Hacker News Reader

Comment by tentacleuno | Hacker News Reader

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices

The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1].

I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do we protest this? Google will just strong-arm their implementation through Chromium and, when banks, Netflix & co. start using it, they've effectively cornered other engines into implementing it.

This isn't new to them. They did it with FLoC, which most people were opposed to[2]. The most they did was FLoC was deprecate it and re-release it under a different name.

The saving grace here might be that Firefox won't implement the proposal.

[0]: https://github.com/RupertBenWiser [1]: https://github.com/RupertBenWiser/Web-Environment-Integrity/... [2]: https://news.ycombinator.com/item?id=26344013

View on HN

> how do we protest this?

You do not and you cannot. It was written in stone once Chrome dominated the browser market. What Chrome (Google) wants, Chrome (Google) gets. Despite all the good engineering Google wants to sell ads, that's all there is to it. And the result is this proposal.

> The saving grace here might be that Firefox won't implement the proposal.

It's irrelevant and we are an irrelevant minority. Unless people switch to FF in droves the web is Chrome. And they won't because at the end of the day people just want to get home from their shitty jobs and stream a show. As long as that works everything else is a non-issue.

We could at least get everyone here to use Firefox. There's really no excuse for a technically minded person to still be using Chrome for their day to day browsing.

If you do eventually run into a poorly crafted webpage that doesn't work on Firefox you have the wherewithal to decide if you are simply not going to use that site or hop over to chrome just this once.

But the important thing is checking in automatically as a Firefox user in the logs of every other site online. Push Firefox marketshare up and at least some places will be hesitant to write off Firefox as irrelevant.

> We could at least get everyone here to use Firefox.

That would accomplish nothing.

> But the important thing is checking in automatically as a Firefox user in the logs of every other site online.

No, that's not important. HN users are a tiny minority compared to the billions of people that use the web daily.

I'm sorry, there's no easy way to say this: Firefox is never coming back. The web of old is never coming back. It's over. Even if this particular proposal gets defeated somehow, a future similar proposal will make it through. There is nothing you or I can do about it. Google is more powerful than most governments, and they are vastly more powerful than any random group of like-minded people who get together on the Internet in the belief that they can accomplish something.

A defeatist attitude like this certainly predicts the future... If you're playing by the rules. And the rules were set by Google, so it's in your best interest to break them by actively harming Google. Restrictions in choice happen because people don't oppose the narrowing enough to make the corporations lose money. This might be one of the few times where targeted malware could be beneficial if it destroys Google's services and makes them too much of a risk to use. If somebody puts a latent trigger into a Javascript library that's widely used like Node.js that makes Chromium and only Chromium break then that would start a cascade effect of Chromium locking itself up more and more until it's impossible to use. You could even make cookie bombs, where you have two cookies, and when one expires before the other it triggers the surviving poisoned cookie to ruin Chrome's functionality by poisoning the browser agent. Google wouldn't be able to trust anything they didn't make themselves. You can force Google to barricade themselves in until it's impossible to reach them, and have them do it so fast that updating systems for developers and users would be too much of a pain to constantly keep up with. The downside is once you use a tactic like this then it's not just Google that wouldn't trust anything they didn't make themselves.

> That would accomplish nothing.

Firefox came into the mainstream because of power-user recommendations and the browser ballots.

It should be illegal for a significan platform (say 10mln users) to make its own browser, or any really, the unquestioned default. Users should be prompted on first use, giving a randomly ordered selection of any capable browser. If users can just click through it the choice should be random.

This is the only way to maintain healthy competition and ensure independent yet functional standards. Otherwise incentives will continue to centralize power.

You're describing the old Firefox before they became Google's controlled opposition. Since 2011 all they have done is continuously stripped out every useful power user feature in a bid to turn into a shitty copy of Chrome; the last straw was gutting their powerful XUL/XPCOM extension system in favor of Chrome's far limited web extensions because muh security (and since then there's been more, not less cross browser malware). Today you can't even write your own extension for use on the main build thanks to forced extension signing (which ended up disabling everyone's extensions a few years ago due to an invalid certificate). And that's before all their unethical tracking, in browser advertising and privacy violation over the years, that requires various 'hardening' about:config changes out of the box, or the erosion of configurable features with almost every release. Mozilla are woke hypocrites today, financially dependent on Google while claiming to be privacy champions and squandering their money on multiple other projects instead of focusing on Firefox. The only browser that continues to be the old Firefox in spirit - the one that upended Microsoft's IE monopoly - is its hard fork, Pale Moon (which gets derided as oLd aNd iNSeCuRe by Mozilla fanboys). Doesn't need any 'hardening' because it doesn't snoop on you to begin with, and the latest versions have massively improved web compatibility while retaining support for the original powerful XUL extension system.

My point wasn't to gush praise on Firefox here, rather to point out that we need browser ballots again -- and permanently.

Otherwise Palemoon is as doomed to obscurity as Firefox, if not moreso.

It may well be too late, given Google has absolute control over web standards and their policy of introducing draft features in Chrome and then making them part of the standard. Unless an anti-trust case is brought against them which explicitly mentions their browser engine and standards monopoly, and correctly points out that every other browser today is just a skin around Chrome while Firefox is controlled opposition. Every case against them seems to obsess on the search engine monopoly.

>Firefox came into the mainstream because of power-user recommendations and the browser ballots.

But it was a completely different situation.

- There was a huge influx of new internet users who were all asking their techy friends which browser to use. This is not the case now. People mostly stick with what they know.

- FF was the better product for pretty much all use cases. If this proposal does go through, this will not be the case. It's nice that FF can block ads, but it's ultimately useless if the average user won't be able to access Netflix/Youtube/Facebook/their bank account. It will be an objectively worse browser.

Browsers are increasing in importance even today, not decreasing.

And as I said, the sustainable solution is browser ballots back by the force of law. It's worked where it's been tried.

Anti-trust based solely on narrow definitions of consumer harm on the other hand, serve only the capital owners. And they'll leverage and co-opt any and every popular and useful innovation: open source, community contributions, open standards, patterns light or dark, etc.

>Google is more powerful than most governments

See that's where I disagree. Rich governments like the EU or the US can and do have power to push regulations if they wanted to. Pretending we the people (in a broad sense), i.e. the state, have no power whatsoever to control the terms under which these companies operate within the state, is defeatist.

Bringing up "We, the people" here is ridiculous, regardless of the "sense". We have zero power. Zero. Protests, revolts, riots ... all make no difference anymore and making a cross on a piece of paper once every couple years, aka voting, doesn't give us power. Anyone believing that is a fool.

It certainly allows us to avoid the worst of 2 evils in any case and nudge the ship of state away from obvious rocks where extremist positions cause politicians to lose elections. Furthermore many states have a means for individuals to directly make law on matters that directly concern enough sufficient voters.

Sounds like defeatism. By writing such comments you only help Google and make people resign from doing anything. Good job... It won't be easy, but it is not impossible to change the world. There are many, many intelligent people around. We just need to work together to achieve our goals. BTW EU has shown, multiple times, that it is powerful enough to impose regulations on tech giants like Google, Facebook or Apple.

Google is not stronger than the EU.

This presumes that the EU

(1) Understands what this is about

(2) cares about its citizens' freedom

(3) has enough coherence to actually do something about it

It's not obvious to me that any of these apply. The EU is pushing -- in fits and starts -- towards self-reliance in its computing infrastructure, but at a slow pace.

Of these, number 1 is probably the most doubtful. The EU, however boring that line of thinking is, is still quite bureaucratic, and it's doubtful that measures to control this, might not be a priority of bureaucrats. After all, the regs I mention later are in the name of "less e-waste" (which is good, but besides the point). So something like "control web DRM" might not be as blatant and easily solved (your point No.3).

For number 2, the EU's new regulations above more easily replacable batteries, mandatory USB-C ports and such, in my eyes prove -- though not doubtlessly -- that they do care about walled gardens in tech.

Number 3 though, again, as I've alluded to before, doubtful. But possible in my eyes. Urgency is another thing you've mentioned, and -- let's say it again -- bureaucrats are not particularly known for solving a problem in the right time.

NB: don't misenterpret my use of 'bureaucrat[ic]' as a negative comment, it is just a fact, however boring.

We've tried nothing and we're all out of ideas. Google is not more important than most states, you underestimate the scale and power of states.

I use Vivaldi (not chrome itself but another Chromium browser) because I want PWA support on my Linux machine so I can have an app for outlook with notifications and Chromium browsers make that far more convenient than Firefox.

If your sole holdout for using a chromium browser is an outlook app, I suggest you go looking around the keyword "email" in your package manager.

I’m not stupid, of course I tried that first

Essentially this doesn’t work because every email client I tried can’t handle the specific way my work email account does authorization and the login always fails. They also blocked POP/IMAP so that’s not an option either. No one else in a team of software engineers figured out a better way to access email so for now this is the best option

> There's really no excuse for a technically minded person to still be using Chrome for their day to day browsing.

Sadly, Chrome is substantially more secure than Firefox.

It is extremely disingenuous to claim the only browser to still refuse to block third party cookies by default, because it helps their ad partners, is "more secure".

The only way in which Chrome is more secure at anything appears to be securely forcing you to view ads via this API. And a shocking amount of malware fails to work when you use a running environment that 95% of society are not using.

You are far safer on Firefox than Chrome.

How are third-party cookies a security (not privacy) risk?

Privacy and security are the same thing. You cannot have one without the other.

Why do most FAANG-type businesses require use of Chrome then?

So as someone who deals with enterprise software: Network effects.

Where I work, we treat Chrome as the malware it is: It's banned both by technical measures and security policy. We deploy Firefox, and begrudgingly deal with Edge when people insist on a Chromium-based browser. (At least Microsoft added some modicum of privacy settings here.)

Here's what I've learned over the past several years: Web developers are lazy. We're commonly told such and such app or service "only works on Chrome" or they'll "only support on Chrome". When we call for support, half the time we'll get told it's because we're not on Chrome, and I have to actually prove to them on an isolated machine that the issue occurs on Chrome so they'll shut the heck up and do their job. "Oh, I found an issue on our server" after I spent two hours trying to convince them their app works fine on Firefox.

In most cases, things "not working on Firefox" entails exempting a site from the popup blocker. In 2023, troubleshooting alternative browsers is usually... roughly that easy. But blaming your web browser is easy and lets them shift blame, so that's what they do.

But enterprise software companies have completely turned Chrome into the modern Internet Explorer: The only browser they'll even deal with. And since a lot of people buy Google's marketing that they know security and aren't completely clueless how security works (they are), people have by and large given in and installed Chrome.

> It's irrelevant and we are an irrelevant minority.

Heh. I was there when it was IE6, and people said the same.

I was there too. People always say this, but just because a thing changed once does not mean it will happen again. In this case, the population scale alone has changed by over an order of magnitude.

Just doing some quick searching - the first numbers that come up when you search for "how many people used the internet in the year 2000" are on the order of 350 million or so. Comparatively, now, in 2023, Reddit alone has some 450 million users. It would seem right now that Tiktok has about three times the number of active users than there were total Internet users 23 years ago.

Additionally, there are literally hundreds of billions of dollars now resting on Chrome remaining the dominant browser.

Short of government intervention (or absolutely monumental fuckup on Google's part somehow), Chrome is here to stay.

Yes. The solution is very simple: uninstall Chrome and Chromium.

We are the people with the most influence on the tech. We are prescriptors. We are legion.

– Yes but Chrome is a tad faster and I have my bookmarks and my favorites extension and blablablabla…

— Then you are the root cause of the problem. If you are not ready to sacrifice an ounce of comfort to save the web, then you are the one killing the web.

Simple: install Firefox. Now.

(oh, and, by the way, also removes google analytics and all google trackers from the websites under your control. That’s surprizingly easy to do and a huge blow in Google monopoly. There are plenty of alternatives)

> There are plenty of alternatives

Yeah, not for long. Go back and read the proposed changes.

Please explain what you mean. It sounds like you have an important point that can only be found if people sit and carefully read several pages. Important points deserve to be stated more plainly.

The entire point of this spec is that your alternative browser wouldn't be able to attest to its "integrity" unless it was exactly as locked down as the other ones. If you have some kind of rebuttal to the shared context we all otherwise have, maybe you should be the one forced to state it more plainly.

Okay, so you're not saying that we're going to lose the ability to use another browser, just that the other browsers might not be good for much.

I think the comment you originally replied to is trying to say "use the other browsers, even if they are not good for much".

For google analytics and the like there are a lot of alternatives to be fair, I've started using Simple Analytics on all my sites.

> The solution is very simple: uninstall Chrome and Chromium.

No. Firefox, beyond being slower, also keeps constantly displaying ads… for itself. Want to open a new tab? “Big Browser cares about your privacy, read how!” I just want to open a new tab!!! I’m working! Restarting? “Discover what’s new with Firefox”, “Hohoho, we care about your privacy, LOOK HOW MUCH WE CARE! ALSO WE HAVE NO ADS!” Worse, they suggest to solve privacy that I use Mozilla VPN. VPNs don’t solve privacy. Also, it’s a paid ad for a paid product.

Mozilla had also a staunch political slant, going as far as firing a CEO for a donation he made to the opposing group years ago. There is nothing neutral here, if you are not a leftist, it’s dangerous to use or even give your participation to that ecosystem.

Mozilla has failed to become the no-ads, better-ethics, privacy-aware navigator (pun intended). They keep performing worse actions than Google all the time.

> Firefox, beyond being slower, also keeps constantly displaying ads

One tab with an ad opening when the browser has updated every few weeks or so is not what I would call "keeps constantly displaying ads".

There isn't a moral dimension attached to loving the right kind of people and gay and straight people are equally moral in pursuing relationships with significant others. On the other hand there is a moral dimension to trying to take away our fellow citizens rights. The CEO as the face of the org became unsuitable to his role when he acted publicly and objectively immorally in support of those who would gut the rights of his fellows

He wasn't on the wrong side of a political issue he was on the wrong side of decency and morality. This ought not to be a leftist position nor should we fear that the tyranny of excessive concern for others may be imposed upon us. Should we decide to use Firefox for evil as it were the privacy both endorsed and adhered to by Mozilla precludes them discovering it let alone stopping us.

The position of user of Firefox and public face of Firefox are inherently different positions and come with different reasonable expectations but I think you knew that.

> it’s dangerous to use or even give your participation to that ecosystem.

Please describe precisely the threat model you fill most applicable

> keeps constantly displaying ads

For a definition of constantly redefined to mean rarely when a new major version comes out.

> They keep performing worse actions than Google all the time.

The context here is that google tracks everything you do and regularly shares it with the government including under terms that are obviously abusive of user privacy and including to repressive governments, are in the middle of attempting to destroy ad blocking by pushing locked down environments in the name of security. A move likely to have massive implications that will be impossible to manage or control in repressive dictatorships even if Google themselves do nothing to directly assist with mass surveillance in Orwellian states. Merely building general purpose tools virtually guarantees bad usage by repressive regimes. By contrast Mozilla has? Tried to pimp their VPN to you as part of their new version notification...

It really sounds like the Brenden Eich debacle has colored your perception of the situation and perhaps you need to step back and evaluate the situation objectively.

Brendan Eich getting fired was like watching the original internet get murdered by progressives. Everything since then has been about how I thought that would go.

He spent money to promote misusing a legal process to as it turns out illegally take his fellow citizens rights away.

Why do you think that's acceptable?

A guy gave a $3100 dollars to a political cause of his choice that was on the ballot, and people with this ideology drove him out of the company he founded that fought very hard for internet freedoms.

Since then, Mozilla/Firefox has largely become irrelevant and absolutely no longer has the same privacy concerns and respects.

He donated money in opposition of a law he didn't want to pass. He didn't take anyone's rights away.

https://waterfox.net/ to the rescue.

Surely you don't mean Waterfox that states in their FAQ[0]:

"Who owns Waterfox?"

"System1 now own Waterfox, but Alex Kontos is still leading the direction of Waterfox and will be for the foreseeable future."

And who's owner, System1, states at the top of their page[1]:

"System1 operates the most dynamic Responsive Acquisition Marketing Platform

Connecting high intent customers with advertisers at scale"

[0]: https://www.waterfox.net/docs/faq#5-who-owns-waterfox [1]: https://system1.com

Get with the times, Waterfox is independent of System 1 now. https://www.waterfox.net/blog/2023/07/03/a-new-chapter-for-w...

I surely do mean exactly that particular Waterfox. I've had my fair share of concerns back in the day when System1 acqui(hi)red Waterfox, but I haven't seen any suspicious behaviour whatsoever so I'm pretty confident it's fine for the time being.

Of course, if you know a better browser (that is not Chromium-based), I'll be happy to hear your suggestions!

>Simple: install Firefox. Now.

No.

>I was there too. People always say this, but just because a thing changed once does not mean it will happen again.

The problem is that the web standards have now grown so much that it is impossible to write a complete new web browser from scratch. Firefox is not coming back, because Mozilla seems to prioritize other things than code quality and the actual usability of their software.

And yes, I know that the SerenityOS developers are trying to do it, but while some very advanced things work "good enough" in their browser so that Twitter and Discord's web client works to some extent, the more basic things are so broken that their browser cannot even render basic HTML 3.2 sites properly.

Google's end goal is probably to "deprecate" HTTP 1.x and force everyone into using their own replacement for the protocol. Their protocol is going to be like the thing they call "HTTP2", an insanely complex protocol that is impossible to implement by a small developer team. In the end their own protocol becomes a "rolling release" protocol that only works with Google's own app, at which point they can completely stop releasing RFCs for it.

No, I get it. I can't see a blackout day happening (the one stopped SOPA/PIPA) again either.

But it still happened, against M$, who was the behemoth of the time, so things are never impossible.

I was there too, in the 1.0 days, and still am. But these days are gone, Firefox is not coming back. Back then Firefox was immensely better than IE. As long as the other alternatives are just as good, there is no reason for the mythical "average user" to change over. Why bother if you can do everything in Chrome? We may understand the differences, ideological or technical, but good luck explaining that out there. There's a massive disconnect between user and technology and as a result people will live in the perfectly curated technological bubble that's been served to them.

"You can use adblock" is a pretty chunky benefit over Chrome

but "Netflix and my bank actually work in Chrome" is Google's endgame.

the adblock "endgame" will be a self-hosted DNS system that blocks requests to ad-server urls (or return benign responses).

Then the game will switch to encrypted proxied traffic that you cannot block.

Then the adblocking software will switch to the GPU layer, and use machine learning and AI to wipe the region of memory in the GPU containing the ads (and replace it with something benign).

Then the next logical step from likes of google is a fully trusted computing environment - aka, you as an end user no longer control your own machine.

This is entirely predicted by Richard Stallman.

The browser... or the javascript running in it, served from the primary domain you are browsing will just do DNS over HTTP from within the browser, completely avoiding your dns filter

Which follows that the final frontier of ad blocking are AR glasses that use machine learning and AI to block light from ads from reaching your eyes?

Internet Explorer 6 brought front-end web development to a standstill for more than five years. Let’s not do that again.

This is not the right attitude. Google wanted AMP. Google didn't get AMP. AMP is dead.

This is not even just Google. Apple, Microsoft, Cloudflare, everyone's in. https://gabrielsieben.tech/2022/07/29/remote-assertion-is-co...

It was fun while it lasted though, finally news sites that could be read on an average German mobile data connection.

For the uninitiated: Germany's mobile phone network has been ridiculously expensive and unreliable for decades. Everyone else in Europe has done it better, because no one else thought they could extort 60 billion euros from the providers for RF spectrum licenses - we're still paying for that blatant debt-shifting today.

Before it died it crippled the web, the search, publishers' ad revenues etc.

AMP is dead, but long live King AMP, now known to subjects as King WEI

Defeatism is not necessarily realism.

There's a degree of saying no and opting out and controlling your own shit that you can do.

Some, like owning a phone and getting tracked to many degrees is inevitable but others, like software on a computer, is quite easy to think about.

You don't need to be a majority to go a different path. Linux users everywhere know this. We never needed the "year of the Linux desktop".

There's usually ways around the designated box. Obviously, get ready to be called names for not bowing down to authority... But you can ignore them and move on.

Whatever happened to legislation? I bet most people here would have said the same about Apple's App Store monopoly on iOS, and yet the EU passed the DMA and the matter was closed.

There's no reason why the same can't happen here. The defeatism attitude helps with nothing and is part of the reason why this happens in the first place.

EU passing the DMA is literally the specific reason why google is unstoppable. They finally cracked the last significant holdout against chrome/chromium market dominance, now there is nobody left to oppose them in the browser market.

This "holdout", also pushes for device attestation, disguised as captcha avoidance.

https://www.macrumors.com/how-to/how-to-bypass-website-captc...

Except that if that happens the government will come at them just like they did to Apple.

They considered it enough that Apple had a monopoly on distribution for apps for a device with ~50% marketshare in the US, and even less in Europe.

Imagine what they would do for something that has ~97%

Chrome/Chromium is already above 75% marketshare and the EU doesn’t care, and is taking moves that will actively increase consolidation and monopoly control.

We’re literally in the thread where we’re talking about the anti-consumer moves that are resulting from that consolidation. This is what it looks like when Google flexes that monopoly control and tells you how it’s going to be. EU doesn’t seem to care.

> Chrome/Chromium is already above 75% marketshare and the EU doesn’t care, and is taking moves that will actively increase consolidation and monopoly control.

It took roughly 15 years for the EU to react to Apple's practices, and they have been anticompetitive from day one.

Chrome has caused no competitive damage to consumers or competitors (yet), give it time.

You can by not using Google products. Change the search for ddg or kagi. Change your email for proton. Use Dropbox instead. Remove Chrome, live with iceweasel or Firefox.

It is not like you'll be loosing much. This is the time to change, while we still have other players in the market.

No, you can't - not until you get a significant part of the world's population to join your protest.

The point is that if chrome implements this, netflix, amazon, facebook etc might decide they'll use this feature and only permit browsers who implement this to use this site.

Even if the only browser that does so is chrome, that's fine because chrome's market share is big enough that they can ignore the rest.

Have fun using Firefox if half of the web locks you out or treats you like a second class citizen.

It might be time to abandon that half of the web. Radical software freedom ideology is looking less radical and more rational by the day.

It may not be that easy as now that stuff like banks and government services have embrance it. If they or your work/school apps need it, you are screwed

I'm already using a separate device for "official" stuff. It's a fully Google/Microsoft managed phone that runs my professional life (work profile, LinkedIn, etc.) and accesses government and some financial services. It mostly sits in a drawer outside work hours and don't use it to browse or talk to anyone outside of work. It has SimpleX installed so it can send anything I need (eg. financial statements) to my personal phone, without even needing to store my personal phone number.

My personal phone, and my personal laptop and PC, run open source OSes and are as privacy-focused as I can make thrm. They're the ones I use to browse and talk to people, both on public and private platforms. They're the ones that have my photos, my books, my passwords, my movies and my music. (I don't use streaming services, except for YouTube via Newpipe.)

I do make sure that I always have at least one bank account with a bank that doesn't require SafetyNet or similar, and can therefore be accessed without needing the "official" phone. So far, all but one of my financial service providers work fine from my personal devices.

I think the dual-device approach will quickly become the only realistic one for individuals who want privacy in their computer use (which will remain a minority). I will even say that, although Google is doing this purely for the sake of ads and profits, it is not unreasonable to expect citizens to have an "official" online presence in the form of a highly standardised Internet client, without prejudicing their ability to use other ones. In the same way that you have an official residential address, without prejudicing your ability to have other mailboxes or live on the road.

It'll be radical and minority.

Most users are more comfortable with computers that are toasters, not (hackable) general purpose machines.

The flexibility to hack implies the flexibility to be owned. Users don't want to get owned. They hate that so much they'd voluntary choose an owner

> Users don't want to get owned.

I can assure you most people don't think about their tech choices long enough to conclude anything like this.

Now the question is going to be how the other half is funded.

Protests aren't convenient, that's the entire point of them.

What, you think taking down the ad industry on the web is going to be painless?

> netflix, amazon, facebook etc might ... lock you out

Is this supposed to be a bad thing? It's almost made to sound like surviving without them would be tantamount to starving, but frankly we might be better served without them.

I see Facebook locking you out (no great loss there) but I'm less convinced about Amazon or Netflix. They're not advertising-based businesses, so are not suffering with bots-consuming-ads problem.

Put another way, my site is unappealing to bots, and frankly I don't care about bot traffic, because I don't have ads. So I don't feel the need to support this server-side.

Equally Amazon makes money selling goods, not ads. They don't need to know if its human or bot, they just need a credit card. [1] Netflix is subscription based, again doesn't care if its a "trusted device" or not. They want you make sure their content is available not blocked because my TV is "untrusted".

Sure, you'll end up using Chrome to use Google properties. But I don't really see the incentive for the non-ad-based Web to bother implementing this.

[1] it won't move the needle for fraud, fraud is easily done via trusted devices.

>Equally Amazon makes money selling goods, not ads.

Amazon is one of the biggest ad networks on earth. They made $40bn from advertising last year using all the personal data they get from their paying customers.

>Netflix is subscription based, again doesn't care if its a "trusted device" or not.

Oh but they do care very much. Netflix requires DRM in desktop browsers and its own app on mobile platforms. And they launched and ad based plan recently.

It's a mistake to believe that advertising is the main problem and direct payments are the solution. Making a payment takes away more privacy than advertising alone ever could and hands personal data to payment schemes and banks on top of everything.

Netflix hides it's app from the Google Play store if the device fails the system integrity check that this proposal is based on, they definitely care.

Best of luck with that plan.

Almost no users want to be digital hermits. This protest approach has nobody following you up that mountain to the hermitage.

It's not a bad thing to me, but for the average "normie" it's certainly a deal breaker.

And then there's stuff like banks, government services, school services. You might not even be able to escape those ones.

> they'll use this feature and only permit browsers who implement this to use this site

we as tech early adopters and "leaders" in this space, we need to be telling family and friends to complain to those sites about such required support. If enough people complain to amazon that they don't want to use this google branded browser, i think there will be some pushback and the companies would be hesitant to drop support for firefox.

>The point is that if chrome implements this, netflix, amazon, facebook etc might decide they'll use this feature and only permit browsers who implement this to use this site.

Works for me. I don't need those sites/services. If they want to be actively hostile to me, I can vote with my feet/wallet.

I can't (nor do I wish to) control what other people do. Just what I do.

As it stands now, I block the bulk of scripts/ads/trackers/other spyware on my devices, and those who don't like that are free to block me from accessing their sites.

Maybe I'm missing something important here, but I don't need anything from Alphabet, Netflix, Meta or any other rapacious corporation. They can do what they like, and I will do the same.

>Have fun using Firefox if half of the web locks you out or treats you like a second class citizen.

If the above folks are who you consider "half the web" then, at least for me, nothing of value would be lost, as I don't use that garbage anyway.

Changing away from Gmail would lose me access to an uncounted number of sites where my login is Oauth of some flavor or other.

You can move away now or wait until they lock you out (and thereby lock you out of all you OAuth sites) with no recourse. The endless cries for help in /r/GMail/ says it all.

OAuth sites will let you change your OAuth provider or even better switch to a local account on their site and use a password manager so you don't tie everything to an OAuth provider unless the site will accept a self hosted one.

I avoid giving a password to random sites online for a reason: I trust Google's password databases to be a lot more airtight than joerandomsite.tld.

That includes password databases.

What's the harm in giving some sketchy site a unique, random password only used with that site? (In contrast to letting them have your Google profile and all that comes with it)

The need to retain one unique random password per site (as opposed to having one extremely secure Gmail password with two factor authentication attached to it).

It's the old twin airplane principal from the hacker's dictionary: the virtue of putting all your eggs in one basket if the basket is built very well.

Something to consider when you save your passwords in Google, you can "forget" and reset your Google account password and all your passwords are still there. Compare that to a proper password manager where if you forget the master password (assuming sufficient complexity) nobody is getting those passwords back ever. So Google has full access to your passwords whenever it feels like it.

As the other commenter said, there's zero risk giving a dodgy site a randomly generated password used only for that site, the randomly generated password gives them no information or pathway to any other web site.

That's a feature, not a bug. I don't want to lose all of my passwords if I have to reset my Google password.

You will lose them all when Google decides to lock your account.

I have them backed up to a second account.

What about Safari? It has significant market share. Seems like our best bet now

I doubt Apple will be our savior here. Apple is in a great position to implement this spec: their secure enclave and the systems they've developed around it are practically the state of the art. Also Apple is in bed w/ traditional media. (Apple News, Apple TV, iTunes, etc.) Microsoft has been doing the same[1] for years w/ Pluton on the Xbox to protect their IP. Google has been doing this on Android using, dm-verity, SafetyNet, et al. Nintendo employs similar protections on the Switch with moderate success. (After the bootrom of the initial HAC-001 was patched on the production floor the only real option to attack a modern Switch is physically glitching the console.)

I suppose Apple may object on the grounds of being a "privacy focused" company, but I'll believe that when I see it. I'm not gonna sit here holding my breath for these megacorps to do the right thing.

[1]: https://www.youtube.com/watch?v=U7VwtOrwceo

> I doubt Apple will be our savior here. Apple is in a great position to implement this spec: their secure enclave and the systems they've developed around it are practically the state of the art.

You are probably right, but there is one self-interested reason why Apple might resist implementing this - Apple doesn’t like the web competing with apps, and this is basically giving the web a capability that right now only apps (effectively) have.

> Apple doesn’t like the web competing with apps

Perhaps you haven’t been paying attention but macOS Sonoma—currently in beta, shipping this fall—has the best web app support we’ve seen in a mainstream operating system.

You can put a web app on the Dock using the Finder’s “Save to Dock” command for virtually any website or web app.

Not only do you get service workers, push notification, web app manifest support, etc. web apps have first class support in the Finder, Spotlight, Spaces, Mission Control, etc. [1].

[1]: https://developer.apple.com/videos/play/wwdc2023/10120/

Excellent point.

> Also Apple is in bed w/ traditional media.

True. Try to screenshot anything from Apple TV+ content. You'll get a black image.

Screenshotting Apple TV+ works fine for me on desktop Chrome, even with hardware acceleration enabled. I don't recall doing anything to circumvent normal behavior (not really in the habit of screenshotting things I'm watching).

That's why desktop chrome is served lower resolution content than, say, Safari, where they can block it.

Interesting because screenshoting Netflix does not work on chrome

It works fine in VLC with ATV content I have torrented.

If you subscribe to Apple TV, you are literally voting with your dollars for more of this crap. Stop giving them money!

Apple is really the only party in a position to be a savior.

For example, they threaten to remove FaceTime and iMessage from UK iPhones if the government there changes the law on encryption [1].

[1]: https://www.macrumors.com/2023/07/20/apple-threatens-to-pull...

Yet they removed apps from the taiwanese app store in Chinas interest

> I doubt Apple will be our savior here.

You only have to look at how they're (still) restricting PWAs to see they also have their own goals to preserve their walled garden and market share (as they should, it's a publicly listed company, but it's not the same as an open source alternative)

Yeah: the company that is all about locking down user devices and relishes in providing a DRM-ridden platform for developers to maintain complete control over their users is totally going to be against implementing this specification :/. I mean... it's possible? but any hope there is fully predicated on their hatred of Google and their distaste for the web.

If my goal is to try to avoid vendors locking down what I can do with my computer, I don't think switching from Linux to MacOS is going to be an improvement.

Already does device attestation. https://www.macrumors.com/how-to/how-to-bypass-website-captc...

Doesn't Apple have some leverage here? They may not control the overall browser market but they mostly control the smartphone market (or at least the profitable segment of that market) and lots of those users prefer to use Safari.

I'm aware Apple implemented similar tech a while ago, but I have infinitely less confidence that Google would use it responsibly.

> the web is Chrome

And lot of people here squeal like stuck pigs if you suggest anything other than the Chrome monopoly. HM is a constant barrage of demanding that legislators force the Chrome monopoly to be extended to iOS devices!

I mean Firefox caved to support EME. This isn't the early days of the web anymore either, the enthusiasts are a small minority of global web traffic that this will probably succeed even with a large scale boycott.

I still remember the controversy surrounding EME, a LOT of people came out against it (including the EFF[0]); despite that, they still triumphed on[1].

[0]: https://www.eff.org/press/releases/eff-makes-formal-objectio... [1]: https://github.com/w3c/encrypted-media

And thank god for that, otherwise we'd still need to support flash to use most popular websites.

EME is for DRM'ing media. I don't see how that pertains to Flash.

WebAssembly exists as a replacement now, too.

Back in the days before the <video> tag, Web sites were using Flash to play video. Flash was also the main way to play DRMed video before EME.

If browsers didn't natively support DRM then they would have to come up with external extensions (such as Flash) to support DRM.

DRM isn't going away.

DRM should be inconvenient and expensive. There have always been ways to implement DRM security theater for the comfort of content providers in board rooms.

The media ecosystem is not going to be enhanced by making DRM more restrictive. Netflix could completely deactivate all DRM today, and it would change nothing.

Apple completely abandoned their "FairPlay" iTunes music DRM because it became evident that it was not needed.

Every single Netflix show is available on the pirate bay, but Netflix still insists on using DRM.

Because Hollywood mandates that legal distribution have DRM.

Apple in no way abandoned FairPlay. Every file on Apple Music, and iTunes Match is protected with it. And those greatly outnumber transactional sales through the iTunes store, by an order of magnitude. The customer picked the DRMed version, every time.

Because everyone else pirated to great effect.

Good. DRM should be external to the browser, not integrated into it.

DRM is mostly security theater anyway. Until a few years ago, the Spotify client just left unencrypted mp3s cached locally. And they stopped DRMing music over a decade ago. People are willing to pay a reasonable price for first party content.

If a company insist on DRM, then they should be on their own.

If we make it too easy, then they will just use it everywhere.

Spotify will not load in a browser without a DRM plugin

Yes, but that is fairly recent! Did anyone even notice? For years, you could siphon every song you listened to and save it locally. But did it affect anything? I did it for a little while, but then found it wasn't worth the trouble.

It affected Spotify enough to engineer a solution to stop it.

And five years isn't "fairly recent".

One would also note Spotify is a failing business, and it was failing even harder then.

The majority of Spotify's lifetime there was NO DRM, and ripping it was easy.

The majority of users had no idea and it didn't affect them at all. Nor is there any evidence that it had any impact on Spotify's business.

Recent? I signed up 4 years ago and this has always been the case.

I think in this case Firefox is in a different position: if it didn't support EME netflix wouldn't work.

But in this case it could report "sure, this is a real user alright" by being its own attester, can't it?

That depends on how the attestation is done.

If done correctly, TPMs on every computer would be preloaded with signing keys (probably microsoft). The web browerser would then ask the TPM to sign the Platform Configuration Registers, which are a hash of a challenge nonce, the system firmware/kernel/configuration/etc. This signature is then sent (along with a description of the system configuration) to an external attester. This external attester validates that:

A) the claimed configuration is "secure" (trusted kernel, bootloader, browser, etc) and

B) The TPM's signature attests to the configuration.

The validator then generates its own signed message that can be sent to the server.

In practice, I think this is logistically unworkable in todays computing environment. But with enough big players pushing for it, I don't see anything fundamentally impossible.

Right, until someone exploits the kernel and it just attests whatever it wants.

Sites will just stop trusting that as an attester.

Anyone can write their own EME plug in that writes the files to disk. But it won't have the keys of any trusted module, because the reason sites trust them is because they don't do that. So it won't get accepted by anyone. Same here.

But they address this in the spec (kinda), suggesting that whitelisting attesters should not be possible.

Presumably this is because if it was, it would open Google to abuse of dominant position claims.

If Firefox lies, sites will refuse to load in Firefox.

Of course, but if Google did that it would allow Firefox to complain about Google's abuse of monopoly power. I'm not sure that is a path they'd risk going through.

So what if Netflix doesn't work?? That is the choice of Netflix. Big content will always want more control. Firefox will never be able to keep up. They will just do a mediocre job of working against their users.

Microsoft and Real Player pushed hard for an integrated ActiveX based DRM ecosystem over a decade ago. I'm so glad that Mozilla flatly refused to entertain such idiocy. I sure wish that Mozilla still existed.

Mozilla is now just a "pick me" [1] organization to big content. They should own being a browser that caters to users, not platforms. Because they will end up with nothing.

[1]: https://www.urbandictionary.com/define.php?term=Pick%20me

The problem is, back then most people on the Internet were techies. They knew their shit.

Today? Guess who Grandma's gonna call with "my Netflix isn't working"? And she won't care why, all she cares about is Netflix.

Protest is easy and involves the ADA and COPPA.

1) You cannot all of a sudden provision content differently to a user who has an unapproved device with their preferred accessibility stack and/or hardware.

2) Even if attestation does not involve tracking, effectively forcing children into an ecosystem that tracks them can be deemed unlawful by the FTC. Providers cannot foreclose all means of access to content that are not in a tracking ecosystem, because it violates the rights of children.

The proposal is probably legally negligent because it does not exercise the ordinary standard of care expected of senior technologists. Providing a tool that affects hundreds of million of children and people with disabilities is not a joke.

The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1].

It astounds me that people would actually associate their real identities with stuff like this publicly.

how do we protest this?

The same way we protest politicians doing things against our desires? We know exactly who the perpetrators are, so perhaps we should all give them a piece of our mind. I absolutely don't condone violence, but exercising our right to free speech is always a good idea.

I'm holding out hope for Ladybird to save us all one day:

https://awesomekling.github.io/Ladybird-a-new-cross-platform...

that site gave me a ton of hope and inspiration, thank you for sharing.

> how do we protest this?

Probably the privacy angle is best. Given that this uses an "attester’s public key", this enables to uniquely identify a given device repeatedly over time with no margin for error. It's essentially "perfect fingerprinting".

There's also the option that devices don't use a per-device key. If all the devices from a vendor use the same keypair, then this would be broken by just extracting the key from a single device (AFAIK, in the US this would likely not be legal to use).

> The saving grace here might be that Firefox won't implement the proposal.

As others have said, FF doesn't have a lot of leverage left to influence those type of decisions, but Safari might. Not sure what their position is on this proposal.

The one pager has a section on stakeholder feedback [0], but doesn't name them for some reason.

[0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

Looking at it in terms of leverage and market-share is a huge mistake that Mozilla keeps making. Mozilla doesn't have a platform like Google does. What exactly is Mozilla even competing for? Popularity?

They should hunker down and make the best browser they can, implementing their best web. It worked 20 years ago, and in many ways the circumstances are the same. We have tech monopolies proposing ludicrous "content security" mechanisms. Where would Mozilla have been if they tried making some sort of half baked "less evil" form of Microsoft Janus DRM[1]?

People are going to get sick of how intrusive DRM is becoming, and there should be an alternative waiting for them.

Every person who has content they thought they purchased "expire" and be erased from their device, or who can no longer use their expensive projector after the latest mandatory update.

I evangelized heavily for Firefox in the 1.x days. People were sick of IE6, and were glad to have Firefox. I worked at a computer store and probably converted 100+ people.

[1]: https://en.wikipedia.org/wiki/Janus_(DRM)

What exactly is Mozilla even competing for? Popularity?

Mozilla's revenue is proportional to usage so they need enough users to cover their development costs.

If only the wikimedia foundation would fork firefox, then the open web might have a chance.

Wikimedia is honestly the only organization with the right ideology, the right business model, and enough money to do something like this sustainably.

I thought Wikimedia was quite shady itself when it comes to funding and money management?

Mozilla and Wikimedia both have a reputation for wasting money by trying to branch out beyond their main product. Wikimedia is totally overfunded so wasting money doesn't threaten their survival but they've also been criticized for begging for donations that they don't need. Personally I don't see a reason to combine them.

Coincidental observation:

Your username is the same as the initialism used internally to refer to the Wikimedia Foundation.. The WikiMediaFoundation: WMF

Wikimedia is much much less shady than Mozilla in a bunch of ways. Some people might take issue with the way they spend their money, or the tactics they use to raise money, but I don't think I would consider them shady.

Full disclosure: I was employed as a software release engineer at the Wikimedia Foundation from 2015 through 2022.

> FF doesn't have a lot of leverage left to influence those type of decisions

FF didn't have leverage in 2005 but we're still somehow living in a post-IE world. Leverage and market share aren't a concern, community support is all that's needed. The issue is that Mozilla Corp have been rapidly burning community bridges at pace of late, topped off by the fact that 2005 Mozilla wasn't dependent on Microsoft for their income.

It scares me when people talk about forcing apple to allow non WebKit browsers on iOS. iOS is the only thing stopping chrome from actually winning the browser war.

> how do we protest this

The proposal for Chrome, you don't, because there's no stopping it. See DRM, Secure Boot, all the rest of the shitshow pursuing "trusted environment". It'll never happen, but CEOs won't accept reality.

You can, however, embrace the rest: eg. keep serving your own content on http (along with https), gopher for retro compatibility, and because they are less prone to break.

Keep using your current device for browsing, and whatever refuses to serve you either leave it for good or keep a spare chromebook for all the "services" you can't avoid to use, like banking.

I don't have a better route. It's a bit like streaming: if I want resolution above 480p, I use a Chromecast with Android TV.

> if I want resolution above 480p, I use a Chromecast with Android TV.

I am one who specifically does not want a resolution above 480p. Unfortunately, some TV services had decided to remove that feature and now it wastes disk space due to the higher resolution. I also want to be able to use an external caption decoder and recorder (in my case, the same device does both), so will use the composite video and not HDMI (which doesn't have captions).

Steven J. Searle wrote: "The sad fact of the matter is that people play politics with standards to gain commercial advantage, and the result is that end users suffer the consequences. This is the case with character encoding for computer systems, and it is even more the case with HDTV."

> keep serving your own content on http (along with https), gopher for retro compatibility, and because they are less prone to break.

Yes, it is reasonable. I think that "HTTPS only" is (mostly) no good, but having both is good. HSTS is no good.

Generally agree but I don't think Secure Boot falls in this category unless the keys are locked in firmware (and in that case the firmware is the problem). Root passwords aren't evil either just because they can be withdrawn from the user.

Secure Boot is often conflated with Measured Boot.

Measured Boot is essential for any attestation based scheme.

If I want resolution above 480p, I turn to torrents.

That said, I haven't had the desire to watch TV for a long time.

Vote with your clicks. Google doesn't want me to install an ad-blocker on my phone, so I'm not browsing the ad-infested websites. And for the current integrity checks: If a site wants me to solve a captcha just to view it, I close the tab and never visit the domain again. In fact, I already close the tab when I see Cloudflare checking my browser. Let the corporate web die.

Firefox on android has unlock origin support.

I'm doing this again, but here's my shameless plug for the article I wrote 1 year ago now, "Remote Attestation Is Coming Back," which warned that this was coming to the web and had quite a discussion about that idea at the time:

https://news.ycombinator.com/item?id=32282305

It was just one example, but Netflix is trash in web browsers anyway. Firefox should say no to all of this - it doesn't feel like it now, but saying no could birth alternative services that don't operate in such a manner.

Not technology related exactly, but until recent events I thought Reddit would survive and be untouchable. Now I'm wondering why I didn't join the fediverse sooner. There are rough spots but it will surpass centralized solutions.

We are at a turning point and should say no to all garbage. They need us more than we need them.

> It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do we protest this?

Death by a thousand cuts can also happen in the other direction. Even if we do not have a single decisive way to oppose this disastrous proposal, we can fight it in as many ways and on as many avenues as possible. Spreading the word about it widely is an important first step, so that those best placed to oppose it know that they should act.

> How do we protest this?

Perhaps, make a web page with something like:

  if(navigator.getEnvironmentIntegrity) window.location="[some URL with the protest]";

As long as online advertising is a primary source of revenue for many companies, the internet is going to increasingly have less degrees of freedoms.

Probably the only solution is to bring harsh legislation against the very existence of online advertising. I don't know what that legislation would actually look like and how it can be done ethically.. but the alternative is probably worse.

Reply on news.ycombinator.com