The much maligned “Trusted Computing” idea requires that the party you are supposed to trust deserves to be trusted, and Google is DEFINITELY NOT worthy of being trusted, this is a naked power grab to destroy the open web for Google’s ad profits no matter the consequences, this would put heavy surveillance in Google’s hands, this would eliminate ad-blocking, this would break any and all accessibility features, this would obliterate any competing platform, this is very much opposed to what the web is.
Ugh. DRM. I freaking hate DRM. I “buy” a book from Amazon and it’s all DRMed. I like the Kindle app so I keep buying there. But when I can I buy physical books at a LBS
Can someone explain to me how this is different to the trust system used by SSL Certificates?
I think that the main difference is that with SSL you only encrypt the data, and then you can modify at will(as in making changes to every page your browser renders - ad block, grease monkey like extensions etc. With DRM, you won’t be able to modify the pages at all
I was meaning more in the “trusting Google” sense, how is this different to trusting VeriSign?
This is only my opinion, but basically you cannot trust no one. Having that said, certificate providers make their money by ensuring you will get the page from the server you asked for, and also for the encryption. Ignoring the certificate is possible, since it is the browser’s choice. My point is, SSL providers have a lot to lose by exploiting the certificates for malicious intents(such as modifying the data, or changing to a different host etc) while the DRM of google is by design meant to allow us less freedom with how we use the web.
So i think that you can choose who is less trust worthy by figuring out what they will gain
This is why you donate to Mozilla, Thunderbird, and/or the EFF.
It’s also why you use non-Chromium/non-Webkit browsers.
Gonna play devil’s advocate here… I think most Mozilla money comes from Google and i think the reason Google keeps the money flowing to Mozilla is for Chrome to have a real competitor, Firefox to date is the only popular web browser with different engine and all that. Maybe it’s fair for me to say that it resembles a tiny tiny fraction of why Intel keeps AMD alive back then.
As for EFF, i viewed them as just another NGO. For me most NGOs will have a non achievable goals, because it will be the dead of an NGO if they ever achive their goals. (No more money for them).
I’m not against people donating to Mozilla or EFF or Thunderbird Foundation. I think it will be better (yet longer process) if government can regulate big tech, much like what the European Union did with GDPR.
the reason Google keeps the money flowing to Mozilla is for Chrome to have a real competitor, Firefox to date is the only popular web browser with different engine and all that
Did you forget Safari? It has orders of magnitude more users than Firefox and it doesn’t use the same rendering engine as Chrome.
The government won’t regulate big tech if that doesn’t give them any benefit. Governments want to control big tech to gain more power.
Governments like the EU do not just regulate to gain power. No need to spread disinformation just so you can be more pessimistic.
Yep, that sounds like a very Mega-Corp thing to do.
Why do people have a problem with this? It explicitly says browser extensions, like ad blockers, will still work. It says cross site tracking won’t be allowed. It all sounds pretty good.
It sounds like most are not liking it because of some potential future abuses rather than what it actually is?
It sounds like most are not liking it because of some potential future abuses rather than what it actually is?
If I, potentially, wanted to abuse a system, I’d probably come up with a way to modify that system such that I can abuse it, but with a plausible explanation as to why I’m not actually going to do that, so that others will agree to it.
But let’s assume, for the sake of the argument, that Google and/or the people who wrote this are actually acting in good faith. That still won’t stop other large companies like Microsoft, Apple, etc. or even future Google employees from abusing the system later on.
Yes, the potential for abuse is the big deal here. And you know humans, if it can be abused, someone will try.
Sure, but this is also a solution for the existing abuse that runs rampant. Which abuse is better?
I’m sure these same arguments against this were made for anti-virus software back in the beginning. “They’re only doing this so in the future they can flag all their competitors programs as viruses” and “they’re only doing this so they can choose who can use what”. The parallels are strong.
Is there a way to stop the existing abuse without introducing a different kind of abuse? Ideally, that’s what we should aim for, if possible at all.
If that’s not possible, restricting people’s freedoms in the digital world (or the real world, for that) to prevent some from abusing such freedoms doesn’t sound such a great proposition. As for “which abuse is better”, I’d argue that if I have to be abused one way or another, I’d prefer to be free and in control so I have a chance to stop it myself ;)
(what freedoms, you might say? freedoms to run my own choice of operating system, my choice of browser, etc. on a computer that I own, maybe even built myself, and not be prevented from accessing the internet at large)
I’m sure these same arguments against this were made for anti-virus software back in the beginning
And I’m sure some of those companies, or some of those companies’ employees, wrote some viruses themselves ;) But really, we can only speculate. Most are definitely legit and helpful.
The key here is, who is in control: the user of the software, or the company that made it? I’d say even for antiviruses, the user is in control, can choose a different antivirus or no antivirus at all (like me). In this Google proposal, it seems Google and other big corporations will be in control and not the user. That’s the reason why it’s bad. If I have to be abused, at least I like being in control so I can (try to) prevent it.
This is part of a broader plan:
- Get hardware attestation, aka secure boot (DONE)
- Get software attestation, via app stores (DONE)
- Get web app attestation (this proposal)
- Compile all web apps to webassembly (upcoming)
- Create a provider-controlled environment on user-supplied devices (partially there)
Only basic extensions and ad blockers will work with compiled apps (Manifest V3 is part of that plan). Accessibility features will be as good as those of Flash.
What most are not liking, is the change in power dynamic on the WWW:
-
Before: “you give me some data and I’ll decide what to do with it”
-
Upcoming: “we’ll give you some data and you will do exactly as we tell you with it”
The time might be coming to create a “libre WWW”, parallel to the “corporate WWW”.
I’m mostly in agreement but … what’s wrong with webassembly? that’s just another way to compile webapps into, or parts of webapps, other than javascript. What am I missing?
“Compiled” is the key: a non-reversible operation that implies loss of syntactical and grammatical content. Meaning, it’s harder to analyze, reason about, or modify. As the “assembly” part indicates, it’s intended to be as hard to analyze, reason about, or modify, as possible.
First there was Java, then there was Flash, now there is Webassembly… all compiled to bytecode, all running in their VM, all intent on converting all apps everywhere, and to lock “proprietary” elements away from the prying eyes and hands of content blockers, analyzers, or even worse: control by end users.
Webassembly and attestation just go hand in hand to create a remote-controlled enclave on a user-owned device that will make it as hard as possible for the user to control.
Some may see it as an inherent exploitation of the user’s resources (already used for cryptominer exploits), others as an attack vector that will be difficult to mitigate by design, others as an unnecessary duplication of the JVM.
Maybe somebody can do a better job of boiling this down than I can.
Basically, right now, if you ask for something on the internet, it gets served to you. Sure there are lots of server side protections that may require an account to log in to access things or what have you, but still you can at least request something from a server and get some sort of response in return.
What this does is force attestation through a third party. I can ask for something from a server and the server turns to the attester and goes, “Hey, should I give this guy what he’s asking for?” and the attester can say “No” for whatever reasons it might. Or worse yet, I can get the attestation but the server can then decide based in turn that it doesn’t like me having that attestation and I get nothing.
You can make arguments that this would be good and useful, but it’s so easy to see how this could go sideways and nobody with any sense should be taking Google or any of these large corporations at their word.
From my understanding, there’s no reason whatsoever to do this besides censorship, for better and for worse. There’s a possibility good, and I’m sure the good would happen, but there’s an even greater possibility it would be bad for users which would surely happen.
Sorry, yes, still trying to wrap my head around it. It’s one of those things where there is quite obviously no direct benefit for the user. The company is trying to sell it as improving their content, moderation, security, etc. which may have indirect, knock-on effects for the end user but whether that would even be true or if it would be perceptible to your average person is MUCH more questionable.
It’s the same kind of thing when you see people defending exclusivity on consoles. I mean sure, it helps prop up your favorite company/developer in hopes that the market benefit may someday come back around and help them to produce more content/games that you like, but people seriously need to start looking out after their own self interests first and corporations be damned. They earn money by providing actual value, don’t ever argue against yourself.
