         | that Google and others are willing to pay their employees.
        
           | rightbyte wrote:
           | Well at least you can increase the price tag for Google,
           | Facebook etc by taunting their employees as bad people.
           | 
           | It is quite incredible actually, because it was not many
           | years ago that working at Google had this coolness factor to
           | it. Hopefully, it is a broader change of view, other than
           | mine?
        
         | verisimi wrote:
         | Imo, the idea that this is about selling advertising and
         | maintaining market share is being used as a false
         | justification. This is not about being able to drive users to
         | ads.
         | 
         | The bigger picture is that Google et al are actually part of
         | the control structure. The governance system wants deanonymised
         | Internet. Corporate interests are how this is being promoted -
         | government legislation would be a harder pill for the masses to
         | accept.
         | 
         | But all the recent mega changes tell us (Elon buying twitter,
         | etc) tell us that this is on the way. Apparent anonymous
         | internet will be sandboxed. Knowing everything about everyone
         | all the time, and having that data being crunched by ai's is an
         | amazing, audacious goal, that seems close to being achieved.
        
         | hot_gril wrote:
         | Just saw https://github.com/chromium/chromium/pull/187/files
         | 
         | It's even funnier with the auto-reply "Thanks for your pull
         | request! It looks like this may be your first contribution to a
         | Google open source project. Before we can look at your pull
         | request, you'll need to sign a Contributor License Agreement
         | (CLA)."
        
         | throwaway71271 wrote:
         | what exactly do you want to preserve from the web as we know it
         | today?
         | 
         | let it burn
         | 
         | focus on building something new, new protocols, new networks,
         | new browsers
        
           | swayvil wrote:
           | Something that isn't dependent upon the whims of princes.
        
         | pornel wrote:
         | Corporations will dismiss all of that as asshole Luddites, and
         | do it anyway. You're not Google's customer. The advertisers
         | are.
         | 
         | The only way to stop Google from treating the Web as their own
         | OS is to take that power away from them, by switching to other
         | browser engines.
        
           | pornel wrote:
           | And we have this crappy paradox that Mozilla is held to an
           | impossibly high standard. People want to burn them to the
           | ground for daring to use _Google_ Analytics, or the Pocket
           | acquisition, and keep using a 100% Google browser, with
           | preferential integration with all of Google 's
           | services/protocols/APIs.
        
             | lxgr wrote:
             | I think that's a false dichotomy. It's possible to
             | criticize Mozilla (ideally in good faith) for both the way
             | in which they develop Firefox and their focus/mission in
             | general, while at the same time using Firefox, since to me
             | it looks like the best alternative we've got.
             | 
             | Not every Mozilla critic is a Chrome user; I'd even expect
             | that the most vocal critics are Firefox fans and users.
        
               | teddyh wrote:
               | In theory, yes, but that's what every thread about
               | switching to Firefox gets: Lots of flames about Mozilla.
               | But when the only sensible alternative is _staying with
               | Google_ , why would these people make these arguments as
               | replies to suggestions to switch to Firefox? It is only
               | reasonable to conclude that it's not Firefox fans making
               | these arguments, _in those threads_.
        
         | anon7331 wrote:
         | Ah yes. The "Uncle Ted" approach, but a bit more mild. At what
         | point do we go full Ted?
        
         | nfw2 wrote:
         | Tiktok is literally controlled by the CCP. If consumers don't
         | care about that, they aren't going to care about DRM.
        
           | anonym29 wrote:
           | Tech-literate folks really should make a concerted effort to
           | move to our own darknet, something like freenet or I2P, to
           | recreate the internet before the advent of mass adoption of
           | smartphones by the public. Forums, IRC, vent/TS, webrings,
           | XHTML 1.0. No WebGL. No Canvas. No WebAssembly. No damn WEI.
           | 
           | Normies can f&$% off and enjoy the data-mined, DRM'd, ad-
           | infested, CCP-propagandized, upload-your-photo-ID-to-post-
           | here, privacy-free dump their illiteracy, careless disregard
           | for harm, and data exhibitionism fetish has allowed the
           | clearnet to turn into.
        
             | MSFT_Edging wrote:
             | While I like this idea, starting from the foot of "CCP-
             | propagandized" based on the tiktok service hosted by Oracle
             | in the US is an amazing way to start off on a Nazi infested
             | foot.
             | 
             | Anti-communism and fascism are historically in lock-step.
             | No one is going to use the services if you basically create
             | web4 stormfront.
        
               | anonym29 wrote:
               | FWIW, I'm certainly not advocating for any kind of
               | racism, or any kind of philosophies that support the use
               | of force to achieve any political, social, or economic
               | goals, so fascism would be firmly out were I the
               | webmaster.
        
               | MSFT_Edging wrote:
               | > any kind of philosophies that support the use of force
               | to achieve any political, social, or economic goals
               | 
               | > so fascism would be firmly out
               | 
               | This goes to prove my point, that there's a gross
               | misunderstanding of history in the general population.
               | 
               | Fascism doesn't use force to get political power, it
               | gains political power through reactionary ideas based on
               | false assumptions that leads to a fascist regime where
               | the violence then occurs on the "other".
               | 
               | It comes through ideas such as "protecting your family",
               | "returning to tradition", and other feel good sayings
               | that mean almost nothing. Think of the phrase "Woke",
               | taken from black community vernacular and twisted to mean
               | almost nothing at all. It describes everything and
               | anything that can make a conservative person upset, from
               | queer people to mental health professionals.
               | 
               | Despite meaning nothing, oh boy has it taken root. Beer
               | is woke, tv is woke, the black guy in star wars is woke
               | for existing. And oh man look how easy it is to take root
               | and now millions of people live their life by the "anti-
               | woke" lifestyle. What does that lifestyle mean? idk,
               | buying shes just to light them on fire, i guess.
               | 
               | This is why communist regimes had gulags. Fascism takes
               | root through reactionary(meaning feelz over realz) ideas,
               | typically against change. A revolution is something hard
               | fought, why would they allow it to be derided by some
               | idiots who miss when they owned all their neighbors land?
               | 
               | What I'm trying to say is one end of the spectrum is at a
               | huge advantage when it comes to free speech environments,
               | for the fascist does not need to argue in good faith.
               | Going by "philosophies that support the use of force..."
               | will get you a lot of a certain group.
        
               | PawgerZ wrote:
               | There was nothing in his comment that alluded to anti-
               | communism sentiment. In my opinion, the parent comment
               | was categorically anti-fascist. Current day CCP conforms
               | to the definition of fascism far more than the definition
               | of communism.
               | 
               | I'd love to hear your thoughts on how they were being
               | anti-communist or fascist in your eyes.
        
               | MSFT_Edging wrote:
               | It's easy in theory to say "oh anti-ccp isn't anti-
               | communist", but in practice, do people actually
               | understand the difference?
               | 
               | Consider the phrase "tankie", what was once a term used
               | by communists to describe a militaristic member who
               | supported the USSR sending tanks into Hungary, has become
               | a general phrase for anyone showing critical support to
               | any socialist project.
               | 
               | Socialists are essentially told they are not allowed to
               | support any previously or currently existing project
               | because bad things were done, are told they're doing
               | whataboutism if they compare the actions to western
               | actions, and are called a tankie if they decide to stop
               | caring about what liberals and right wing people say.
               | 
               | China IS a socialist project, are they strictly a
               | socialist country? No. Did they perform the most thorough
               | and equitable land reforms in the history of Humanity?
               | Yes. Do they wield central power for central planning
               | economic activities? Sometimes. Are they operating on a
               | 100% worker ownership of industry? no, but they have a
               | non-insignificant public ownership of industry, co-opting
               | privately owned industry to steer activities with greater
               | control and hold certain business leaders accountable.
               | 
               | I'm sorry to say, but "current day CCP conforms to the
               | definition of fascism" just isn't correct and goes to
               | prove the point that the meaning of words is mostly
               | ignored. Fascism != Authoritarianism. There was a massive
               | effort post WWII through the cold war to create anti-
               | communist propaganda that simply wasn't true. You had
               | actual ex members of the Nazi party leading anti-
               | communist endeavors. The black book of communism counts
               | Nazis as deaths from communism. The Victims of Communism
               | memorial foundation is literally a mask on far-right
               | thinktanks such as the heritage foundation.
               | 
               | That being said, the West is grossly lied to about China
               | day to day. It is in various interests to have an enemy.
               | To the point where one man can write a report identifying
               | a "future cultural genocide" which was simply a reduction
               | in growth of a population due to 1 and 2 child laws being
               | imposed on a group that was exempt prior, as an actual,
               | in-progress genocide. If you point this out, people call
               | you a genocide denier.
               | 
               | That same man is a director of China Studies, at the
               | Victims of Communism Memorial Foundation.
               | 
               | I apologize for this long winded rant, but yes, if you
               | found an internet presence on being "anti-ccp", you're
               | starting off on a literal fascist foot. The community
               | will deride any left leaning voice, call any voice that
               | says "hey china did a good thing here", as a "tankie",
               | and it will become an echo chamber for right-wing hate
               | speech.
        
               | ddq wrote:
               | China is nationalist authoritarian state capitalist,
               | their external propaganda isn't to spread Marxist
               | ideology, it's simply anything that helps China and hurts
               | everyone else, same as any nationalism.
               | 
               | "What do you think the Russians talk about in their
               | councils of state, Karl Marx? They get out their linear
               | programming charts, statistical decision theories,
               | minimax solutions, and compute the price-cost
               | probabilities of their transactions and investments, just
               | like we do. We no longer live in a world of nations and
               | ideologies, Mr. Beale." Network, 1976
               | 
               | Further, free speech must be defended despite the modern
               | liberal tendency to cut off the majority's noses to spite
               | nazi faces. If you're gonna fight nazis, fight nazis,
               | don't throw out fundamental human rights. They know they
               | can taint principles, signs, and symbols with their
               | stench. Don't give up essential freedoms out of guilt by
               | association. These charlatans have no political theory,
               | no examined ideology. It's a power struggle and we've
               | already ceded too much power.
        
       | andy99 wrote:
       | Has anyone come across a good nontechnical summary that could be
       | shared more broadly?
       | 
       | Edit: the Register article linked elsewhere looks as good as it
       | gets for now
       | https://www.theregister.com/2023/07/25/google_web_environmen...
        
       | [deleted]
        
       | nightshadetrie wrote:
       | bruh
        
       | ricardo81 wrote:
       | fwiw I found Vivaldi's overview a good primer on the situation.
       | 
       | https://vivaldi.com/blog/googles-new-dangerous-web-environme...
        
         | dang wrote:
         | Thanks. Let's discuss that article here:
         | https://news.ycombinator.com/item?id=36875940.
        
       | [deleted]
        
       | blacklight wrote:
       | I'm sick of these guys trying to break the web. From now on it's
       | personal. We need to make sure that Google gets very hurt, and
       | ideally they are wiped out from our industry.
        
       | krzyk wrote:
       | Could someone explain what WEI is? Searching for it returns quite
       | a bit of acronyms.
        
       | lagrange77 wrote:
       | Apple would be in the position to fight this.
        
         | luuurker wrote:
         | "Apple already shipped attestation on the web, and we barely
         | noticed"
         | 
         | https://news.ycombinator.com/item?id=36862494
        
           | lagrange77 wrote:
           | D'oh!
        
           | progbits wrote:
           | And somehow this barely registers on HN, there have been over
           | thousand comments on WEI this week, this was mentioned maybe
           | in 5 (few of them mine - yes I'm repeating this point because
           | it is important).
           | 
           | Attestation bad. Chrome is just catching up to what Safari is
           | already doing, with in fairness more open standard.
           | 
           | We need to kill both.
        
         | andersa wrote:
         | All of the major tech companies are in on this. Google and
         | Apple already deployed it for their phone and desktop platforms
         | (iOS, Android, macOS, ChromeOS, all support attestation
         | already). Microsoft is getting there with Windows 11, and all
         | new devices shipping since ~2015 have the hardware support.
         | Google is now closing the gap on desktop browsers.
         | 
         | Soon the percentage of people supporting it will be high enough
         | to make it mandatory - the last 5% can just get a new device or
         | something like that. They'll do it when their bank website
         | tells them so.
         | 
         | The day Cloudflare flips the switch to require it for all
         | connections is the day the open web dies.
        
           | lagrange77 wrote:
           | Thanks for the info, i wasn't aware of that at all.
           | 
           | > They'll do it when their bank website tells them so.
           | 
           | Right.
           | 
           | > The day Cloudflare flips the switch to require it for all
           | connections is the day the open web dies.
           | 
           | Makes sense and unfortunately seems realistic.
        
             | andersa wrote:
             | Here's an example how far along we already are. You can
             | imagine the next steps, right?
             | https://blog.cloudflare.com/eliminating-captchas-on-
             | iphones-...
        
         | beanjuiceII wrote:
         | apple is one of the bad guys before the bad guys know they're
         | bad guys..they already implemented this stuff
        
       | userbinator wrote:
       | For those who still aren't sure why this is a bad thing, read
       | Stallman's "Right to Read" story --- that's the direction WEI is
       | going to take the Internet and probably other things too, if the
       | opposition isn't strong enough.
       | 
       | Ironically, WEI is one letter off from WEF... but I doubt that
       | was intentional.
        
       | fnordpiglet wrote:
       | This is googles answer to the threat LLM pose to their search
       | engine - cement their ad business into the core protocols.
        
       | adontz wrote:
       | Is there no EU regulation against this?
        
         | andersa wrote:
         | Careful, with the right arguments from Google the EU might just
         | make this mandatory in the name of "security".
        
           | sgjohnson wrote:
           | And if they prohibit it, Google will just pay a several
           | billion dollar fine. At the end of the day, it's just a cost
           | of doing business. Something like an extra 2% tax raise or
           | something. Whatever. Dividend time.
        
         | mardifoufs wrote:
         | The EU is at the forefront of wanting only "real people"
         | online. So no, if anything digital identity is squarely within
         | what would appease the EU
        
       | supernikio2 wrote:
       | I've heard time and time again how this is "the end of the free
       | web". Can someone succinctly explain _how_ this is the case, for
       | somebody not familiar with web browser architecture? What does
       | WEI provide that wasn 't previously possible?
        
         | nfw2 wrote:
         | Actually the free web ended with net neutrality. Didn't you
         | notice when that happened?
        
         | Ygg2 wrote:
         | Future web will require you to have certified browser - Chrome
         | (tm), to access the web. It will require certified OS
         | Windows(tm), running on trusted Hardware TPM(tm), running
         | trusted firmware CIA(tm).
         | 
         | You'll have no choice and your love will be mandatory.
         | 
         | This won't stop malware of course. However a skull clamp will
         | be installed to monitor your thoughts and you will be zapped if
         | undesirable thoughts are detected.
         | 
         | Note: it's a hyperbole but if you want another OS, Browser or
         | hardware you'll be forced to Homebrew it. Or use a compromised
         | app.
        
           | supernikio2 wrote:
           | Can Google really do this? What if I'm using Safari on OS X,
           | or Firefox on Linux?
        
             | thesuperbigfrog wrote:
             | If your choice of operating system and web browser are not
             | WEI-compliant, you can expect something like:
             | 
             | "Sorry, this site requires a certified web browser.
             | 
             | Your browser does not meet the security requirements that
             | this website requires.
             | 
             | Please upgrade to the lastest Google Chrome and remove any
             | uncertified plugins."
        
             | freeAgent wrote:
             | Firefox on Linux will likely lead to problems accessing
             | various services/websites.
        
             | probably_wrong wrote:
             | Well, who's going to stop them?
             | 
             | As for other browsers: I guess that you'd still be able to
             | access my website, but YouTube and GMail will just show you
             | a generic "This browser is not supported" or, at best,
             | "Your browser had been deemed insecure. Please use a secure
             | browser".
             | 
             | If we go full Nostradamus the most likely result is that
             | Safari will play ball (because they are already doing
             | something similar), Firefox will play ball (because they no
             | longer have a spine), they'll implement whatever Google
             | says, and yet another portion of the web will be closed to
             | those who don't dance to Google's tune. I hope you're not
             | too attached to youtube-dl or your adblocker.
        
             | count wrote:
             | Then you're out of luck. That's the whole point.
        
             | devsda wrote:
             | This not only requires Google but websites also need to
             | implement.
             | 
             | The problem is given the number of Google's services, it
             | can easily "nudge" site owners into implementing it.
             | 
             | They can make it mandatory for adwords or analytics or any
             | other service that they have for webmasters and everyone
             | will have to jump in while it is still technically
             | voluntary.
             | 
             | If your $bank choses to implement it, then it can very well
             | mandate only windows or osx clients. Then you can't use
             | firefox on linux.
             | 
             | This may sound like conspiracy theory but we already have
             | examples of similar restrictions on android apps with
             | safetynet. Bank apps already refuse to run on custom roms.
             | It will not be limited to banks. Someone mentioned that
             | McDonald's app doesn't work unless you pass safetynet.
             | 
             | That is how ridiculous it can become.
             | 
             | Edit: fixed typos
        
       | cmrdporcupine wrote:
       | Google is clearly being evil here, but the original sin was
       | having user-agent strings in browsers at _all_.
       | 
       |  _Public_ information on the  'world wide web' should by nature
       | be open and accessible to _any_ agent in a neutral way. (Of
       | course this is implied in Google 's ( _bullshit_ , cough) mission
       | statement.) Making information about what the agent is
       | _invisible_ as a principle from the start would have helped with
       | that.
       | 
       | In reality, that vision was lost in the early 90s when the web
       | went from being a _proposed_ hypertext /document/information
       | retrieval system to being mostly a _presentation_ system for what
       | started as magazine /leaflet/poster analogues ("websites") to
       | which were added dynamic client/server web _applications_.
       | 
       | The difference in model is stark: in the former, the browser,
       | even the user, makes decisions about the presentation of the
       | content based on mostly structural information declared in the
       | document. In the latter, the 'document' is not a document, but a
       | _program_ executed on the users computer.
       | 
       | And once you've made that transition, the "developer" of the
       | "program" now expects more and more of the kinds of controls they
       | get when they truly control the platform.
       | 
       | And it doesn't help that in the midst of this, mobile
       | applications came on the scene, undermined the web completely,
       | and changed expectations of how content should be made available.
       | From that point on it became even more expected by companies and
       | product managers that they control the whole sandbox. e.g. Meta
       | couldn't even be bothered to launch Threads on web, probably
       | precisely because they don't like the restrictions there, and
       | having full control is so much more profitable to them, and
       | they're not the first.
       | 
       | In any case, this all sucks. I've already personally switched to
       | Firefox in most places, but the very fact that Google feels
       | emboldened to push this tact says a lot about the state of the
       | web and how this 30 year trajectory has gone.
       | 
       | In a way, I just hope the "www" dies and all of us who helped
       | create this thing in the first place birth something new and
       | better. But this is also hopelessly naive.
        
       | Paianni wrote:
       | Looks like this has been inserted into release 117, which won't
       | hit the stable channel for several months yet. Chromium is still
       | the most secure GUI browser out there so I'm not in a rush to
       | leave, especially as OpenBSD 7.4 will probably ship with 116.
       | 
       | If the devs/Google's intentions are truly limited largely to
       | trying to prevent bots, then I hope they realise their folly.
        
       | AlfeG wrote:
       | Just don't use and especially pay to sites that will enforce
       | this.
        
       | danlindley wrote:
       | The web is not dying, it is being killed. And the people that are
       | killing it have names and addresses.
       | 
       | Shame on Rayan Kanso <rayankans@chromium.org>
       | 
       | Shame on Peter Pakkenberg <pbirk@chromium.org>
       | 
       | Shame on Dmitry Gozman <dgozman@chromium.org>
       | 
       | Shame on Richard Coles <torne@chromium.org>
       | 
       | Shame on Kinuko Yasuda <kinuko@chromium.org>
       | 
       | Shame on Rupert Ben Wiser: https://github.com/RupertBenWiser/Web-
       | Environment-Integrity
       | 
       | Google needs to be broken up.
        
         | dang wrote:
         | No personal attacks, please. It's not what this site is for,
         | and destroys what it is for.
         | 
         | You can make your substantive points without that, as most
         | other users in this thread have been doing.
         | 
         | You may not owe web-destroying $MegaCorp better, but you owe
         | this community better if you're participating in it.
         | 
         | https://news.ycombinator.com/newsguidelines.html
        
         | SquareWheel wrote:
         | Currently development and standardization occurs in the open,
         | on GitHub and elsewhere. When it's decided that's no longer
         | possible, I hope you realize that this kind of targeted
         | harassment is what led to its demise.
        
         | sph wrote:
         | Shame on all knowledgeable people that happily keep using
         | Chrome and giving Google money. That make the web more
         | centralized by giving more and more power to entities that
         | benefit from this like CloudFlare.
         | 
         | HN is full of people that are indirectly helping to push these
         | changes forward. You're preaching to the choir, and the choir
         | is too lazy to switch browsers or learn how to configure a web
         | server, so they just shrug and carry on.
        
       | _elf wrote:
       | I hope this is something that non-Chrome Chromium-based browsers
       | can omit from their builds.
        
       | BLKNSLVR wrote:
       | Could be an epic troll on Google's part
        
       | funOtter wrote:
       | How does this affect people using Pi-hole to block ads?
        
       | hot_gril wrote:
       | This war was already settled long ago on smartphones, which are
       | globally the most used personal tech. There are already lots of
       | things like banks and messaging apps that require full or partial
       | use of an unrooted smartphone for security purposes. Now they're
       | bringing it to the more niche area of PCs.
        
       | aaronclong wrote:
       | I'm curious what Brave says to my issue:
       | https://github.com/brave/brave-browser/issues/31897
        
       ___________________________________________________________________
       (page generated 2023-07-26 23:03 UTC)