Unpacking Google’s Web Environment Integrity specification

As noted in the article, Google comes up with a scheme like this every couple months. They also can’t seem to identify good sites anymore, based on their search results.

So… fuck it. Let them DRM their part of the internet. It is mostly shit nowadays anyway. They can index Reddit, X, and a bunch of sites that are GPT SEO trash.

We’re never getting 201X internet back anyway, so let Google and friends do their thing and everybody who doesn’t want anything to do with it can go back to the 200X internet. It was kind of disorganized but it it better than fighting them on DRM over an over again.

What are 200X and 201X internets?

If you can identify bots more accurately, you get less "GPT SEO trash".

decades :)

If we had known how fleeting the glory of the early 2010s internet would be, with everything ad-free and seo still comparatively rudimentary, would that have made it easier or harder to watch it die?

There is approximately a 0% chance that people won’t figure out how to make their bots “verified” if this goes through.

That's not how it works, because the GPT SEO trash is being generated by the people on the server.

This proposal does not affect bots producing web content, only (potentially) bots browsing web content.

As the other comment said, the decades. I could have used 2010’s I guess, it is just hard to refer to the first decade of the millennium that way.

Well there is that and there are users that post GPT SEO trash to Reddit et al, which is what the attestation API could help with.

It does affect bots creating social media content.

Not necessarily. Even with WEI, spammers could farm legit tokens and then set up their own api that hands one out to their bot when one is necessary.

Everything was free because interest rates were nothing, and every startup could use investor capital to cover their costs

the spammers are quite capable of buying several hundred old phones with valid attestation certificates to pump out crap

My understanding is that you can't reuse tokens, because the system uses challenge response.

Which is orders of magnitude more expensive than deploying the bot to a cloud or botnet.

I don't know how much bot spam pays these days. Maybe it's still worth it.

But can you get a token and then not send it and save it for later? That's more what I was thinking. Not replay attacks but gathering a bunch of tokens thst are valid but never submitted to the origin, and then provide them via api requests to those that need one to use unauthorized devices with that origin.

the attestation requirement increases the cost but also increases the value of the spam as the spammers competitors are put out of business

And everything was simpler, you could throw something up on a $10/month shared host. Now you need a full stack of services running in the cloud charged by the minute.