- cross-posted to:
- privacy@lemmy.ml
- technology@lemmy.ml
- cross-posted to:
- privacy@lemmy.ml
- technology@lemmy.ml
Mozilla’s position on WEI is pretty solid.
You must log in or register to comment.
Mozilla try not to be based challenge (impossible)
I fear Mozilla will oppose it right up until they implement it, they know who butters their bread and their CEO has a hunger for loafs.
They have already opposed it, and your speculation based on your dislike of their CEO probably isn’t helpful. It’s against the open web and Mozilla has no incentive to implement this. It’s something only an ad company would be keen on.
It is based on them being wholly funded by Google, I think it is helpful to point that out when we are talking about them biting the hand that feeds them. If Google does in fact force this upon you to use their services then Google search will be part of that and Google search is where Mozilla makes a vast majority of its funding.
Right now they make money from google for default search because they pay the most. Previously they went Yahoo and could go bing. They did not implement web manifest v3, so you’re insinuation isn’t based in fact. Plus, this has nothing to do with search, it is to do with after search when on a website.
If Google is pushing a feature to secure higher ad revenue they’re obviously going to implement it on their own services such as search. As for Bing Microsoft have implemented Manifest v3 in Edge and it’s unlikely they will skip out on Web Integrity. Time will tell but it’s likely Firefox will be pushed into supporting it.
I don’t think MS implemented it. It’s chromium, they just took the code base. Some browsers actively removed it, but when you’re based on chromium, you start with the code that google gives you.
MS taking a codebase and doing nothing with it logically makes no sense to imply that Firefox will purposely resource and write code contrary to web freedoms.
Whether they implement in web search is speculation, they’d be purposefully downranking companies in search for not implementing something that cost them revenue excluding their customers. It would be google vs companies, and it wouldn’t be pretty.
Either way, state your position. Are you suggesting people should roll over and take it, or move to Firefox, because all this side debate is doing nothing useful.
I don’t think MS implemented it.
Their decision is detailed here: https://learn.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3
Whether they implement in web search is speculation
Sorry if it wasn’t clear from my original comment but yes this is speculation for the future.
Are you suggesting people should roll over and take it
I’m suggesting people aren’t going to be given the choice if this is actually pushed through to the full extent that Google is hoping. Fighting against it is obviously the right move but it doesn’t hurt to imagine a future where that fighting has no meaningful effect.
because all this side debate is doing nothing useful.
Not all discussions are a debate, and these discussions need to be had.
I use waterfox currently. If this takes off, I will browser shop until I find a browser that doesn’t implement it. If i come across any sites that don’t work, well, I just won’t use their sites anymore.
And when all the sites stop working?
the site i mostly use is kbin and other open source/privacy respecting sties, and I doubt ernest would implement WEI on this site. Any other sites, I can do without. they don’t want my viewing? fuck them.
Well if they don’t cave and stick with it the CEO can butter my loafs all they want.
Although a comment close below puts a little dent into that ^^
https://github.com/mozilla/> standards-positions/issues/852#issuecomment-1649928726
I guess, even if “it contradicts our principles and vision for the Web.”, it might happen just like the past:
https://hacks.mozilla.org/2014/05/reconciling-mozillas-mission-and-w3c-eme/ Formal objection: FLOSS and EME w3c/encrypted-media#378 https://daniele.tech/2014/05/firefox-drm-and-w3c-eme-complicated-technical-matter/
I don’t think Firefox’s position is unreasonable here. Ultimately, the old way of distributing copy-write content wasn’t going to work. Companies that had right to something, couldn’t easily distribute it without a large risk of piracy and a tanking of revenues. Having a sandbox around proprietary shite made sense and protected users privacy while also enabling the content providers to maintain their asset.
Removing ad blocks is a wholly different ball game. Google obviously has a stake in it because YT is funded by ads. Maybe some ad driven content providers also, but subscription driven services don’t have the same need for that. It does seem an unholy alliance between content providers and big tech has been formed and it could be something at play again.
I actually agree and appreciate your response. I was just poking a little fun at the “impossible” there but Firefox absolutely has been an invaluable voice for neticens all over the world.
❌ Play DRM-controlled content
Will keep supporting Firefox 👍👍👍
It’s funny, I always kept Firefox and Brave (yes I’m aware its chromium and full of fuckery) installed. But as soon as this news broke, before it was even confirmed, I swapped back from Brave to Firefox as my primary. Fuck Google for this. They’re just truly not the company they once were.
They never really were the company they claimed to be.
Oh god no, never said otherwise. But for years they struck this equilibrium between evil and quality of services offered in exchange. That value had been rapidly deteriorating for the last 5 years or so. It’s just sad to see is all.
I feel like at least they tried to put up that illusion at some point. But that mask has fallen.
Why do I feel like it isn’t the death of the internet as we know of, but rather the sharding of the internet. The corpo plaza internet is clearly emerging, we have to make sure we support and hold up the everyone else internet
With banking, streaming, there isn’t really an easy alternative. This could be a locking out that could be quite disruptive.
I’d just like to interject for a moment. What you’re refering to as streaming, is in fact, piracy/streaming, or as I’ve recently taken to calling it, piracy plus streaming.
Problem: banking, health care, and the government are on the corpo plaza internet, and you are required to deal with them.
The problem is we can’t just not use their internet - I see extending the fediverse as a great way to bring back the original promise of the Internet, a free place for collaboration and exchange of ideas.
But we still need to use the normal Internet for daily life. The potential control here goes so far past ad blocking or browser choice - what happens when they start deciding what apps you can have, or what os, or if your using an unmodified locked down system without root access?
Plus, you have legislation like kosa that could be used to restrict people from operating websites locally in the US.
This move alone wouldn’t kill the Internet, but you have to look at the wider context. This is an inflection point - tech giants are on an all out money grab, and a lot of important battles are going to happen back to back. Losing any one of them will be just an inconvenience, but all together they’re going to redefine the rules moving forward
as everyone should
I feel like it’s worth reopening the sub just to share this.
Like, I’ve been watching reddit all day, waiting patiently for this news to hit the fan, and I’m not seeing it anywhere. Like…I’m kind of stunned. This is exactly the thing I would think would blow up on Reddit.
deleted by creator
Would projects such as Ungoogled Chromium be affected? Or possibly, is it something one could cut out from the source code?
i think the problem is most websites would follow google and maybe those webpages will only work on chromiums
And then we’re back to the IE6 days.
I think it would be risky, companies will roll it out think people who are on chromium will move to chrome, or their browsers will support this. If people move to Firefox, companies know that a percentage of their users will be prevented from using this, and it could cost their marketshare/revenue. Google cannot be trusted to dictate web standards any more, and Mozilla is the best placed to break that hegemony.
As long as safari don’t adopts it, i don’t think the web will, that is the ios user-base but we still shouldn’t let our guard down.
I’m outta the loop on this whole situation, what’s going on?
Web dev here. It enforces the original markup and code from a server to be the markup and code that the browser interprets and executes, preventing any post-loading modifications.
That sounds a bit dry, but the implications are huge. It means:
- ad blockers won’t work (the main reason for Google’s ploy)
- many, if not most, other browser extensions won’t work (eg.: accessibility, theming, anti-malware)
- people are going to start running into a lot of scam ads that ad blockers would otherwise prevent
- malicious websites will be able to operate with impunity since you cannot run security extensions to prevent them
- web developers are going to be crippled for lack of debugging ability
These are just a few things off the top of my head. There are endless and very dangerous implications to WEI. This is very, very bad for the web and antithesis of how it’s supposed to be.
TBL is probably experiencing a sudden disturbance in the force.
I think you’re missing the fact that if google doesn’t attest for your software choice, the website could prevent access. It is google trying to take ownership of what is and isn’t supported software when accessing the internet. This is far more serious that a few adverts, this could be the removal of liberty on the open web.
That’s the “endless and very dangerous” part.
I appreciate that, I just thought it’s worth spelling out so people really get the gravity of this situation.
Any idea on what happens to DNS level blockers?
I’m not saying you’re wrong or that Web Environment Integrity is a good thing, but a primary source and citation is needed for this statement:
It enforces the original markup and code from a server to be the markup and code that the browser interprets and executes, preventing any post-loading modifications.
Read between the lines, dude. Ad blockers work by observing and analyzing the DOM for elements presenting or containing ads and subsequently removing or obscuring those elements by manipulating the DOM. There’s no way for WEI to carry out its purported goals without forcibly preventing DOM manipulation.
There are absolutely no conceivable benefits for users. None.
I don’t disagree, and I’m personally aware of the consequences. Adding the API would be the first step, and future proposals and changes could amend it to add other environment details to tell a website that there are browser extensions that can read or modify the page.
I don’t really think summarizing WEI as though it already includes those really helps people understand what WEI currently is or does, though. Nobody reads the actual documentation before repeating what they were told, and that’s going to lead to the spread of factually-incorrect information. It’s not a bad thing for people to be aware of the long-term issue with having a WEI API, but users’ lack of understanding of WEI in its current form is just going to be used by Google as proof to dismiss dissenting feedback as FUD.
I didn’t read through the entire spec, but I read enough to sniff out their Trojan horseshit. I’m not regurgitating anything, I’m calling it as I see it.
This is of benefit to no one but for corporate overlords to do more overlording. It’s fixing a problem that doesn’t exist.
I don’t know why you’re trying to hard to defend one the biggest corporations on earth that decidedly not-not-evil, but if I ever need a top notch recipe for robust leather footwear, I’ll be sure to call you up.
So your suggestion is hopefully later, google will allow extensions even though their proposals are against it. This is the company that rolled out web manifest v3, a proposal to limit and remove extensions. Their past actions have demonstrated motives opposite to what you are implying could happen. It’s entirely wishful thinking.
Google may want to place themselves judge and jury of what software is allowed on a computer, but anyone of sane mind should not be considering allowing them.
HTTPS already prevents man in the middle attacks and changes to the website content to protect users. This is to protect companies from users. It’s horrific and an attack on the web freedoms that have so long been held.
I believe there’s a misunderstanding somewhere. I wasn’t suggesting anything; I was explaining how Web Environment Integrity could be altered in the future to kill extensions.
The current form of WEI does not have the ability to enforce anything. It isn’t itself DRM, and it can’t prevent extensions from running on pages. What it can do and the only thing it does, is tell websites about the browser environment.
Right now, the only thing it tells websites is the name of the browser. A website having the browser name can’t directly enforce page integrity. It’s already possible to find out the browser name through the user agent or by fingerprinting it with JavaScript.
If WEI is approved and implemented, that opens up the possibility for future additions to the specification. Those changes could require that the browser sends more info to websites. I gave the example of a change that would require WEI tells the website that the browser has an extension which could modify the page contents.
A website having that information would turn WEI into DRM. It gives the website the choice to refuse service to any browser that is running an extension that could change what the user sees.
I hope that was more clear. I don’t expect Google to make changes that immediately block extensions, and then be kind enough to allow some of them back. I suspect they would make changes that don’t prevent extensions, and then revise them to prevent certain types of extensions.
I think most of what you have said is reasonable.
I think the concern I have is in what they said they will do. That is quite disturbing, and unless they are lying, that is where their intention is. Combined with web manifest v3, it’s clear they are quite motivated and they have a long term plan here. They’re dropping it piece by piece perhaps to remove opposition to it. Rather than stab someone to death, it’ll be death by papercuts. My view is we should take the paper off them now based on what we know, rather than waiting until they kill someone.
My concerns is beyond extensions, it’s when it goes towards browsers, and operating systems. My concerns is with the focus on attestation, is this is going to have the potential to tie in to TPM and could be potentially used for fingerprinting based on hardware regardless of what you try to do. There is a number of things in motion that independently seem benign but when combined together, are absolutely disturbing. Giving google control over what is and isn’t approved is dangerous. They simply cannot be trusted.
To elaborate on why I’m saying a citation is needed: I read the entire proposal and specification myself, and I couldn’t find evidence affirming the statement.
The Web Environment Integrity explainer document doesn’t require, suggest, or mention script or DOM integrity status under what information is in the signed attestation. Neither does the draft specification, which is pretty devoid of details. The closest it comes to that kind of thing is only enabling the API within a secure context, which basically means “the page was served over HTTPS using a valid certificate”.
That doesn’t mean that WEI can’t be used to enforce page integrity in an extremely roundabout way1, but lacking a citation showing that it directly does that, it needs to be explained to people who are out of the loop how it can do that.
1: One of the environment details sent to a website is a unique identifier for the browser. Blocking every browser except Android Chrome would limit the ability to use extensions to modify the website, since that browser doesn’t support them.
The internet is getting fucked by Google.
this just in, google doing what google does. More at 10.
Google (or Google employees) came up with a “trust attestation standard” that would supposedly let sites know if a user was a human or not, but because the attestation required a third party and some trust mechanism locally, it would further enclose the Web around Google
Can someone ELI5 this
When you want to access a website, the server will ask your browser “Is the user’s environment good for me to show my website?” and will only provide you the website if your browser agrees. What this essentially means is that ad blocking or any other scripting on your side could make your browser say “No, there’s some fuckery going on” and you would no longer be served the page.
Is this why people don’t like google AMP links? Because the AMP links can prevent adblockers from working
AMP links serve other people’s content from google’s servers meaning you never leave their domain.
It’s like going to a restaurant but you can only order from the pre approved from Google menu that they don’t mind if you have allergies. What they mind it’s what kind of car you use to come to the restaurant.
Google is making a system to verify any given user is running a verified browser on a verified OS on verified hardware (TPM).
The first problem is that only big tech companies will be able to pass any of these verification steps. Say goodbye to your modifiable, community-driven, open source OS or browser.
The second problem is that the only software they choose to verify well be increasingly restricted. Say goodbye to your ad-blocker, because Google makes the browser and they’re the one selling the ads.
You can still an unverified browser, I suppose, but websites decide whether to let you in or not. And Google will reduce their ad revenue if they don’t “verify” their users.
I feel like our best bet is EU regulation against this kind of monopoly.
I dont get it. Doesnt the US have an anti monopoly agency?
Most countries have anti-monopoly agencies. Whether they are of a mind to take action or not is another question entirely. Sometimes they are absolutely toothless. I miss the days when they used to do stuff like when MS was prevented from forcing browser/search engine (I cannot remember which) by default etc.
We absolutely should try to lobby as much as we can to nudge them to act, but I don’t think we can rely on government agencies alone. MS recent acquisition shows that agencies are either not motivated, or not competent enough to oppose tech giants.
