Apple already shipped attestation on the web, and we barely noticed

Yesterday, the sentiment on Google's early proposal was "company breakups start to make a lot of sense", "Go f yourself, Google", "It's maddening and saddening", "[the people involved] reputations are fully gone from this".

Today it turns out Apple not only proposed but implemented and shipped the actual feature last year. "It could be an interesting opportunity to reboot a few long-lost dreams". "I kind of get both sides here". "I guess I personally come down to leaving this turned on in Safari for now, and seeing what happens". Granted, the overall sentiment is still negative but the difference in tone is stark. The reality distortion field is alive and well, folks.

Totally agreed. Apple's marketing is simply the best. Google on the other hand, repeatedly let its reputation erode by a loud minority of Google haters without doing any PR to control the narrative. As if they still believe that one echo of "don't be evil" could still reverberate after twenty years.

They aren't implementing it as a common browser standard

They shipped it in their browser without intending to standardize it? That's even worse! If true.

PATs are a draft standard with participation by companies other than Apple (such as Fastly and Cloudflare and Google): https://www.ietf.org/archive/id/draft-private-access-tokens-...

As the "kind of get both sides" person I come to defend my honour. Honestly I see both (the apple implementation and the google about-to-be as pretty much the same thing just going about it in Apple- and Google- style.

It's not a fan boy thing (and I would hate to be the guy whose github was filled with anger yesterday - it's not his problem, and he should be left alone).

It's just a marker on the journey - we know the rough destination.

(Also Insuspect the second time you hear bad news the community has had time to adjust - FU is usually a first time emotional reaction. Wow I really am into "see the good in both sides". )

point taken, but as the blog post here and many other comments have pointed out, there is a very sharp qualitative difference between just-Apple and Apple+Google doing this. Apple alone has a minority market share but together they cover enough of the market that many websites would be tempted to only allow connections from trusted clients.

Probably not the RDF but rather that Google is famously bottoms-up driven, they're asking for feedback in an open forum, and the proposal is by individuals who are responding as individuals. One of them even posted to Hacker News. That unfortunately incentivizes bullying behavior by people who don't like it and hope that if they're nasty enough, the individuals in question will give up.

Apple has no time for any of that. They consider, they plan, they act. You never learn the identities of anyone involved, they don't generally ask for feedback, they often don't even give the justifications for their plans, and squishy tech sentimentalities are considered irrelevant compared to consumer UX. Getting mad at what Apple does on some web forum is no more useful than getting mad at a brick wall.

There are reasons why the "faceless corporation" is a cliché, after all. It's a deliberate policy designed to protect employees.

My impression is that Google abandoned this approach.

It’s really not the same intention or implementation.

We should also consider that Apple’s solution is a way to distinguish between human vs. Non human users on an Apple device. It doesn’t allow a service to randomly lockout browsers and/or OS (which Google’s proposal does), just that if you’re already on your Apple device, you don’t have to do a “verify I’m a human” captcha.

cf. https://developer.apple.com/wwdc22/10077

Why is it worst? Isn’t the whole point of an open web to be able to have different agents with different capabilities?

As TFA notes, with only 20% market share, this feature being in Safari is of little to no consequence for the world as a whole.

Hence the rather different reaction when Google proposes something similar (and worse) on top of its 70% market share.

No, it's to have multiple independent implementations of the same standards.

I can't tell if you are joking, what sort of fragmented hell do you want?

It's a feature designed to work on Apple devices that requires Apple-specific hardware. Why would they make it a standard?

Since when have the standards been finalized before the early implementation? Much of the web has been browsers trying things out and seeing if they can convince others to join them (or, in olden times, following MS's lead as with AJAX).

Yup -- you see this same effect on articles about Apple's draconian OS policies.

When Microsoft bundled IE with Windows that was terrible. But Apple bundling Safari and locking out competing browsers? That's just what's best for the customer.

It does in these cases protect employees, but that's not the design. It's designed to avoid accountability. If a company decides to illegally dump pollution into the ocean or bribe a foreign regime, they by no means want the executives who made those decisions to be easily identifiable. Companies don't go to jail.

Apple is big but insular. I never bought any Apple device so I never had Safari (*) and any attestation affecting Apple's customers didn't affect me. Web sites could harass them but not everybody else. Google is a different beast. Their browser engine can't run on iOS but it runs on Macs and on every other major OS.

(*) there was a Safari for Windows in the early days of the iPhone. It had a Mac UI which was horrible to look at inside Windows. Maybe it was the time Jobs thought web sites were the way to go for the iPhone. Then he realized that an app store would make a lot of money. Nobody gets everything right all the times.

> The reality distortion field is alive and well, folks.

summer spectacles have been applied: e.g. barbieheimer and women's soccer world cup

I wonder what else

Can you tell us why you think people were bullied, and why apple's primary concern is consumer UX and nothing else?

I don't think they mean Apple's primary concern is their consumer UX, but that their customers' primary concern is consumer UX.

> When Microsoft bundled IE with Windows that was terrible.

Microsoft was a monopolist (the government went after them for misuse of their monopoly power).

> Apple bundling Safari and locking out competing browsers? That's just what's best for the customer.

I'm not sure how common that sentiment is, but no sane person would argue that Apple has a monopoly on basically anything.

They're certainly a dominating player in the phone market.

Why wouldn't it allow a service to do exactly that?

Because web developers might not be incentivized to implement multiple different attestation protocols?

The difference can probably be explained by nobody having any idea that Apple already implemented a version of this.

And on top of that, Google's reputation of brutal power grabs on the web may make a difference in tone.

Importantly though, we shouldn't frame this as Apple vs Google. I can ensure you that both companies absolutely hate the open web and open computing in general.

It's the strangest thing. On any other platform, people want freedom. They don't want MS to force them to use Edge. They don't want websites to force them to use Chrome, etc.

With Apple, it's the opposite. Freedom to install third party app? That would be dangerous! Freedom to use iMessage in the browser? That just doesn't make sense! Freedom to use third-party browsers on iOS? I guess most people just don't care about that one.

It's just striking that for every other company, lock-in is bad. But for Apple, lock-in is actively evangelized by the user base.

Apple captures 85% of the profit share of the worldwide phone market, as Apple websites love to trumpet: https://appleinsider.com/articles/23/02/03/apple-collects-ne...

1) Not being an Apple user for exactly this kind of reason means I had no idea Apple had done this.

2) Apple users being willing to sell themselves down the drain is nothing new.

However, this is shit irrespective of who does it. Period.

Obligatory repost of "The Right to Read": https://www.gnu.org/philosophy/right-to-read.en.html

It's in the nature of the device you're using: an Apple device. This implies there are non-Apple devices out there who will inevitably fail the check.

It's also in the way Apple allows its use; however that's not as strong. Apple has positioned this as a way to prevent CAPTCHAs from reaching the customer. Apple is interjecting with the provider and saying Hey, trust us. We can prove its a human because they're saying they're on iPhone. They're not positioning this as a way to deny service. Only to speed up access.

If Apple says it is to prevent the user from seeing a CAPTCHA, trust them at their word, with all the implications it entails.

If Google says it is to prove to advertisers that a human is seeing their ads, trust them at their word, with all the implication it entails.

Apple released Safari on Windows when a majority of Windows users were still using IE7. It was a genuine play for a pie of the Windows browser market and its search revenue. It had nothing to do with web apps. When it happened, Jobs positioned its release as a way to make Safari even better, since more people would use it and report issues and bugs.

This is a patronizing take.

Who should we get behind? Stallman?

You?

All the startup CEOs whose business was based on low interest?

Where you planning on going? Mars? There’s only Earth.

Apple makes hardware people like and happens to interoperate with the web.

Google wants us believe it is the web.

I can do weird computer science with a MacBook and no Google. Can’t without a MacBook.

They are vastly different companies and the discourse is vastly different. Shock. Awe.

> loud minority of Google haters

translation: loud minority of people who has a clue what Google really does

I think most of their users are just happy with the way things are and don’t want any changes that might screw things up.

Overall they trust Apple to take care of things - that’s why they bought Apple stuff in the first place - and feel that anything that takes control from Apple and could prevent Apple from doing its job, would be bad for them.

Not going to argue against your gist (Apple is a megacorp and we should be wary of them as with all such nearly-unaccountable entities) but which definition of monopoly includes profit share?

Neither seems trustworthy. Google because, I mean, Google, they’ve repeatedly demonstrated that they can’t be trusted, whether regarding privacy or LTS, and Apple because it’s just “trust the device”, which can obviously be gamed by developer accounts or other hacks like simply walking past a rack of devices confirming touch or face recognition.

There’s no stopping fraudulent behaviour, only defensive barriers to dissuade the non-nation-state actors.

My impression is that Google is, once again, just slow at execution. They probably do want to integrate PATs together with their Google One VPN product.

For me, it comes down to incentives.

Apple's incentives more closely align with mine, than any other megacorp.

And Apple is the only company in the world big enough to take on those other megacorps.

So, Apple certainly isn't perfect. But they're a hell of a lot better than any other megacorp. And I choose them to help defend me against those other megacorps.

Most importantly, I don't want Apple being crippled in their ability to fight the other megacorps.

That lasted only 5 years. According to Wikipedia the first release was on June 11 2007 and the last one was on May 9 2012.

https://en.wikipedia.org/wiki/Safari_version_history

I found this press release from 2007 https://www.apple.com/uk/newsroom/2007/06/11Apple-Introduces...

“We think Windows users are going to be really impressed when they see how fast and intuitive web browsing can be with Safari”, said Steve Jobs, Apple's CEO. “Hundreds of millions of Windows users already use iTunes, and we look forward to turning them on to Safari's superior browsing experience too”.

History demonstrates that actually they didn't and Apple gave up quickly.

Interestingly they also have some benchmark

> [Safari] now it's the fastest browser on Windows, loading and drawing web pages up to twice as fast as Microsoft Internet Explorer 7 and up to 1.6 times faster than Mozilla Firefox 2 (*)

but by reading the more we learn that they benchmarked Safari on a Mac and the other two browsers on a Windows machine.

Just read this thread: https://news.ycombinator.com/item?id=36854114

A few choice comments:

"I recommend finding everyone responsible for this and exercising your right to free speech on them. It works for politicians, and it should work on this other flavour of bastard too."

"I believe both of these users are acting in very-bad-faith, and not correctly observing any ethical codes of conduct in Engineering."

"As far as I am concerned the reputation of this Ben Wiser guy is so far down the toilet that there’s practically nothing he can do or say to recover it. Like the old joke goes “you screw a goat once…”"

"The people involved in this concept/idea/proposal should be shamed into retirement. They should never work in the tech sector again. They should be afraid to use their names before first knowing their audience (an agricultural audience would likely be OK)."

"sometimes I don't think constructive replies are appropriate or possible. "

"Magnitude of the malfeasance is so great they deserve to be held to account for it"

And lots more.

I'm pretty sure beyond the personalization of the issue, 90% of the difference here can be explained by ad blockers. There's no deep technical or philosophical principle at work in most of those comments but what's clearly shining through is that tech people block ads a lot, feel they have a right to do so and will get furious at any attempt to stop them. Apple doesn't care about click fraud, ad blocking or spam on the web because those are other people's problems so they limit their remote attestation to the CAPTCHA reduction use case. This use case has the advantage that it improves the browsing experience for Apple users only. HN posters dislike CAPTCHAs as much as the next guy, so nobody cares. But Google want there to be lots of web content that's free to access so also concerns itself with the publisher side of the web, not just the consumer side. They list more use cases and ask for feedback, there are more consumers than creators, so surprise surprise, they get a lot of hate.

Hahaha classic Apple benchmarking

I am perplexed by the mindset that leads people to believe Apple is more interested in privacy than Google. Is it the ads they run?

Apple makes money by selling goods and services. Google is in the business of targeted advertising. So they have diametrically opposed incentives wrt privacy.

Are Apple selling ads on the web?

Apple long understood that the best way to sell a product is not as a product but as a cult.

I’m always amazed when people don’t get this. It’s like they’ve bought into Google as part of their identity so much that they are in denial with regards to how Google make their money.

> They're not positioning this as a way to deny service. Only to speed up access.

Remember Net Neutrality? Pepperidge Farm remembers.

They do if other large shareholder executives need a scapegoat. Shareholders will look the other way and protect their profits so if employees are doing something bad but profitable, they are protecting the employee in times of outrage IMO

This is not true. Remember iCloud scanning for CSAM? Even though Apple was simply creating a process to do what everyone else (GDrive, OneDrive) was already doing, only with MORE privacy protections, they scrapped the entire thing after significant backlash.

Consumer voice is powerful. It shouldn't be underestimated.

Personally, I don't find most of those comments as bullying. Harsh and uncouth, maybe, but in my opinion bullying requires there to not be a cause for the criticism. In this case, there is every cause for criticism.

None of the comments you quote stand out as more than harsh criticism either. There's no bullying going on. The people pushing this proposal should be held to account for their actions, and it's moronic to argue otherwise.

They both collect a lot of "telemetry" [0] and sell ads [1].

[0] https://news.ycombinator.com/item?id=26639261

[1] https://news.ycombinator.com/item?id=32461690, https://news.ycombinator.com/item?id=28897027.

Please correct me if I'm wrong. Didn't they scan after the photo was taken not just before upload to the cloud? If so, that is very significant into my mind.

And that's the part that's striking to me!