pptr

Which is orders of magnitude more expensive than deploying the bot to a cloud or botnet.

I don't know how much bot spam pays these days. Maybe it's still worth it.

My understanding is that you can't reuse tokens, because the system uses challenge response.

How is this feature hostile to Googles users? There is genuine benefit from websites allowing you to do more things via their website (vs their app). Also: fewer/no Captchas, fewer bots on social media

The platforms most people use will see benefits. Apple users apparently already do.

I understand the argument that the open source experience will get worse. But frankly, google.com will still work for you. It will be other websites that make your experience worse.

It does affect bots creating social media content.

Well there is that and there are users that post GPT SEO trash to Reddit et al, which is what the attestation API could help with.

I'm curious to hear from someone familiar with web development: How much do websites invest in accessibility and related features that cater to a small audience? Can we draw any conclusions from this to how websites will deal with accessibility to non attested users?

Why would Google not monetize unattested traffic? I mean that's like Google blocking it's own ads from being shown.

I don't know much about the online ad market. I assume advertisers will pay more for attested impressions than for unattested ones. But unattested impressions will still be worth something.

I guess it depends how far the certification goes.

If even extensions can be detected, why wouldn't selenium be detected? Granted, I don't know how it works exactly.

In addition to the 5$ robot arm you need to add 200$ for the device it is operating. Drastically raising the cost to run a bot farm is key. You can't fully eliminate inauthentic behavior, but you can make a lot of it unprofitable.

If you can identify bots more accurately, you get less "GPT SEO trash".

Good idea, we just throw out all the security mechanisms to avoid "corporate control" and even worse anti virus software "inspecting end users' computers". I'm sure people will be very happy about all the mal- and ransomware they receive. Imagine the utopia we would live in.

The attestation is about the device, not the website.

I think just from a security perspective it makes most sense for the device or os manufacturer to handle attestation for that device.

That's debatable. I read it like this only affects the charging model. Advertisers only get charged for impressions from humans, not bots. This is enough to prevent fraud.

Out of curiosity: what programming language are you searching for?

I never had problems finding SO answers for C++.

The listed use-cases are not what I typically see complaints about.

What I do see a lot: * This will be used to detect and block ad blockers. * Open source users can't do attestation and will get locked out of parts of the web.

These are not goals of this proposal from what I can tell. And there are indeed discussions how to avoid those negative externalities.

That's how I read the proposal too.

One key difference to Captchas is that since this new system requires no user input, the "cost" of a website requesting attestation is a lot smaller. So it will probably be used more widely.

How does this compare to simply targeting a certain CPU utilization (say, 70%)?

In a sufficiently complex system you will have many different queues and other bottlenecks that affect throughput at scale. Some requests will also require more compute than others.

I like to plot the correlation between utilization and latency. Since utilization will typically vary during the day, you get lots of datapoints without running any benchmark. That lets you make more informed decisions regarding target utilization and when it becomes necessary to scale up.

Can someone explain to me what's so fundamentally bad with this proposal?

My understanding is that websites can essentially confirm whether the user is likely to be a human because he/she accesses the website from a certified device.

Won't this mean there is less need for Captchas, logins and pay walls? The doc also mentions that this will remove the need for some use-cases of fingerprinting.

I imagine from a user perspective this will be an improvement.

Disclaimer: Googler, but not working on Chrome

I think this simply allows the team to move faster. For example, you only need to build a website, no Android/iOS app.

Product wise, you have more freedom to build the UX around this new technology without concern for legacy use cases.

You can measure improvements. You don't have to guess. However, I understand that a lot of work can't easily be evaluated for user impact.

Googler here.

If you work at a big tech company you can improve the products used by millions if not billions of people. I find that very rewarding.

These all seem like "nothing burgers" to me.

* He critizised that Yoel advocated for Kids using dating platforms in his PhD thesis. It's a misrepresentation IMO, but the reasoning behind his criticism is not LGBT specific.

* This is about mocking pronouns, not about LGBT people. “I absolutely support trans, but all these pronouns are an esthetic nightmare.” - EM

* He reinstated a lot of accounts that didn't violate the law (free speech). Vice cherry picked some examples that were originally banned for "anti LGBT" tweets.

* Activist account was banned for "hateful conduct". I don't know the context here, but that classification seems reasonable.

* He did delete the pelosi tweet, presumably once he realized it was false.

* The last one is about anti LGBT behavior by employees at Tesla, not by EM himself.

Security and privacy are all about imagining the worst. Anything that can be exploited will be exploited eventually.

I thought Bill Gates' recent book covered all the important problems and how they could be addressed. Here is a good summary: https://www.gatesnotes.com/Energy/Lowering-Green-Premiums