←back to thread

Unpacking Google’s Web Environment Integrity specification

(vivaldi.com)
756 points dagurp | 5 comments | 26 Jul 23 11:30 UTC | HN request time: 0.414s | source
Show context
Pannoniae ◴[26 Jul 23 18:14 UTC] No.36882314[source]▶
There is zero point debating this in technical detail because the proposal itself is evil. Don't get distracted by tone policing and how they scream you must be civil and whatnot.

Our best hope is kicking up a huge fuss so legislators and media will notice, so Google will be under pressure. It won't make them cancel the feature but don't forget to remember that they aren't above anti-trust law. There is a significant chance that some competition authority will step in if the issue doesn't die down. Our job is to make sure it won't be forgotten really quickly.

replies(4): >>36882382 #>>36882512 #>>36883092 #>>36886092 #
rezonant ◴[26 Jul 23 18:18 UTC] No.36882382[source]▶
Yes, we need to protest. And I don't mean protest by slamming Google's github repositories with comments. That's not a protest. Go tell the media. Go tell your elected officials.

I also think web developers getting together like we did with SOPA/PIPA and raising awareness on our web properties can also help. How do we organize that?

replies(4): >>36882511 #>>36882562 #>>36882582 #>>36890656 #
1. Pannoniae ◴[26 Jul 23 18:25 UTC] No.36882511[source]▶
There are some ways ranging from mellow to outright cuntish. These can be applied to websites or social media profiles (depending on the method):

- Display a small text or a link to raise awareness about WEI

- Display a "Works best with Firefox, a browser which respects you and your privacy" banner in a similar way to the chrome nagging popups.

- Display a fullscreen modal (just like the SOPA/PIPA ones) with a detailed write-up of the problem

- Subtly degrade the website's experience on chromium (just check window.chrome)

- Outright block chromium, and explain why.

replies(1): >>36883090 #
2. cayley_graph ◴[26 Jul 23 19:00 UTC] No.36883090[source]▶
Blocking Chromium altogether isn't as big of a deal as it seems, either (unless you're a truly huge website). It's so easy to switch to Firefox these days. Probably takes a few minutes. For technical blogs with useful content on them I suspect people's desire to see the content will override the inertia of switching browsers.
replies(2): >>36885388 #>>36888081 #
3. hellojesus ◴[26 Jul 23 21:33 UTC] No.36885388[source]▶
Does not blocking Chromium devolve in behavior to a comparable level as WEI? Seems like the same problem is introduced: breaking the web.
replies(1): >>36886321 #
4. cesarb ◴[26 Jul 23 22:59 UTC] No.36886321{3}[source]▶
> Does not blocking Chromium devolve in behavior to a comparable level as WEI? Seems like the same problem is introduced: breaking the web.

Not really, for two reasons.

First, is that it can be bypassed, for instance with an extension which hides the relevant JS property and/or switches the user agent, or even on-the-fly edits the site's Javascript. The whole point of WEI is that it cannot be bypassed.

Second, is that just blocking Chromium does not prevent the development and use of new web browsers and/or operating systems, while a predictable consequence of WEI is making them non-viable in practice (they'd have to first convince Google that both the browser and operating system is DRM-ed enough that the user does not have enough control over the browser to make it do everything the user wants, and only then the browser would be allowed to access WEI-walled content).

5. hightrix ◴[27 Jul 23 02:18 UTC] No.36888081[source]▶
It absolutely takes just a few minutes. I did it today on my work laptop, installed Firefox, import from chrome, and I was back to work in less than 5