The Right to Lie and Google’s “Web Environment Integrity”

202 点作者 boramalper将近 2 年前

25 条评论

liveoneggs将近 2 年前

I think the fundamental disconnect here is that Google's view of "user" is a "Chrome/Android User Who Shops from SERP Pages" -- google makes money vs the more nebulous "user" of "the (open) web" which is probably only understood by a few people who were alive in the pre-web world (people 35 and older who were also online).Google does not care about the later and only wishes to make more money from the former. Google has a clear and blatant monopoly position over ad-based web monetization so most of the web will follow Google's will. We all need paychecks. The group of old farts who saw the world change are growing older and irrelevant.I am extremely pessimistic about the future of "the (open) web" as the vehicle of our modern low-friction economy as these corporate gatekeepers (Google and Microsoft) are making such big wins recently.Good luck out there. The World Wide Web (old school) and Old Fashioned HTTP+HTML are under grave threat from carpetbaggers.

评论 #36936512 未加载

superkuh将近 2 年前

His comment system is currently broken and will just 404 and return you to a URL at <a href="https://rants.org/%5Ehttp:/your.ip.addy.here/" rel="nofollow noreferrer">https://rants.org/%5Ehttp:/your.ip.addy.here/</a>. So I guess I might as well post here instead,>My web browser (currently Mozilla Firefox running on Debian GNU/Linux, thank you very much) will never cooperate with this bizarre and misguided proposal.Mozilla used to be about user freedoms. Lately Mozilla has been a front-runner on turning off and disabling non-TLS just HTTP support. They will likely be one of the first browsers to remove support for it and eventually HTTP/1.1 as a whole. ref: <a href="https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/" rel="nofollow noreferrer">https://blog.mozilla.org/security/2015/04/30/deprecating-non...</a>Given that HTTP/3 as implemented by Mozilla cannot connect to self-signed TLS cert websites this means the future of Firefox is as a browser that can only visit websites that third party TLS CA corporations periodically approve (even if those corporations are currently benign, like LetsEncrypt). Does this remind you of anything? That's not to say other browsers are better in this respect. Mozilla's Firefox and it's forks are the least worst... it's just everything is getting much worse all together.

评论 #36936497 未加载

评论 #36936702 未加载

评论 #36936563 未加载

评论 #36936442 未加载

评论 #36936275 未加载

评论 #36936490 未加载

评论 #36936419 未加载

评论 #36937241 未加载

thesuperbigfrog将近 2 年前

"If your computer can’t lie to other computers, then it’s not yours."This fundamentally comes down to "do you really control your computer, or does someone else?":<a href="https://youtu.be/Ag1AKIl_2GM?t=57" rel="nofollow noreferrer">https://youtu.be/Ag1AKIl_2GM?t=57</a>

评论 #36936669 未加载

gochi将近 2 年前

Is there a link to an article that actually goes into WEI on a technical level that isn't the proposal itself?So many things posted to HN about it have been the grand overview, which is a perspective worth diving into but also has drowned out every other perspective to the point where it's very difficult to figure out what's really happening with the proposal here.

评论 #36936270 未加载

评论 #36936292 未加载

seo-speedwagon将近 2 年前

I figured I’d take a minute to try and find the proposal itself, so I could see what the proponents considered the virtues of this to be.<a href="https://github.com/mozilla/standards-positions/issues/852">https://github.com/mozilla/standards-positions/issues/852</a> <a href="https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md">https://github.com/RupertBenWiser/Web-Environment-Integrity/...</a>I stopped reading after the explainer’s intro section. The first example is making it easier for websites to sell adds (lmao) and the other 3 are extremely questionable whether if the proposed remedy even helps. And it’s presented as a benevolent alternative to browser fingerprinting, as if we must choose between these two awful choices. It’s an absolute joke of a proposal.

ranting-moth将近 2 年前

May I suggest something like "Enterprise Environment Integrity". How does the public know that the enterprise (i.e. google) it's dealing with is healthy?The public should have an entity that will receive detailed attestation data to assess that. Failing the attestation will revoke business permit along with an announcement.

评论 #36936510 未加载

评论 #36936533 未加载

Macha将近 2 年前

> In the normal world, you show up at the store with a five dollar bill, pick up a newspaper, and the store sells you the newspaper (and maybe some change) in exchange for the bill. In Google’s proposed world, five dollar bills aren’t fungible anymore: the store can ask you about the provenance of that bill, and if they don’t like the answer, they don’t sell you the newspaper. No, they’re not worried about the bill being fake or counterfeit or anything like that. It’s a real five dollar bill, they agree, but you can’t prove that you got it from the right bank. Please feel free to come back with the right sort of five dollar bill.Side note: This at least would occasionally happen if you tried to spend Scotland or NI £5 notes in England.

评论 #36937121 未加载

评论 #36936871 未加载

评论 #36936604 未加载

hkt将近 2 年前

I can't convey how disgusted I am at the thought of WEI becoming a reality.It will lead to three webs: the remainder of the open web, the new closed web, and the pirate web.Personally I'll do my bit to preserve openness, even if that means working socially and technically to support the new world of piracy. It will always be a losing battle without institutions fighting for openness, though.This is a moment when Sun's old line - "the network is the computer" - starts to look hideous and dystopian. Prophetic, but maybe not how we thought.

评论 #36936485 未加载

theteapot将近 2 年前

In other words, Google earnestly believes your browser belongs to them and your just using their tool. They're not really wrong either. What'd we think would happen when Google (an ad company) dominated browser market share ...

评论 #36936450 未加载

评论 #36936431 未加载

评论 #36936516 未加载

评论 #36939892 未加载

userbinator将近 2 年前

The underlying hostile technology is "remote attestation" and it's what we should all be fighting against.People justify the latter by speaking about companies wanting control over employees' environments, but IMHO that shouldn't be allowed either. This is also why "zero trust" is problematic; they want to replace humanity with centralised control.

评论 #36937063 未加载

评论 #36942394 未加载

EGreg将近 2 年前

My web browser (currently Mozilla Firefox running on Debian GNU/Linux, thank you very much) will never cooperate with this bizarre and misguided proposal. And along with the rest of the free software community, I will continue working to ensure we all live in a world where your web browser doesn’t have to either.That depends on Mozilla. As long as our software comes from corporations, we will just be reduced to begging.

throwbadubadu将近 2 年前

We have come a long way since "don't be evil", would be funny if not so sad..

jacknews将近 2 年前

I'm not sure the title is helpful, or the analogy.It's more like, if you want to borrow a book from the library, you have to bring an FBI agent home with you too, so they can certify that you don't have a photocopier or scanner (or even a pen and paper), that only you can read the book, and not another family member, that if you want to read aloud, your windows can't open and let anyone else listen in, that you read it from cover to cover including the back-page ads for other books in the series, that you can't leave home with the book, to re-lend it out, and so on.NO. Not on my machines.

Pxtl将近 2 年前

On the one hand, I firmly do believe that we need a proper way to verify identity globally over the internet. The Turing Test is over and AI is going to destroy every user-submittable form online.On the other hand, it's infuriating that advertising is the first front in this war. I specifically don't want advertisers to have my identity. I'm fine with like my Mastodon server or a site like HN to know I'm me because I'm actively interested in interacting with them. I don't want to interact with advertisers, or for them to have my identity, but they're going to wall off half the internet for people who opt out.

评论 #36936914 未加载

评论 #36936765 未加载

tedunangst将近 2 年前

Funny that this was cross posted to fediverse, a network that is heavily reliant on digital signatures to prevent lying.

评论 #36936417 未加载

wdiamond将近 2 年前

people built internet just to destroy it. its not a tech problem. its economics. the forever decreasing profits because more people just know and re-sell for less. tor will become more and more expensive till people realize that needs the same hardware trick with another brand like internet2,3,4,5,... to seek the solution by hacking wont stop this foverer battle. its just ends when the imaginary of fair price for information meets the offer (the forever decrease of population to let universe in peace)

user6723将近 2 年前

The wei camp wants a world where you can have your open source OS with encryption that actually works but almost any commercial website won't talk to you.Wei will get integrated with your CBDC.

recursive4将近 2 年前

Upvote if you actually read the proposal in question.

oh_sigh将近 2 年前

The premise of this article is fundamentally wrong.> On that Web, if you send a valid request with the right data, you get a valid response.Explain DoS protection then.

1vuio0pswjnm7将近 2 年前

"By analogy: right now, you can tell your browser to change its User-Agent string to anything you want."You can also choose not to send this header. By default I do not send it. The RFCs do not require it^1 and very rarely do I find sites that do. When I do find such sites,^2 I just add them to the proxy config so that a UA is added on the way out. Almost invariably these sites will accept a made-up UA, so long as it is well-formed, which is interesting.^3 It suggests no one knows what new UA strings will appear.The origin of changing the User-Agent header dates back to one of the earliest browsers, written in part by a well-known Silicon Valley VC.^4 It was always possible for the user to control HTTP headers such as UA and the designers knew it. Later in the "browser wars" Microsoft changed its UA header to match Mozilla's.^51.<a href="https://towardsdatascience.com/the-user-agent-that-crazy-string-underpinning-a-bunch-of-analytics-86507ef632f0?gi=e30981d0139f" rel="nofollow noreferrer">https://towardsdatascience.com/the-user-agent-that-crazy-str...</a>2.For example, www.federalregister.com and sec.gov.3.Many users want to "blend in" and use common strings so perhaps use of made-up strings remains largely untested.4.<a href="https://raw.githubusercontent.com/alandipert/ncsa-mosaic/master/mosaic-spoof-agents" rel="nofollow noreferrer">https://raw.githubusercontent.com/alandipert/ncsa-mosaic/mas...</a>5.<a href="https://webaim.org/blog/user-agent-string-history/comment-page-1/" rel="nofollow noreferrer">https://webaim.org/blog/user-agent-string-history/comment-pa...</a><a href="https://humanwhocodes.com/blog/2010/01/12/history-of-the-user-agent-string/" rel="nofollow noreferrer">https://humanwhocodes.com/blog/2010/01/12/history-of-the-use...</a>As for WEI, I'm inclined to think that the terms "abuse" and "fraud" in the spec may actually refer to ad fraud, including potential fraud by Google itself in marketing its ad services because it hides the true extent of ad fraud from its customers.People who like to access the web with uncommon TCP/HTTP clients may not be a significant problem. There are no details given in the spec about this alleged "fraud"; perhaps that's intentional. Although by being vague in the spec, real humans that prefer not to use popular browsers may jump to conclusions.^6It could be that we're on the cusp of exposing the true extent of ad fraud with respect to Google, and the ultimate unworkability of Google's core "business" (selling ad services). Perhaps Google believes its advertiser customers could begin to lose trust; maybe direct more ad spend to Apple.6.Some pre-spec discussion: <a href="https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/XCAIgPtxAQAJ" rel="nofollow noreferrer">https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_...</a>

aabedraba将近 2 年前

For crying out loud, Google

puffyengineer将近 2 年前

What is so wrong with Web Environment Integrity? It's a great policy, and the notes CLEARLY outline how the main benefit is going to be for the users and website developers. If you're not doing anything wrong, then you shouldn't have an issue.

TX81Z将近 2 年前

At no point does he explain what the hell the rant is about.

Georgelemental将近 2 年前

There is no right to lie. There is a right to remain silent. That is what "Web Environment Integrity" threatens.

评论 #36936216 未加载

评论 #36936224 未加载

评论 #36936400 未加载

评论 #36936715 未加载

评论 #36936730 未加载

评论 #36936342 未加载

skybrian将近 2 年前

> If your computer can’t lie to other computers, then it’s not yours.And why is that not okay?I think this sort of attitude is left over from when computers were expensive. Nowadays, I have multiple computers, some of which are fun toys I mess with, while others are appliances that I just use for their intended purpose. And that's fine, because when I screw up, maybe I don't want to have broken the computer that I use for video chats and to do my banking? Maybe I don't want my main phone to stop working?It's okay to be a hacker and buy a router that you just use as a router and a Chromebook that you just use for web browsing. You can also buy a Raspberry Pi and mess with embedded programming on cheap devices. The appliance computers should be as low-maintenance as possible so you have more time for hacking.The nice thing about really cheap devices like a Raspberry Pi Pico is that if you actually build something useful for real work, you can deploy it, stop messing with it, and buy another computer for experiments.

评论 #36936477 未加载

评论 #36936446 未加载

评论 #36936397 未加载

评论 #36936408 未加载