Most active commenters
  • Xenoamorphous(4)
  • wbobeirne(4)
  • account42(3)

←back to thread

Unpacking Google’s Web Environment Integrity specification

(vivaldi.com)
756 points dagurp | 23 comments | 26 Jul 23 11:30 UTC | HN request time: 1.12s | source | bottom
Show context
wbobeirne ◴[26 Jul 23 17:56 UTC] No.36881997[source]▶

    > Can we just refuse to implement it?
    > Unfortunately, it’s not that simple this time. Any browser choosing not to implement this would not be trusted and any website choosing to use this API could therefore reject users from those browsers. Google also has ways to drive adoptions by websites themselves.
This is true of any contentious browser feature. Choosing not to implement it means your users will sometimes be presented with a worse UX if a website's developers decide to require that feature.

But as a software creator, it's up to you to determine what is best for your customers. If your only hope of not going along with this is having the EU come in and slapping Google's wrist, I'm concerned that you aren't willing to take a hard stance on your own.

replies(16): >>36882111 #>>36882159 #>>36882251 #>>36882319 #>>36882333 #>>36882392 #>>36883076 #>>36884242 #>>36886398 #>>36886528 #>>36886698 #>>36887109 #>>36888102 #>>36888252 #>>36889157 #>>36890182 #
nvy ◴[26 Jul 23 18:15 UTC] No.36882333[source]▶
>But as a software creator, it's up to you to determine what is best for your customers.

Absolutely zero large web properties do anything based on what's best for users. If this gains traction, Google will simply deny adsense payments for impressions from an "untrusted" page, and thus all the large players that show ads for revenue will immediately implement WEI without giving a single flying shit about the users, as they always have and always will.

replies(4): >>36883319 #>>36883544 #>>36883620 #>>36884815 #
wbobeirne ◴[26 Jul 23 19:35 UTC] No.36883620[source]▶
I think this is a little reductive. WEI is likely what some people at Google felt was best for AdSense's customers, i.e. advertisers. It just so happens that Google has a whole other set of customers who this is not best for, e.g. Chrome users, YouTube users. The problem is that it's all coming from one company, and AdSense is where the money is at, so I don't trust Google to make the best decisions for their secondary customers.

I definitely agree that AdSense blocking clients that don't implement WEI seems likely. At that point, it will be up to websites that rely on AdSense revenue to decide what to do with customers they aren't monetizing. That's already a question they have from users with ad blockers, although that is a little bit more challenging to detect.

My hope is that the majority of sites accept that they can't rely on ad revenue, and instead resort to directly monetizing users as a way to make ends meet. IMO that's a better relationship than indirectly selling their data and attention.

replies(3): >>36883945 #>>36884469 #>>36886497 #
1. Xenoamorphous ◴[26 Jul 23 19:54 UTC] No.36883945[source]▶
> At that point, it will be up to websites that rely on AdSense revenue to decide what to do with customers they aren't monetizing.

Isn’t this a no brainer? Ad funded websites have zero incentive to serve pages to ad blocker users. Not only they don’t make any money from them, they cost them money.

replies(4): >>36884260 #>>36884651 #>>36884863 #>>36885102 #
2. wbobeirne ◴[26 Jul 23 20:13 UTC] No.36884260[source]▶
I run an ad blocker on all of my devices (mix of uBlock or Brave browser) and I'm pretty surprised how infrequently sites ask me to disable it to access content. Not sure if your experience is different.
replies(1): >>36884885 #
3. bmacho ◴[26 Jul 23 20:39 UTC] No.36884651[source]▶
Users that use ad blockers and are served

  - cost mostly marginal money
  - continue to use your platform, potentially watch ads later
  - their usage can be sold to anyone: where are they at a given time and what are they doing
  - don't go to rival platforms
  - tell their friends about the website
  - etc
replies(1): >>36887123 #
4. lnxg33k1 ◴[26 Jul 23 20:53 UTC] No.36884863[source]▶
I visit a lot of websites that show blank pages upon seeing that I have an adblocker, so the technology to prevent serving those who have adblock is still there, I 100% of the time, saw the message to disable adblocker and just left the website.

This tech is not to prevent serving content to people who adblock, this technology is to make sure that people don't have the ability to make that choice and force certain setups that prevent adblocking

replies(1): >>36889342 #
5. vbezhenar ◴[26 Jul 23 20:54 UTC] No.36884885[source]▶
Probably because ublock deletes those “disable Adblock“ screens.
replies(1): >>36885001 #
6. wbobeirne ◴[26 Jul 23 21:04 UTC] No.36885001{3}[source]▶
Any proper gate for a user to access content should be managed by a server, not on the client side. It would have to be the same for WEI. If they can detect that I'm using an adblocker, there's no reason they couldn't prevent me from accessing content by not even serving the content in the first place.
replies(3): >>36885629 #>>36885732 #>>36886882 #
7. Cort3z ◴[26 Jul 23 21:12 UTC] No.36885102[source]▶
Figuring out and serving the site to display the “disable Adblock” is likely more costly than to serve the content (unless its video).

That being said; creators needs money to keep making what they are making. Too bad ads is such an all encompassing method. The web is literally worse with it, but would not have been as big without it.

replies(1): >>36892156 #
8. anonymous_sorry ◴[26 Jul 23 21:51 UTC] No.36885629{4}[source]▶
Unless they can only detect it with client-side code?
9. omoikane ◴[26 Jul 23 21:59 UTC] No.36885732{4}[source]▶
It's a cat and mouse game between the ad-blockers and ad-blocker-blockers. I imagine if WEI actually becomes a thing, WEI countermeasures will also emerge, and WEI counter-countermeasures soon after.

A better plan might be for websites to find some a better way to sustain themselves, possibly by running ads that are more relevant and less obnoxious so that users wouldn't block them.

10. blibble ◴[26 Jul 23 23:58 UTC] No.36886882{4}[source]▶
the point of remote attestation is the environment the client is running in can be measured by the server and any tampering detected

tampering meaning running your code instead of theirs

replies(1): >>36892912 #
11. simbolit ◴[27 Jul 23 00:25 UTC] No.36887123[source]▶
I wish the people running adtech-reliant websites would agree with your (very fair) points.
replies(1): >>36900784 #
12. Xenoamorphous ◴[27 Jul 23 05:37 UTC] No.36889342[source]▶
Showing some ads in an ad funded website is the admission fee. You’re not willing to pay it, which is completely fine, so just don’t go to that website. But if you keep coning back to an ad funded website because you enjoy their content, it’s only fair that you disable the ad blocker in that site.

Those sites that showed you the “disable ad blocker” pop up that prompted you to leaving won’t miss you.

replies(3): >>36889597 #>>36890086 #>>36890496 #
13. jalfresi ◴[27 Jul 23 06:13 UTC] No.36889597{3}[source]▶
Its not an admission fee. The website is hosted on a publicly accessible web server. There is no admission fee. The browser I am using serves my purposes; if I wish to strip certain elements from the page, add new ones or reformat the page any way I see fit, I can and am allowed to.

The point Google seem to be making quite clearly, is that the browser does not serve my needs, but the needs of Googles paying customers.

replies(1): >>36891867 #
14. lnxg33k1 ◴[27 Jul 23 07:21 UTC] No.36890086{3}[source]▶
And I won’t miss them, not sure the point you’re making, i am not able to know if a website has ads before visiting it, can only leave once. It has asked me to
replies(1): >>36891848 #
15. isaacremuant ◴[27 Jul 23 08:15 UTC] No.36890496{3}[source]▶
Except they don't just show you adds, they heavily track you in all kinds of disingenuous and non transparent ways.

But hey, it's great that some people want to make the devices they own and holds extremely valuable days of their own person, something controlled by external entities.

Don't worry, those of us who know our tech and value our privacy, will continue not listening to the "just take it" crowd.

16. ◴[27 Jul 23 11:11 UTC] No.36891848{4}[source]▶
17. Xenoamorphous ◴[27 Jul 23 11:14 UTC] No.36891867{4}[source]▶
We're talking about ethics here, not laws nor what's technically possible.

You want to support the ad-funded website you keep coming to, yes or no? Yeah ideally every website would have a paid option for the HN crowd with cushy jobs, but that's not always feasible.

replies(1): >>36891996 #
18. account42 ◴[27 Jul 23 11:35 UTC] No.36891996{5}[source]▶
> We're talking about ethics here, not laws nor what's technically possible.

In that case, ads, being psychological manipulation to get users to do things they would not otherwise do, are already highly unethical. The ethical think to do is to discourage their use, which includes blocking them for yourself thus making them less profitable overall.

replies(1): >>36892456 #
19. account42 ◴[27 Jul 23 11:57 UTC] No.36892156[source]▶
> That being said; creators needs money to keep making what they are making.

Many ad-supported sites rely on unpaid users for content.

20. Xenoamorphous ◴[27 Jul 23 12:31 UTC] No.36892456{6}[source]▶
And what better way of blocking them that not visiting that website that serves them?
replies(1): >>36893483 #
21. hellojesus ◴[27 Jul 23 13:12 UTC] No.36892912{5}[source]▶
The conflict emerges because the device is mine, not theirs. I ask for content, they send it. It seems am unfair burden to collude with os and hardware manufactures to force the user to give up general computing in order to visit an otherwise unknown web page. It would be a much better experience to go dark with content like Twitter has done than to remove general computing from the web.
22. account42 ◴[27 Jul 23 13:50 UTC] No.36893483{7}[source]▶
https://ublockorigin.com/ for instance
23. kzhe ◴[27 Jul 23 22:06 UTC] No.36900784{3}[source]▶
...