“Web Environment Integrity”: Locking Down the Web(brave.com)
brave.com
“Web Environment Integrity”: Locking Down the Web
https://brave.com/web-standards-at-brave/9-web-environment-integrity/
102 comments
Honestly modern Firefox works better than Chrome for me at everything - better memory management - faster loading times - better extension support.
There is only one set of site where Chrome performs better than Firefox: sites made by Google. I can't help but assume that it's intentional.
Unfortunately, for many people those are very important sites.
The Internet desperately needs some government to step in and force Google to spin off Chrome as an independent company. It's the only hope we have of stopping Google from completely ruining the Internet.
Unfortunately, for many people those are very important sites.
The Internet desperately needs some government to step in and force Google to spin off Chrome as an independent company. It's the only hope we have of stopping Google from completely ruining the Internet.
In this era we need to move to the idea of "effective monopolies". Just because Chrome isn't an absolute monopoly, doesn't mean it can't essentially dictate whatever direction it wants in a mostly unchecked manner.
Even American "monopoly" legislation, and our horrible "only care about the consumer" opinion on monopolies has ALWAYS supported breaking up companies that don't have 100% of the industry because they do anti-consumer shit with whatever percentage control they have.
And yet, despite being widely understood as purposely handicapped on non-chrome browsers by using a specific, internal library that is especially optimized inside the V8 javascript engine, Youtube works just fine on Firefox.
There is no "it's slow" excuse to not use firefox. Even if it took a full second longer per page load, WHICH IT EMPIRICALLY DOES NOT, that would still be an acceptable price to pay to not HELP ONE MEGACORP LITERALLY HAVE FINAL SAY OVER ANYTHING THAT HAPPENS ON THE INTERNET
There is no "it's slow" excuse to not use firefox. Even if it took a full second longer per page load, WHICH IT EMPIRICALLY DOES NOT, that would still be an acceptable price to pay to not HELP ONE MEGACORP LITERALLY HAVE FINAL SAY OVER ANYTHING THAT HAPPENS ON THE INTERNET
On Linux the one area where I feel (nothing scientific) that Chrome is faster is for JavaScript code execution. But I still use Firefox instead of Chrome.
I used to feel that too but not anymore. Now when I boot up chrome to test something I don't notice a difference. I think it's improved quite a bit over the last few years.
I mean, chrome is the slowest js engine at the moment: https://treeherder.mozilla.org/perfherder/graphs?timerange=3...
I love it.
Although currently I am mostly using Chrome for web dev, and Firefox for everything else. On my current project, FF just couldn't seem to handle the churn of constantly loading heavy pages, dev tools etc.
I should switch to a chromium really.
Although currently I am mostly using Chrome for web dev, and Firefox for everything else. On my current project, FF just couldn't seem to handle the churn of constantly loading heavy pages, dev tools etc.
I should switch to a chromium really.
Firefox is great but I can't make it my daily driver because of two issues:
- Terrible font kerning on canvas (Google Docs, Spreadsheets) (probably a decade old bug)
- Doesn't sync icons in favorites bar (which I use without accompanying text, so, big deal)
- Terrible font kerning on canvas (Google Docs, Spreadsheets) (probably a decade old bug)
- Doesn't sync icons in favorites bar (which I use without accompanying text, so, big deal)
Never noticed the fonts, but I noticed the vastly reduced image quality in Chrome on many websites that scaled down images.
So, having slightly harder to read fonts, and the wrong favicons, is enough to help google own the web.
Jeeze. C'mon, this is exactly what I'm bitching about. How horrific would Google have to be in their position of power over the web before you finally are willing to suffer even a minimal drawback to prevent it?
Jeeze. C'mon, this is exactly what I'm bitching about. How horrific would Google have to be in their position of power over the web before you finally are willing to suffer even a minimal drawback to prevent it?
Yes, and maybe, there's a lesson for you to take from this: such small things may accumulate into world overlordship of an evil corporation. Do you remember how Google Chrome gained marketshare over Internet Explorer? It was all minor annoyances with IE like slow startup, a single page crashing the whole browser, unmovable tabs, big download windows, having multiple search bars. That was it[1]! Chrome never promised "an entirely new web experience", but fixed all the minor annoyances that had lingered during IE's dominance and never been fixed.
So, guilt-tripping users into using Firefox is a terrible idea, and might actually backfire. This is an institutional crisis we've been experiencing by both Firefox and Google making bad product management decisions. Firefox has come a long way, and I applaud it for it, but it's not my fault that Firefox has been so behind in the race. Keep blaming people as much as you want, that's the truth.
[1] https://web.archive.org/web/20080903104921/http://www.google...
So, guilt-tripping users into using Firefox is a terrible idea, and might actually backfire. This is an institutional crisis we've been experiencing by both Firefox and Google making bad product management decisions. Firefox has come a long way, and I applaud it for it, but it's not my fault that Firefox has been so behind in the race. Keep blaming people as much as you want, that's the truth.
[1] https://web.archive.org/web/20080903104921/http://www.google...
IMO the best hedges against Googles web monopoly at the moment are Apple and Microsoft, not Mozilla.
Apple because of Safari (duh) and Microsoft because they are possibly the only company that could reasonably maintain a hard Chromium fork in the case of Google going crazy.
Unfortunately all three of them are more or less aligned on this issue of remote attestation so I don't really see a path forward.
Firefox just doesn't have the market share to matter. If everyone had switched to it 10 years ago there might have been a chance but the goose is cooked.
Apple because of Safari (duh) and Microsoft because they are possibly the only company that could reasonably maintain a hard Chromium fork in the case of Google going crazy.
Unfortunately all three of them are more or less aligned on this issue of remote attestation so I don't really see a path forward.
Firefox just doesn't have the market share to matter. If everyone had switched to it 10 years ago there might have been a chance but the goose is cooked.
The best course against web integrity is not let it establish itself. So we need to identity attestation servers and block them on the networks we maintain.
Neither Microsoft nor Apple has any problem with your or my problem with Google.
> Still excuse after excuse after excuse to just not use Firefox.
What happens when Firefox refuses to implement WEI - then <insert large social media companies> start to require it?
If WEI becomes a common requirement then Firefox will effectively be forced to implement it or it won't be usable as a web browser at that point for the average consumer
What happens when Firefox refuses to implement WEI - then <insert large social media companies> start to require it?
If WEI becomes a common requirement then Firefox will effectively be forced to implement it or it won't be usable as a web browser at that point for the average consumer
Yeah this gets tricky for Google and Mozilla. Goog need FF (and pay for it) to be around and not be meaningless in terms of market share because anything else and it's hard for big G to keep pretending they don't have a crushingly obvious monopoly. Mozilla need Goog because you know, hundreds of millions of reasons. FF bowing to WEI would be the ultimate capitulation. But as you say, if WEI flies, Moz capitulates or dies.
It's tough for Goog. They're playing the end-game card here. It's tough, because it's the game winner. On the one hand, total and complete domination of the web. On the other.. Kahn's FTC and the pesky EU technocrats shaking those tired old antitrust lawsuits..
I love FF. But if WEI or whatever future version of WEI gets up, FF will join the party or consign itself to eventual irrelevance. "I use FF for the web, except banking, most major corp sites, paid content, and an increasing bunch of other stuff - but those four bloggers who still post plain HTML pages, FF all the way, go indie web!"
It's tough for Goog. They're playing the end-game card here. It's tough, because it's the game winner. On the one hand, total and complete domination of the web. On the other.. Kahn's FTC and the pesky EU technocrats shaking those tired old antitrust lawsuits..
I love FF. But if WEI or whatever future version of WEI gets up, FF will join the party or consign itself to eventual irrelevance. "I use FF for the web, except banking, most major corp sites, paid content, and an increasing bunch of other stuff - but those four bloggers who still post plain HTML pages, FF all the way, go indie web!"
Sure, this is what it looks like if/when we've fully lost the fight.
Those of us who currently recommend Firefox are hoping that there's still enough time to do something about this.
Maybe it's already too late, but you might as well try, you know?
Those of us who currently recommend Firefox are hoping that there's still enough time to do something about this.
Maybe it's already too late, but you might as well try, you know?
Firefox is <2% user base at this point, and financially completely beholden to Google.
The fight was lost long ago, several times (once when they decided to throw out thousands of developer work years by gimping all the addons)
The fight was lost long ago, several times (once when they decided to throw out thousands of developer work years by gimping all the addons)
My entire point is that firefox is as 2% because all of us petty and pathetic individuals are unwilling to do even the littleist thing to make the world a better place at our own expense.
Using a slightly worse (and I argue it isn't even) web browser won't kill you, yet everyone on here has excuse after excuse to continue to help google have control over the entire internet.
Pathetic.
Using a slightly worse (and I argue it isn't even) web browser won't kill you, yet everyone on here has excuse after excuse to continue to help google have control over the entire internet.
Pathetic.
Google is just as beholden to Firefox existing, if it doesn’t want to be sued to oblivion.
I'm not sure "I'm not a monopoly, look my competitor owns 2% of the market" is an effective defense anyway?
I think only Safari really counts as a "competitor" at 20% market share and doesn't share the chromium base (compared to edge, etc).
I think only Safari really counts as a "competitor" at 20% market share and doesn't share the chromium base (compared to edge, etc).
Or Firefox and other browsers against WEI gain a significant userbase that these websites can't use WEI to discriminate.
Most people don't really interact with social media via the web anymore anyway. They use apps.
> It could be half as fast (it isn't) and use twice as much RAM (it doesn't) and ask for a damn nude photo of me and I'd still be using it right now.
Same. I mostly use Firefox (I still use Chrome for testing) and it's a good browser in itself: not just because it's not Chrome/Edge.
Same. I mostly use Firefox (I still use Chrome for testing) and it's a good browser in itself: not just because it's not Chrome/Edge.
Exactly. To have a fighting chance to not loose your control over your hardware and software choices, you need to do compromises. (Which we are already loosing on many fronts.)
I see people complaining Firefox having subpar font rendering, in sufficient tab management, Mozilla not acting up to their standards, but lack on some fronts.
So what? You won't make compromises on some of your convenience and still use a user hostile company's software, or forks of it which strongholds you to their whims? And expect everything to play in your favor? Silicon Valley is trying to profit against your best interests.
I don't really say you should be using Firefox, but saying you should use some other browser which is not depending on Chromium, or forks.
I also can say Safari would not be the best choice here. As Apple is the Pioneer on restricting you, the users.
I see people complaining Firefox having subpar font rendering, in sufficient tab management, Mozilla not acting up to their standards, but lack on some fronts.
So what? You won't make compromises on some of your convenience and still use a user hostile company's software, or forks of it which strongholds you to their whims? And expect everything to play in your favor? Silicon Valley is trying to profit against your best interests.
I don't really say you should be using Firefox, but saying you should use some other browser which is not depending on Chromium, or forks.
I also can say Safari would not be the best choice here. As Apple is the Pioneer on restricting you, the users.
It won't matter, if WEI catches on Firefox will be in the same boat. Any non-WEI browser is equal in terms of protesting it. The threat is sites will lose their users if they start requiring it. If anything Chrome derivatives that patch it out but still pretend to be Chrome are even worse for website operators that want to use it.
There's lots of reasons to use FF, this isn't one of them.
There's lots of reasons to use FF, this isn't one of them.
The excuse is always that Gecko is harder to integrate... but at what point is maintaining all these patches harder?
I’ve been maintaining a “soft” fork now for about 12 years now, most of that time on my own. It’s actually possible to get quite involved and do some cool stuff with the changes you make, while keeping up to date; with the resources the size of a company like Brave have, it’d be incredibly straightforward to actually use your own browser logic, with a bit of good engineering. (To all intents and purposes, using Gecko as the engine and your own browser features on top of that, separate to Firefox itself).
I’ve started myself in the past, and am picking that back up again. But by all means it’s quite possible.
I’ve started myself in the past, and am picking that back up again. But by all means it’s quite possible.
Firefox needs to win mobile. In my opinion this is where Brave excels.
As soon as I can use custom shortcuts I’ll switch back to Firefox again.
Or Brave could just do what they should have done in the first place and develop their own browser engine from the ground up - by now they ought to have the resources to do so, and the world could really do with more than the handful we have now.
Mozilla is a political organization, not a web browser developer. I’ll keep using brave.
Brave is a cryptocurrency. No thanks.
I don't see that at all. I've been using Brave for years and nothing to do with crypto. There is a BAT thing, but you can disable it.
The BAT thing is the cryptocurrency. No thanks.
I said that, but you can disable it.
Can you explain your comment? Is it forcing me to use crypto and I'm not aware of it? Am I mining?
Can you explain your comment? Is it forcing me to use crypto and I'm not aware of it? Am I mining?
I'm not interested in handing over my privacy to a company seeking out creative sources of revenue.
https://en.wikipedia.org/wiki/Brave_(web_browser)#Business_m...
https://en.wikipedia.org/wiki/Brave_(web_browser)#Business_m...
From your same source
> Since April 2019, users of the Brave browser can opt in to the Brave Rewards feature.
I have used Brave for years. I've never seen any of their ads and hardly see any other hands since they have a pop-up blocker.
> Since April 2019, users of the Brave browser can opt in to the Brave Rewards feature.
I have used Brave for years. I've never seen any of their ads and hardly see any other hands since they have a pop-up blocker.
> hands since they have a pop-up blocker.
ads since they have an ad blocker
ads since they have an ad blocker
Really? Mozilla is a political organisation and Brave, the very same organisation that hires a fired Mozilla CEO that publicly opposes same-sex marriage, is not a political organisation?
Cool.
Cool.
Brave is a man-child’s tantrum that he had to face the consequences of being a bigot.
If Mozilla is a "politcal organization," their whole politics is centered on how to shape the web. And, idk, having a strong position on such ideas seems pretty damn relevant to this conversation.
Using "political" like a slur is childish and naive.
Using "political" like a slur is childish and naive.
don't add the code.
Firefox on iOS is awful. Basic features like swiping the toolbar to switch tabs are still missing.
Firefox on iOS is not Firefox.
The engine is not, but the UI still sucks. I read on HN that Mozilla started working on a new iOS browser, since we all expect Apple to open up iOS in this or next year to custom browser engines. I hope they will make this new Firefox for iOS a reason to never touch Safari again (I miss Firefox Sync + Firefox add-ons so much!!)
Nor is chrome or brave, yet Firefox is the only one with such a poor experience.
Brave is not just a wrapper on top of Chromium. It is actually using a forked version of Chromium. So, it might not be that big of a concern.
One doesn't really preclude another in practice.
Firefox is legitimately not an option for me. It's literally unusably slow. So slow that it's not actually better than no browser at all.
You have an issue. Firefox is not slow by any means. I use all the browsers for work and Firefox for my navigation. Firefox have never been slower than anything else.
Clearly, I do, yes! But I've given up on trying to nail down what the issue actually is after about a year of trying. It exists on all of my machines, so it's likely related to some other piece of software I commonly use. I just don't know which one.
I am not asserting that FF is bad and nobody should use it. I'm asserting that there are some people (at least one, anyway) who can't use it. Shaming people for not using FF is, therefore, uncalled for.
I am not asserting that FF is bad and nobody should use it. I'm asserting that there are some people (at least one, anyway) who can't use it. Shaming people for not using FF is, therefore, uncalled for.
my guess is filtered dns.
I just audited my system(firefox 110 on openbsd). and when dns is acting up(I disabled external dns leaving only my internal domains resolvable) firefox takes forever to do anything waiting on dns timeouts.
firefox is making requests to
Well, Sigh, I have a new weekend project. poking around in about:config trying to turn this bullshit off off.
I just audited my system(firefox 110 on openbsd). and when dns is acting up(I disabled external dns leaving only my internal domains resolvable) firefox takes forever to do anything waiting on dns timeouts.
firefox is making requests to
www.google.com #why? I don't have google set as my default search engine.
detectportal.firefox.com
9.9.9.9.https #???? this is strange. DoH? but I should have it disabled.
contile.services.mozilla.com.
firefox.settings.services.mozilla.com.
content-signature-2.cdn.mozilla.net.
push.services.mozilla.com.
Well, Sigh, I have a new weekend project. poking around in about:config trying to turn this bullshit off off.
That's entirely possible. It does smell like something's waiting for a timeout of some sort. But the times are very long. About 5 minutes to start the browser, and while not every page render incurs a delay, when they do, the delay is on the order of a minute or so.
In any case, I really have spent a lot of time digging into this. At some point, I just had to let it go.
In any case, I really have spent a lot of time digging into this. At some point, I just had to let it go.
>It exists on all of my machines
What machines, did you assemble the hardware yourself? On a reasonably modern android phone, firefox is fluent even with dozens of tabs and there's nothing you can do to make it slow.
What machines, did you assemble the hardware yourself? On a reasonably modern android phone, firefox is fluent even with dozens of tabs and there's nothing you can do to make it slow.
No, none of these machines are ones that I've assembled myself (and even if they were, so what?). They are all Linux machines. I only very rarely browse the web from my phone, so a browser's behavior on Android isn't relevant to me.
These comments should are as useful as claiming that that magic alternative bullshit medicine cured my cancer. N=1, not reproducible and likely has zero relevance.
You should post to firefox support/some stackexchange site or whatever to fix your problem, not comment on the quality of a product you have failed to properly evaluate.
You should post to firefox support/some stackexchange site or whatever to fix your problem, not comment on the quality of a product you have failed to properly evaluate.
I was not seeking support here, nor offering some sort of review. I was pushing back against the shaming of people who don't use Firefox by pointing out that not everyone has the option.
> You should post to firefox support/some stackexchange site or whatever
Interesting that you assume I haven't done these things already.
Also interesting is the level of hostility in your reply, plus the downvotes my original comment got. The FF fanbase seems to have become a bit irrational and intolerant of anything said about FF that isn't fawning praise. That's disappointing.
> You should post to firefox support/some stackexchange site or whatever
Interesting that you assume I haven't done these things already.
Also interesting is the level of hostility in your reply, plus the downvotes my original comment got. The FF fanbase seems to have become a bit irrational and intolerant of anything said about FF that isn't fawning praise. That's disappointing.
The faster we can build usable decentralized apps and get users onto them, the better.
It should only lend urgency to leave the “old web” for those of us who are builders, makers and evangelizers.
They’re after encryption, they’re attacking anonymity, they want all of finance for themselves, and they want to kill privacy too -- I for one say NO thank you.
There is a level — almost a treble —- in these comments on how “it’s inevitable” or “already cooked” but only if you see these fights in isolation. It most assuredly it is not inevitable.
Let’s get positively focused and make hay while the sun shines and it’s not too late. There’s so much intelligence, compassion and love for humanity in this community. Let’s use it.
It should only lend urgency to leave the “old web” for those of us who are builders, makers and evangelizers.
They’re after encryption, they’re attacking anonymity, they want all of finance for themselves, and they want to kill privacy too -- I for one say NO thank you.
There is a level — almost a treble —- in these comments on how “it’s inevitable” or “already cooked” but only if you see these fights in isolation. It most assuredly it is not inevitable.
Let’s get positively focused and make hay while the sun shines and it’s not too late. There’s so much intelligence, compassion and love for humanity in this community. Let’s use it.
> in these comments on how “it’s inevitable” or “already cooked” but only if you see these fights in isolation.
It is, in fact, over.
Commodity hardware has no "escape hatch" anymore. If you want to, say, implement custom encryption or ensure anonymity/financial independence for yourself, you cannot stop the Powers That Be. You are helpless to resist Apple or Google or Microsoft if they tell you "no".
The fight was lost when we decided that we didn't need computing rights. The rest, as they say, is history.
It is, in fact, over.
Commodity hardware has no "escape hatch" anymore. If you want to, say, implement custom encryption or ensure anonymity/financial independence for yourself, you cannot stop the Powers That Be. You are helpless to resist Apple or Google or Microsoft if they tell you "no".
The fight was lost when we decided that we didn't need computing rights. The rest, as they say, is history.
Browsing these days is like going into jungle. I use Adblock, ghostery, noscript, pihole. To have a good experience you cannot go in unprepared. Some pages require some scripts to be running. Then I will not go in. I think it will be the same with WEI. If a page asks me for it, I will not go in. Sorry, but no. It may be harder over time, but if I cant't change the world, I van browse on my own terms. There needs to be extension that will be blocking WEI.
We need a list od pages that supports it and we need to same the for their support of WEI
We need a list od pages that supports it and we need to same the for their support of WEI
I'm sure Tom Scott wouldn't mind better personal attestation options on the Web: https://www.yahoo.com/now/prominent-youtuber-claims-brave-ba...
Interesting, I'm a fan of Tom's and agree with this take but have not known about it before now!
It's nice that they are changing their marketing on this a bit now that there is a wave to ride and the evils of DRM are coming for them; but, let's not forgot that, at the end of the day, Brave is just another company that makes money on ads :(, and (thereby) has most of the same anti-user incentives.
So, sure... they clearly don't want to be prevented from blocking other peoples' ads (a big part of their pitch); but, blocking their ads while still getting paid--which is, of course, extremely easy to pull off on an unrestricted computer--is an existential threat to their only actual revenue stream which they want to protect against.
The ramification: Brave's product managers--and even Brendan Eich himself (whom all of the later quotes I have in this comment were taken from, directly or indirectly)--have often talked about using the very same remote attestation technology to protect their SDK and even their browser for the same reasons as Google.
https://www.reddit.com/r/BATProject/comments/bw6sek/
https://www.reddit.com/r/BATProject/comments/b7rwbx/
> 1/ native C++/Rust code, no JS tags on page that have zero integrity. That means ability to use SGX/TrustZone to check integrity and develop private user score from all sensor inputs in the enclave; ...
> We already have to deal w/ fraud. That is inherent in any system with users and revenue shares or grants. We do it better via C++ and (under way) SGX or TrustZone integrity checking + OS sensor APIs, vs today’s antifraud scripts that are routinely fooled.
> What Brave offers that's far better than today's joke of an antifraud system for ads is as follows: 1/ integrity-checked open source native code, which cannot be fooled by other JS on page; ... (1) requires SGX or ARM equivalent, widespread on mobile.
https://www.reddit.com/r/BATProject/comments/
https://www.reddit.com/r/BATProject/comments/97trex/comment/...
> Part of the roadmap (details in update) is a BAT SDK. Obviously it would be open source, but more: we would require Secure Remote Attestation (Intel SGX broken but ARM TrustZone as used by Trustonic may be ok) to prove integrity of the SDK code in app.
So, sure... they clearly don't want to be prevented from blocking other peoples' ads (a big part of their pitch); but, blocking their ads while still getting paid--which is, of course, extremely easy to pull off on an unrestricted computer--is an existential threat to their only actual revenue stream which they want to protect against.
The ramification: Brave's product managers--and even Brendan Eich himself (whom all of the later quotes I have in this comment were taken from, directly or indirectly)--have often talked about using the very same remote attestation technology to protect their SDK and even their browser for the same reasons as Google.
https://www.reddit.com/r/BATProject/comments/bw6sek/
https://www.reddit.com/r/BATProject/comments/b7rwbx/
> 1/ native C++/Rust code, no JS tags on page that have zero integrity. That means ability to use SGX/TrustZone to check integrity and develop private user score from all sensor inputs in the enclave; ...
> We already have to deal w/ fraud. That is inherent in any system with users and revenue shares or grants. We do it better via C++ and (under way) SGX or TrustZone integrity checking + OS sensor APIs, vs today’s antifraud scripts that are routinely fooled.
> What Brave offers that's far better than today's joke of an antifraud system for ads is as follows: 1/ integrity-checked open source native code, which cannot be fooled by other JS on page; ... (1) requires SGX or ARM equivalent, widespread on mobile.
https://www.reddit.com/r/BATProject/comments/
https://www.reddit.com/r/BATProject/comments/97trex/comment/...
> Part of the roadmap (details in update) is a BAT SDK. Obviously it would be open source, but more: we would require Secure Remote Attestation (Intel SGX broken but ARM TrustZone as used by Trustonic may be ok) to prove integrity of the SDK code in app.
Blocking Brave's ads is literally three clicks. I don't care if I don't get paid if I block ads. What I don't want is to lose the ability to block ads or to allow websites to block me for using an unapproved system. Google seems to be working for both of those things while I don't see any chance Brave ever allows either.
You don't care... but Brave cares. The point here is that Brave has been talking up the same user-hostile tech for the same user-hostile reason: to prevent "ad fraud", as they are an ad company, like it or not.
...and, frankly, Brave isn't going to have any choice in implementing Google's plot: the web simply isn't going to work in Brave anymore if they don't, as web pages will just start refusing to give Brave any content.
The real issues are the very existence of remote attestation technology and advertisements as a business model / corporate incentive structure; imagine living in a world where we made both of these illegal.
...and, frankly, Brave isn't going to have any choice in implementing Google's plot: the web simply isn't going to work in Brave anymore if they don't, as web pages will just start refusing to give Brave any content.
The real issues are the very existence of remote attestation technology and advertisements as a business model / corporate incentive structure; imagine living in a world where we made both of these illegal.
"Men can always be blind to a thing so long as it is big enough." - GKC
We want our SDK (if we manage to build it) by which revenue share is distributed to be tamperproof and used by humans. You don't like this, turn off the BAT support in the SDK-using app, or use a different app.
Contrast this with Google WEI, which proposes that web pages (esp. the big ones, including Google's) can do this to all browser users, who get zero revshare, just battery draining ad-tech requests and malvertising risk.
See the difference? I have said openly that I'm a fan of Secure Remote Attestation but it has to be opt-in and user-first. WEI as a tool for Chrome supremacy on the browser side and Google on the ad-tech side is pretty much the opposite.
We want our SDK (if we manage to build it) by which revenue share is distributed to be tamperproof and used by humans. You don't like this, turn off the BAT support in the SDK-using app, or use a different app.
Contrast this with Google WEI, which proposes that web pages (esp. the big ones, including Google's) can do this to all browser users, who get zero revshare, just battery draining ad-tech requests and malvertising risk.
See the difference? I have said openly that I'm a fan of Secure Remote Attestation but it has to be opt-in and user-first. WEI as a tool for Chrome supremacy on the browser side and Google on the ad-tech side is pretty much the opposite.
Turning the browser into a foreign entity on your own PC. From the company that went from “Making the worlds knowledge accessible’ to ‘rentseeking on the collected knowledge and the trying to lock everyone else out from it’
"Brave's browsers" distributions of browsers, there ftfy
FWIW brave genuinely has multiple privacy patches that are useful and can't be done properly with extensions in chrome.
Several of these either can't be done via a js extension to chrome, or can be detected/bypassed. Brave does them in-engine which is the better way to do it.
https://github.com/brave/brave-browser/wiki/Fingerprinting-P...
Several of these either can't be done via a js extension to chrome, or can be detected/bypassed. Brave does them in-engine which is the better way to do it.
https://github.com/brave/brave-browser/wiki/Fingerprinting-P...
"We are a fork, have been all along"
https://twitter.com/BrendanEich/status/1684561924191842304
https://twitter.com/BrendanEich/status/1684561924191842304
...and then you click on that GitHub link and it explains that they fetch the Chromium codebase and then apply a set of patches on top of it. I wouldn't diminish that work by refering to it as just a reskin, but it's also not what I have in mind when I hear about something being forked.
They don't maintain a separate Chromium codebase, nor do they refer to it as a fork anywhere on GitHub. They do refer to it as a customised Chromium, which I think is a far more accurate description:
> Brave Core is a set of changes, APIs, and scripts used for customizing Chromium to make the Brave browser.
I also think of Chrome as a customised Chromium, not a fork of Chromium.
They don't maintain a separate Chromium codebase, nor do they refer to it as a fork anywhere on GitHub. They do refer to it as a customised Chromium, which I think is a far more accurate description:
> Brave Core is a set of changes, APIs, and scripts used for customizing Chromium to make the Brave browser.
I also think of Chrome as a customised Chromium, not a fork of Chromium.
> I wouldn't diminish that work by refering to it as just a reskin, but it's also not what I have in mind when I hear about something being forked.
If the goal is to maintain compatibility with what you've forked, there are not a lot of other ways to do what Brave is doing... when you do the classic fork, the code tends to diverge and compatibility decays.
> I also think of Chrome as a customised Chromium, not a fork of Chromium.
I've started viewing Chromium based browsers as distributions instead of forks.
If the goal is to maintain compatibility with what you've forked, there are not a lot of other ways to do what Brave is doing... when you do the classic fork, the code tends to diverge and compatibility decays.
> I also think of Chrome as a customised Chromium, not a fork of Chromium.
I've started viewing Chromium based browsers as distributions instead of forks.
> the “reskinned” claim is complete nonsense
With me that's a straw man, I haven't been using the word "reskinned".
The way he mentions Chromium proves my point that it's a distribution of Chromium.
Chrome is a browser because Google has Chromium, and they've chosen Chrome as the name for their distribution of Chromium. But it is also a distribution of Chromium.
With me that's a straw man, I haven't been using the word "reskinned".
The way he mentions Chromium proves my point that it's a distribution of Chromium.
Chrome is a browser because Google has Chromium, and they've chosen Chrome as the name for their distribution of Chromium. But it is also a distribution of Chromium.
I wasn't talking to you when I used "reskinned". Diatomaceous_ooze used "skinned", so unless you are they, why are you replying here? If you are ooze, quibbling over my adding "re-" won't get you far.
"Chromium" is not a distributable binary blob, so you're wrong in your essential claim. We don't distribute the same Chromium bits in Brave as Google does in Chrome. Chromium is open source software. We disable and nullify a lot, as the first document linked in my tweet details:
https://twitter.com/BrendanEich/status/1684561924191842304
"Chromium" is not a distributable binary blob, so you're wrong in your essential claim. We don't distribute the same Chromium bits in Brave as Google does in Chrome. Chromium is open source software. We disable and nullify a lot, as the first document linked in my tweet details:
https://twitter.com/BrendanEich/status/1684561924191842304
Hard to listen to anything from a company that constantly:
1) Doesn’t innovate on anything, social media accounts are plagued with pointing fingers at others while using a Chromium fork themselves, ignorance at its finest.
2) Has been accused of selling copyrighted data for AI training and has not made a public statement.
3) Has a history of making stupid decisions and only apologizing when a big news outlet calls them out.
1) Doesn’t innovate on anything, social media accounts are plagued with pointing fingers at others while using a Chromium fork themselves, ignorance at its finest.
2) Has been accused of selling copyrighted data for AI training and has not made a public statement.
3) Has a history of making stupid decisions and only apologizing when a big news outlet calls them out.
Seems like a biased opinion. Brave and their products innovate a LOT. Browser, (good) search engine, crypto as a way to keep websites profitable, etc.
do you remember when they put (silently) their referral code in crypto exchange websites?
lol, what a great innovation!
lol, what a great innovation!
I’m not sure their crypto had the objective to keep websites profitable. It looks more like a good hack to get rich by obtaining classic money with the sell of random numbers. But I’m not an expert in scams.
skilled(1)
I personally think the upsides of WebBundles are huge. There's nothing that would stop the browser from being able to filter & ignore content coming from in a WebBundle, so I'm not sure what Brave's greivance is here. The adserving topic is complicated as heck, but everyone seems to acknowledge big change is necessary & Google and Firefox both have proposals to radically overhaul the system while enhancing user privacy; Brave's own primary distinguisher at this point is their BAT tokens, their own answer here. There's complicated topics here, but I see Brave following the standard pattern of trying to be a lightning rod of discontent.
It's also surprising to me how almost no one has commented on Private Access Tokens shipping for Apple. Which do the same thing. Here's them bragging about being able to avoid catchpa's since the devices are all vouched for by Apple as unmodified & controlled by Apple: https://developer.apple.com/videos/play/wwdc2022/10077/
There was a decent submission on this recently, but not much engagement. https://www.snellman.net/blog/archive/2023-07-25-web-integri... https://news.ycombinator.com/item?id=36866355
I think this is absolutely the worst shit, almost as bad as MV3 being a utterly neutered shitty hell hole version of what web extensions were. But it's notable to me that both Google didn't start this particular trend, Apple did, and more broadly - I have such a hard time picking words here - it feels like the stark polemics have been on overdrive to create a reality distortion field, where Chrome is purely bad/evil/awful/no-good everywhere. We should be upset & mad! But I feel like we're pretty far into losing our minds territory, and slipping into strokes of broadsweeping public madness.
It's also surprising to me how almost no one has commented on Private Access Tokens shipping for Apple. Which do the same thing. Here's them bragging about being able to avoid catchpa's since the devices are all vouched for by Apple as unmodified & controlled by Apple: https://developer.apple.com/videos/play/wwdc2022/10077/
There was a decent submission on this recently, but not much engagement. https://www.snellman.net/blog/archive/2023-07-25-web-integri... https://news.ycombinator.com/item?id=36866355
I think this is absolutely the worst shit, almost as bad as MV3 being a utterly neutered shitty hell hole version of what web extensions were. But it's notable to me that both Google didn't start this particular trend, Apple did, and more broadly - I have such a hard time picking words here - it feels like the stark polemics have been on overdrive to create a reality distortion field, where Chrome is purely bad/evil/awful/no-good everywhere. We should be upset & mad! But I feel like we're pretty far into losing our minds territory, and slipping into strokes of broadsweeping public madness.
I don’t mean to be an apologist here, but Google’s vs Apple’s intention seem crystal clear.
Google is trying to make it impossible not to see the ads it’s selling. Apple’s intent seems to be lock down the Apple platform…? I know Apple is blatantly abusive in lots of spaces, but Chrome is a super-majority of the browsers in use. It’s an odd take to spin this into “they started it” finger pointing.
The reason Chrome is getting all the hate is that Google finally realized its power, position, and needs and became self-serving. Apple is just a lesser demigod is this fight.
Google is trying to make it impossible not to see the ads it’s selling. Apple’s intent seems to be lock down the Apple platform…? I know Apple is blatantly abusive in lots of spaces, but Chrome is a super-majority of the browsers in use. It’s an odd take to spin this into “they started it” finger pointing.
The reason Chrome is getting all the hate is that Google finally realized its power, position, and needs and became self-serving. Apple is just a lesser demigod is this fight.
The stated goal of both is the same: to provide a privacy-preserving primitive for anti-abuse. Both explicitly state that the goal is not to exclude competing browsers or operating systems or to limit things like browser features or extensions.
You're just assuming that they're both lying about the motives, and making up the worst possible motives you can think of for each. I think in both cases you're wrong, and the stated goal is the actual goal. (Apple is not looking to lock down their platform with this, and Google is not thinking about ad blockers at all here.)
Their reasons for needing such an anti-abuse primitive are not the same, but the mechanisms are very similar, and the range of attestations they could provide without public opinion or regulatory backlash is probably almost identical.
You're just assuming that they're both lying about the motives, and making up the worst possible motives you can think of for each. I think in both cases you're wrong, and the stated goal is the actual goal. (Apple is not looking to lock down their platform with this, and Google is not thinking about ad blockers at all here.)
Their reasons for needing such an anti-abuse primitive are not the same, but the mechanisms are very similar, and the range of attestations they could provide without public opinion or regulatory backlash is probably almost identical.
If you're pointing a gun at me, I don't care if you say it's your intention not to shoot.
Whether it's their goal or not to exclude competing/upstart browsers and operating systems, that will be the end result given the content of the proposed standard.
Whether it's their goal or not to exclude competing/upstart browsers and operating systems, that will be the end result given the content of the proposed standard.
Google is not thinking about ad blockers at all here.
The first example in the WEI doc is enforcing that ads are viewed by humans: https://github.com/RupertBenWiser/Web-Environment-Integrity/...
The first example in the WEI doc is enforcing that ads are viewed by humans: https://github.com/RupertBenWiser/Web-Environment-Integrity/...
Sure, and that text has nothing to do with preventing the blocking of ads. It is not saying "humans shall be forced to watch ads", like you're implying. It is saying that bot clicks/views to ads should not count. (It is also saying that websites want proof of probable humanity, usually via captchas, and we should have better ways of doing that. But that aspect of the bullet point isn't really specific to ads in any way.)
I don't pay enough attention to comment on Apple, but of course I assume Google is lying; they're an adtech company trying to ship something that would make it trivial to break all adblockers. Why would you ever trust them?
Because it is functionality they really need for other (legit!) reasons, and since trying to turn it into an anti-adblock technology would be a PR and regulatory nightmare, and make it harder to ship for the uses they actually need it for.
Lying tends to be stupid, especially for a company under so much scrutiny.
Lying tends to be stupid, especially for a company under so much scrutiny.
[deleted]
I was trying to paint a broader picture of how we view Google. I think in many cases there is a lot more complexity, and in most cases, we don't see or appreciate a lot of good things that do help us all. blink-dev is generally a pretty great mailing list of good things, in my view.
This comment is a return to what kind of disturbs me, of using a very narrow focus on one specific thing: one specific thing I already said is the very worst shit.
This comment is a return to what kind of disturbs me, of using a very narrow focus on one specific thing: one specific thing I already said is the very worst shit.
[deleted]
Still excuse after excuse after excuse to just not use Firefox. I literally don't care if you have to hold up your nose, there's only one actual alternative browser engine, and it's a matter of survival for anyone who doesn't want the whole internet controlled by google.
It could be half as fast (it isn't) and use twice as much RAM (it doesn't) and ask for a damn nude photo of me and I'd still be using it right now.
Using a google owned browser engine is like growing cavendish bananas while you know the neighbor's farm has the blight already. Change over and try to get good at the new strain while you have a choice, because soon you won't and it will be out of your hands what happens after that.