Blink WEI “will not ship in current form”
toot.cafe
toot.cafe
There were tons of other w3c entities which could have blocked this specification. TAG & Security groups would both have had says.
They'd likely just spin up an "independent" body to manage the specification and publish it outside of the auspices of the W3C. That's what the did with AMP, after all, which sits under the OpenJS Foundation now.
Google themselves actively worked to make AMP non-critial, to make it an implementation detail / toolkit rather than a top-down mandate. And the general idea is solid. To me, there were two major themes: fast rendering components that won't force redraw & wouldn't even block, and the ability to embed/transclude content so Google themselves could feel safe letting you isolated-ly display your content on their search results. The modern incarnations of this idea are very privacy preserving (originally it was less so).
It is a warped point of view, in my opinion, to accuse OpenJS of being a Google puppet with "scare quotes" ""independent" body" nonsense meant to frighten & terrify. OpenJS is home to Node.js, webpack, jQuery, Dojo, and many others. OpenJS has not been a problem or a shill. This was a sensible place for open activity. It's a Linux Foundation project, which - while it has problems (it doesn't do jack to get independent developers a dime, and fuck that noise) - is a fairly respectable organization for collaboration & concern.
To me there's just so much conspiracy-mindedness & reactionary-ism around WEI. This is one topic that deserves the bombasticness, that we should react hard to! But there are processes and checks. Google is far & away the most up-front most-clear, is by far the earliest company to talk about & discuss plans & ideas, and the only company anywhere that has any process for trying stuff/getting data without any commitment to it (Origin Trials).
It's so concerning to me how much it feels like people want to lose their minds over stuff. These chain reactions of negativity are such a power in the world today, but whether or not they have truth & perspective & whether they contribute or distort the dialectic is of such high concern. I struggle to think of what pieces of @m2ys4u's post here contributes & informs & is well coached, but I see so much of it that is aimed to exacerbate, instigate, reactionary-ize. I've tried hard to acknowledge some truths about early AMP, and that was a shitty time, but 2015 was a long time ago and most of Google's promises at the time to follow-through on enhancing rather than controlling the web seem to have been quite seriously followed through on.
We need to salt the ground this was grown in and make sure it never comes back.
The fact that it was even proposed means there elements out there pushing for this stuff. Who knows whether it was a shadowy executive team or just some out of touch developers and PMs.
I wish there was more to say, but the backlash was swift, fierce, and to the point.
Good work.
This does sort of seem like the system is working as intended here. Give people enormous power, but do so in a transparent clear way with lots of review. Rather than a top down organization, this bottom up engineering allows in a lot more potential.
And some of the potential is bad. Do we the technical masses trust in the process, in the various discussions & checks built in to the w3c system? How much is our hunger for attention & excitement & drama fueling a mania, a craziness? 0? Maybe a tiny bit? Or is there real harm to the media cycle blow up beyond proportions to every potentially salacious idea that shows up on radar?
Like Alex, this was a huge deal. A huge issue. But it seemed unlikely to get far as a standard, and had barely begun review cycles, just getting some standards positions, not even getting TAG or security review requests started.
I really like Chrome's model, how proactive & transparent they are, so early. In contrast, most web vendors just ship stuff. Safari just shipped Private Access Tokens, which are Web Environment Integrity, in different name. https://news.ycombinator.com/item?id=36866355 https://www.snellman.net/blog/archive/2023-07-25-web-integri...
"They just love ads!"
What's the context where WEI could be seen as a positive?
[0] The Linux support for that goes from "bad" (check `uname` for version kernel) to none. At least with one client I had to use copy of "system report" file from Windows machine and it worked. Makes me wonder how much of it is just security theater.
The FBI has already put out alerts about scammers and other evildoers calling people using the voice of their family members.
Even if not, they could just rate limits how fast you can make requests to a speed that's plenty for any legitimate user but terrible for bots. If someone wants to astroturf as a million people on social media, they will need a million physical motherboards and a million genuine licenses of Windows, and a million rubber duckies programmed not to act too fast or too continuously. No more Xeon blades with a fat WAN pipe running a credentialed script.
I actually don't know if input devices still don't have TPMs or not. I know display devices do - try watching Disney+ on a CRT, or even an old HDTV. You'll get a nice error message saying your display is too old and unsupported.