Most active commenters

    ←back to thread

    Unpacking Google’s Web Environment Integrity specification

    (vivaldi.com)
    756 points dagurp | 16 comments | 26 Jul 23 11:30 UTC | HN request time: 0s | source | bottom
    Show context
    Pannoniae ◴[26 Jul 23 18:14 UTC] No.36882314[source]▶
    There is zero point debating this in technical detail because the proposal itself is evil. Don't get distracted by tone policing and how they scream you must be civil and whatnot.

    Our best hope is kicking up a huge fuss so legislators and media will notice, so Google will be under pressure. It won't make them cancel the feature but don't forget to remember that they aren't above anti-trust law. There is a significant chance that some competition authority will step in if the issue doesn't die down. Our job is to make sure it won't be forgotten really quickly.

    replies(4): >>36882382 #>>36882512 #>>36883092 #>>36886092 #
    1. rezonant ◴[26 Jul 23 18:18 UTC] No.36882382[source]▶
    Yes, we need to protest. And I don't mean protest by slamming Google's github repositories with comments. That's not a protest. Go tell the media. Go tell your elected officials.

    I also think web developers getting together like we did with SOPA/PIPA and raising awareness on our web properties can also help. How do we organize that?

    replies(4): >>36882511 #>>36882562 #>>36882582 #>>36890656 #
    2. Pannoniae ◴[26 Jul 23 18:25 UTC] No.36882511[source]▶
    There are some ways ranging from mellow to outright cuntish. These can be applied to websites or social media profiles (depending on the method):

    - Display a small text or a link to raise awareness about WEI

    - Display a "Works best with Firefox, a browser which respects you and your privacy" banner in a similar way to the chrome nagging popups.

    - Display a fullscreen modal (just like the SOPA/PIPA ones) with a detailed write-up of the problem

    - Subtly degrade the website's experience on chromium (just check window.chrome)

    - Outright block chromium, and explain why.

    replies(1): >>36883090 #
    3. therein ◴[26 Jul 23 18:28 UTC] No.36882562[source]▶
    I wrote to some senators today about this and also filed an FTC complaint against Google.

    Talked to a few friends inside Google as well and they are also against it.

    Firefox is going to be my default moving forward.

    There is no reason or way to discuss it with technical merits anyway. Nobody can create a new issue on that repo, nor can they create a PR. Comments on reviews are also disabled.

    Many of us are at technical spots that can do this. We need to bring back "Works best with Mozilla Firefox" pop-overs.

    replies(3): >>36882625 #>>36883257 #>>36890634 #
    4. bloopernova ◴[26 Jul 23 18:29 UTC] No.36882582[source]▶
    Also protest by stopping use of google products.
    replies(2): >>36882648 #>>36882691 #
    5. rezonant ◴[26 Jul 23 18:32 UTC] No.36882625[source]▶
    I think we should make a POPA/SIPA style explainer/protest popup JS script that webdevs can drop in just like before.
    replies(1): >>36883156 #
    6. benatkin ◴[26 Jul 23 18:33 UTC] No.36882648[source]▶
    Use Rumble instead of YouTube? Even if it's more ethical, do I want to see Russell Brand and Jim Jordan on the home page?

    Edit: Ah, here's something about it from a degoogling perspective: https://www.reddit.com/r/degoogle/comments/x1610t/what_are_y...

    7. beebmam ◴[26 Jul 23 18:36 UTC] No.36882691[source]▶
    Boycott 100%.
    8. cayley_graph ◴[26 Jul 23 19:00 UTC] No.36883090[source]▶
    Blocking Chromium altogether isn't as big of a deal as it seems, either (unless you're a truly huge website). It's so easy to switch to Firefox these days. Probably takes a few minutes. For technical blogs with useful content on them I suspect people's desire to see the content will override the inertia of switching browsers.
    replies(2): >>36885388 #>>36888081 #
    9. cayley_graph ◴[26 Jul 23 19:04 UTC] No.36883156{3}[source]▶
    Yes. I would put this on my website if someone made it.
    10. rollcat ◴[26 Jul 23 19:10 UTC] No.36883257[source]▶
    > nor can they create a PR

    https://github.com/chromium/chromium/pull/187

    replies(1): >>36883536 #
    11. toyg ◴[26 Jul 23 19:29 UTC] No.36883536{3}[source]▶
    They won't appear from the repo itself.
    12. hellojesus ◴[26 Jul 23 21:33 UTC] No.36885388{3}[source]▶
    Does not blocking Chromium devolve in behavior to a comparable level as WEI? Seems like the same problem is introduced: breaking the web.
    replies(1): >>36886321 #
    13. cesarb ◴[26 Jul 23 22:59 UTC] No.36886321{4}[source]▶
    > Does not blocking Chromium devolve in behavior to a comparable level as WEI? Seems like the same problem is introduced: breaking the web.

    Not really, for two reasons.

    First, is that it can be bypassed, for instance with an extension which hides the relevant JS property and/or switches the user agent, or even on-the-fly edits the site's Javascript. The whole point of WEI is that it cannot be bypassed.

    Second, is that just blocking Chromium does not prevent the development and use of new web browsers and/or operating systems, while a predictable consequence of WEI is making them non-viable in practice (they'd have to first convince Google that both the browser and operating system is DRM-ed enough that the user does not have enough control over the browser to make it do everything the user wants, and only then the browser would be allowed to access WEI-walled content).

    14. hightrix ◴[27 Jul 23 02:18 UTC] No.36888081{3}[source]▶
    It absolutely takes just a few minutes. I did it today on my work laptop, installed Firefox, import from chrome, and I was back to work in less than 5
    15. icecream_so_gud ◴[27 Jul 23 08:35 UTC] No.36890634[source]▶
    Here is a copy of a letter I have sent out https://news.ycombinator.com/item?id=36889971

    Basically my arguments were it's anti-competitive, against the open web, and a risk to country's security agencies. The latter while a valid argument is to hopefully rattle politicians and government agencies.

    16. icecream_so_gud ◴[27 Jul 23 08:39 UTC] No.36890656[source]▶
    Getting the internet archive onboard would be a good start. They have a legitimate interest in automating crawling of sites.

    It could also hinder pentesters hired to test the owners website, but they already have to contend with WAFs.