[It's FOSS News] Google's New Web Environment Integrity Proposal Dismissed by Brave, Mozilla, and Vivaldi
[It's FOSS News] Google's New Web Environment Integrity Proposal Dismissed by Brave, Mozilla, and Vivaldi
Good, but like all other evil motions like this, they'll just take a short break, rebrand it / rework it / rename it / etc... and try again. And again. And again. Until everyone gets tired.
We have to stay diligent and keep defeating these assholes every time they try to take over the entire internet.
Yep.
Just look at Bethesdas paid mods fiasco. Only took two tries to get it accepted by a lot of people.
Well, that's nearly 3% of the market.
Google's plan is foiled once again.
It's about 10%. Still not a lot.
Of desktop, maybe.
Overall (and like 60% of all browsing is now mobile), no way. Mobile is where alternative browsers really suffer. Firefox actually seems OK for Android but it's not quite as slick on many sites, probably due to them targeting Chrome. Apple force Safari on you so you can't use Firefox at all.
Doesn't matter. Websites will break on the rest of the browsers. Users will complain. All browsers now have Web DRM
Or web site owners that use it will go out of business because people don’t want to change their browsers. The companies will realize their decision was bad when all of a sudden their customers stop coming to their sites.
Google needs shut down! Or at least go back to being a search engine.
The effect those people will have on profit margins probably are negligible, given the large amount of people using Google-created web browsers already.
Or someone will somehow create a new web browser or add-on or just another branch of Chromium that fakes out the DRM somehow.
Like with ReVanced, for example. It's a modified version of the YouTube app with an adblocker and several other bells and whistles added on (and the ability to remove a lot of Google's own bells and whistles).
Unfortunately you're probably right. Vivaldi has already said they will likely adopt this standard despite them disagreeing with it, I assume the same will happen to Firefox and Brave if the standard becomes widely adopted and used enough. Its not an easy issue to tackle. The good thing is we can fight back and push its adoption back as far as possible, as well as just avoiding and boycotting any websites that adopt the standard. I don't know if the push back will be big enough to make an impact, but we at least have to try and do what we can.
We've already seen DRM garbage added to nearly every browser for media playback, despite massive backlash and concerns from organizations like the EFF. Mozilla didn't want to adopt it iirc but they caved in to not lose market share and adopted it in the most user friendly and secure/privacy respective way that they could (Restricting the DRM in its own sandbox), so I could see something like that happen again unfortunately. However to be fair, this new Google DRM standard will be significantly worse and more of a problem than that DRM implementation, as this effects entire websites themselves now and is on a whole new scale and precedent, and not just for certain media content, so hopefully more can be done to prevent this and fight back.
I wonder if there can be any anti-monopoly law suits involved if Google just starts implementing drm on its websites and products without other browsers agreeing to implement it. Sounds a lot like "use chrome, or else."
Mozilla:
Mozilla opposes this proposal...
I wish they took a stronger stance like Brave:
We won’t be shipping WEI support
C'mon Mozilla, show some gonads.
Mozilla is funded by Google, they're pretty good at just opposing them.
They have the same stance. Mozilla just won't implement it.
Brave needs to make it known they won't ship it because their browser is based on Chromium.
Building dystopias is a trend nowadays. The only difference is that some do it openly, while others trying to brand it as security benefits.
Apple are the only other ones big enough to throw their weight around. Hopefully they join in.
Oh, but they already did join in, google that is.
I always say that Apple's biggest success is somehow convincing people that they're pro-consumer.
Write to your country’s anti-trust body if you feel Google is unilaterally going after the open web with WEI (content below taken from HN thread https://news.ycombinator.com/item?id=36880390).
US:
https://www.ftc.gov/enforcement/report-antitrust-violation antitrust@ftc.govEU:
https://competition-policy.ec.europa.eu/antitrust/contact_en comp-greffe-antitrust@ec.europa.euUK:
https://www.gov.uk/guidance/tell-the-cma-about-a-competition… general.enquiries@cma.gov.ukIndia:
https://www.cci.gov.in/antitrust/ https://www.cci.gov.in/filing/atdExample email:
Google has proposed a new Web Environment Integrity standard, outlined here: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md This standard would allow Google applications to block users who are not using Google products like Chrome or Android, and encourages other web developers to do the same, with the goal of eliminating ad blockers and competing web browsers. Google has already begun implementing this in their browser here: https://github.com/chromium/chromium/commit/6f47a22906b2899412e79a2727355efa9cc8f5bd Basic facts: Google is a developer of popular websites such as google.com and youtube.com (currently the two most popular websites in the world according to SimilarWeb) Google is the developer of the most popular browser in the world, Chrome, with around 65% of market share. Most other popular browsers are based on Chromium, also developed primarily by Google. Google is the developer of the most popular mobile operating system in the world, Android, with around 70% of market share. Currently, Google’s websites can be viewed on any web-standards-compliant browser on a device made by any manufacturer. This WEI proposal would allow Google websites to reject users that are not running a Google-approved browser on a Google-approved device. For example, Google could require that Youtube or Google Search can only be viewed using an official Android app or the Chrome browser, thereby noncompetitively locking consumers into using Google products while providing no benefit to those consumers. Google is also primarily an ad company, with the majority of its revenue coming from ads. Google’s business model is challenged by browsers that do not show ads the way Google intends. This proposal would encourage any web developer using Google’s ad services to reject users that are not running a verified Google-approved version of Chrome, to ensure ads are viewed the way the advertiser wishes. This is not a hypothetical hidden agenda, it is explicitly stated in the proposal: “Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they’re human, sometimes through tasks like challenges or logins.” The proposed solution here is to allow web developers to reject any user that cannot prove they have viewed Google-served ads with their own human eyes. It is essential to combat this proposal now, while it is still in an early stage. Once this is rolled out into Chrome and deployed around the world, it will be extremely difficult to rollback. It may be impossible to prevent this proposal if Google is allowed to continue owning the entire stack of website, browser, operating system, and hardware. Thank you for your consideration of this important issue.do you have a link for canada?
Google sent me here https://www.ic.gc.ca/eic/site/cb-bc.nsf/frm-eng/GHÉT-7TDNA5
Done for Switzerland 👍🏻
Don't know about others, but it seems you need to pay money to file antitrust complaints in India. From the link you mentioned:
What are the fees to be paid? [Regulation 49 of the Competition Commission of India (General) Regulations, 2009]
(1) Each information received under clause (a) of sub-section (1) of section 19 of the Act from any person shall be accompanied by proof of having paid the fee as under- (a) rupees 5,000 (five thousand) in case of individual or Hindu Undivided Family (HUF), or (b) rupees 10,000 (ten thousand) in case of Non-Government Organisation (NGO), or Consumer Association, or a Co-operative Society, or Trust, or (c) rupees 40,000 (forty thousand) in case of firm (including proprietorship, partnership or Limited Liability Partnership) or company (including one person company) having turnover in the preceding year upto rupees two crore, or (d) rupees 1,00,000 (one lac) in case of firm (including proprietorship, partnership or Limited Liability Partnership) or company (including one person company) having turnover in the preceding year exceeding rupees two crore and upto rupees 50 crore (e) rupees 5,00,000 (five lacs) in the cases not covered under clause (a) or (b) or (c) or (d).]
Woah, those go from expensive to absurd.
I could see charging like 1000 rupees to deter frivolous complaints, but up to $500,000 is absurd.
Seems like the system is only meant for B2B complaints. B2B antitrust complaints where the offended party still has enough money to drop half a million USD on an antitrust complaint.
This standard doesn't affect ad blockers.
###Goals
- Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device.
- Offer an adversarially robust and long-term sustainable anti-abuse solution.
- Don't enable new cross-site user tracking capabilities through attestation.
- Continue to allow web browsers to browse the Web without attestation.
###Non-goals
- Enable reliable client-side validation of verdicts: Signatures must be validated server-side, as client javascript may be modified to alter the validation result.
- Enforce or interfere with browser functionality, including plugins and extensions.
- Access to this functionality from non-Secure Contexts.
The workflow does not involve checking or blocking extensions. It operates closer to SSL certs. The webpage asks the browser to prove its identity. The browser generates a token. A trusted third party (attester) signs the token. It sends that back to the webpage. The webpage decides if the token is legitimate and if they trust the third party.
The ability to use extensions which alter the contents of the webpage is still allowed if the browser allows it. This standard just verifies the identity of the browser.
It still will cause issues for the Internet, though. Small browsers would likely be unable to afford paying for the attesters. Fingerprinting would be much easier and WEI doesn't have a method to prevent high entropy. Attesters would be able to track each user and the sites they are visiting.
and all of the world with basic knowledge about privacy and all users who doesnt use the google chrome browser.
Not just Chrome. Apple already rolled out something similar in Safari.
Permanently Deleted
Yeah. I'm trying to understand this situation but don't have the time to research. Thinking of sending an email to the European organisation that works for this as someone else has already laid it out. I'm just afraid I don't quite know/follow enough to be able to answer follow-up questions from the org.
This will go through. Firefox already caved on the video/audio DRM last time, and even if they don't, people will just switch browsers. The only thing that could do anything about this are powerful governments and maybe Apple. But Google has bribed all of Washington and half of Brussels at this point, and I imagine the press actually likes the idea of putting DRM on their shitty websites, so they won't make a big stink I don't think, even though they beef with Google. If Apple actually drags their feet I'm sure Google can bribe them.
Thank goodness the other browsers are sane enough not to buy into Google's bullshit. But it does feel like it's only gonna be a matter of time until Google wins, given their massive market share and all that.
It would've been nicer if 9/10 of these other browsers weren't also based on Chromium, strenghtening Googles position
Google already sabotaged edge and forced it to convert to Chromium base.
Give it time, they'll do the same to others, until they hold singular control over everything.
I feel like Edge kinda sabotaged itself with it originally running on EdgeHTML, which was a fork of MSHTML, which is what Internet Explorer ran on. Edge also used an updated design of the blue "e" logo. So, to most users, Edge was just Internet Explorer with a new coat of paint.
Good