Hacker News Reader

Comment by endisneigh | Hacker News Reader

I read the entire thing and it’s not clear how this reduces control of your own computer.

It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

> It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI).

This, however, is true for sure.

At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional. Those who implement it are those who are not interested in an “open web” to begin with and definitionally were never going to support it anyways.

View on HN

> it’s not clear how this reduces control of your own computer.

It eliminates a computer user's ability to have their user agent lie about the platform it's operating on. Such a capability is crucial for privacy and adversarial compatibility. Simple example: your bank of choice starts sniffing your UA string and refusing to serve Firefox, as they only test the site in Chrome and don't want to service support tickets for any other browsers. Presently you can spoof your UA string and visit the site with Firefox anyway. With WEI the bank site now has the technical means to ensure your browser accurately reports its identity and to refuse access to anything but Chrome.

I'm not necessarily claiming that this is how WEI will be used, but the point is it's now up to site operators to choose what makes a valid visitor, rather than the UA being just a transparent medium between you and a website (provided that each is implemented to spec).

It absolutely is how it will be used. Try banking on your rooted Android phone, today. That’s the future for banking on the web.

Streaming video sites are another prime example. They serve low resolution video to Linux machines because the DRM won’t attest to a secure video decoder. I’m not sure I look forward to similar discrimination from the entire web.

> It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

"Obviously" is a very strong word for what is pretty much your opinion.

As the system was designed browsers are an agent of the user, not of the web servers or the ad businesses. If you want guaranteed ad impressions and control go make iPhone apps. Taking an open system such as the web and forcefully closing it up using overwhelming monopoly power like Google is doing is not only disgusting but also incredibly anti-competitive.

> At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional.

For now. "Entirely optional" can be stretched very far. If you were banned from AdSense revenue and from appearing in search unless you enforced this, it would still be "entirely optional" but also pretty much trash your site unless you complied.

> It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

Yes, that is obviously wrong. Accessing a website doesn't give you anything like the ability "to access other servers wholesale unconditionally". Requesting files over HTTPS isn't a gorram root ssh session.

All a user-agent does is ask "Can I have file `/x` please?", "Can I have file `/y` please?", "Here is the data `foo=bar` for `/quux`" etc., etc., etc...

The server is free to say "200 OK" or "400 Fuck off" to any request it receives, at its own discretion, based on whatever rules the server administrator wants to put in place. Which they have the absolute capability to do. That is nothing like "unconditional wholesale access" to a server.

It reduces control of my computer because without it my computer can identify itself to websites and advertisers in the way that I want, but with it, it can only use its TPM assigned identity. You can argue (I'd disagree) that it's a good thing that I can't make my computer spoof as something else, but unquestionably it does reduce my control.

This is wrong though. Wei doesn’t stop your ability to spoof, it stops your ability to be successful in spoofing.

> unquestionably it does reduce my control

It doesn't reduce your control, you are still welcome to identify your computer however you want to websites by using a browser without WEI or disabling it.

You will just have to live with the reality that a lot of servers aren't going to want to talk to your client.

Their point is that a browser with WEI reduces your control versus a browser without WEI. I would agree with them that it's definitional.

This is always such a bad faith argument. When you have to choose between freedom/privacy and being able to perform daily tasks, that's not a choice, but coercion.

the better argument is just flipping the perspective. if your computer runs a web server this increase the control because without it other computers can connect to it and lie about their identity. that's not to say I think this is a good thing, I just don't think control over your computer is a good argument when both sides of a connection are computers, and both operators want not just control over their computer but also what the other computer can do.

That's fair, but it seems to me they could've done it differently -- require a signature from the clients but allow them to produce an unbounded number of valid unique signatures that are securely but anonymously tied to the client TPM. In other words the client would still be able to present a validated anonymized identity, but would not be able to generate someone else's signatures, and private-key-based revocation could still be available to deal with rogue TPMs.

>without it other computers can [...] lie about their identity

That's the point, I think. I own my computer, which means I decide whether it lies. If I want to serve "This website only works in Chrome" when it's actually cross-platform, that's my right. I might want the client to open the page in Chrome automatically, and I would have more control over the connection if I could do so, but that control would be over the client's computer. It's not a question of getting more or less control in general, but of getting rightful control over my own property.

> both operators want not just control over their computer but also what the other computer can do

Are you saying that my demand to not have a server control what my client does is an act of control over what their computer does? Like if I told you not to use your forklift to take my stuff, I'm asserting power over your property?

> >without it other computers can [...] lie about their identity

> Are you saying that my demand to not have a server control what my client does is an act of control over what their computer does?

Yes. The owner of that computer does not want to serve your requests and you want to prevent them from exerting that control over their computer.

>Like if I told you not to use your forklift to take my stuff, I'm asserting power over your property?

Yes that is what is being argued here. Forklift owners demanding the right to lie about using a forklift to property owners like Google who do not want to allow forklifts to take their stuff.

> it wouldn’t necessarily get rid of an open web as it’s entirely optional

The devil is just right there. If an implementor is dominant, and that the feature starts to be used extensively by banks / utility providers or other essential utility, nothing prevent those users to enforce using browsers implementing it, event if it's optional per spec.

The feature then become de-facto mandatory for all implementors, and in the long run google can start refusing serving apps on non-compliants to their de-facto standard without much fuss outside the tech people.

Right. Some people are thinking about this really black-and-white, like you either have control or you don't. In the very end, WEI aims to collectively reduce the users' control.

Imagine this:

You buy a house. Your house has a little box by the front door. The box holds a small House Environment Integrity (HEI) module. This HEI is something your local Home Owners Association installed. They say you cannot open the box or investigate how the module inside works, as this is against the HOA and you will be fined. They tell you this HEI module is meant to help and protect you. To make sure the plumber you hire didn't do a bad job or that the paint you used on your walls doesn't contain lead. They say it's for your benefit and to make your home a better and safer place. This does not reduce the control of your own house.

This is an argument against the TPM, not WEI.

WEI is a mechanism that forces you to let websites use the TPM to stop and frisk your machine before access. There’s no difference.

Sure, WEI just says that they’ll allow literally any person you interact with at all look in the box on your house.

Instead of imagining a theoretical box, consider the water and power meters you probably already have that you don't technically own.

> This does not reduce the control of your own house.

Just make sure your visiting friends register with the HOA, and don't get excited about being handy with the curtains, that's gonna require an HOA approved contractor.

> I read the entire thing and it’s not clear how this reduces control of your own computer.

Requiring to run a software stack signed by a third-party to access a basic Web page definitely reduces my control over my own computer.

> It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

That is not the premise since you can already run a closed-club server and only provide accounts to people you want with whichever conditions you chose. You just not entitled to verify the software that clients run.

> At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional. Those who implement it are those who are not interested in an “open web” to begin with and definitionally were never going to support it anyways.

This will be forced on the Web by ad networks. For our own good and to prevent fraud by the bots of course.

> It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally

No, the preimise is that a server that offers an HTTP endpoint should provide the same behavior at the endpoint regardless of the nature of the device or software that is accessing it.

Obviously, we have some exceptions already, hence robots.txt

But the idea is that if I am a user pointing something with a reasonable functional distance of "a web browser" at an HTTP server, the server should not alter its behavior based on an attempt to verify the internals of my browser.

> It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

The premise is that I shouldn't have to give that server control over locally-running code on my PC as a prereq for access. They can enforce whatever conditions they want server-side.

Reply on news.ycombinator.com