this post was submitted on 21 Jul 2023
2027 points (99.3% liked)
Privacy
31278 readers
715 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This post title is misleading.
They aren't proposing a way for browsers to DRM page contents and prevent modifications from extensions. This proposal is for an API that allows for details of the browser environment to be shared and cryptographically verified. Think of it like how Android apps have a framework to check that a device is not rooted, except it will also tell you more details like what flavor of OS is being used.
Is it a pointless proposal that will hurt the open web more than it will help? Yes.
Could it be used to enforce DRM? Also, yes. A server could refuse to provide protected content to unverified browsers or browsers running under an environment they don't trust (e.g. Linux).
Does it aim to destroy extensions and adblockers? No.
Straight from the page itself:
Edit: To elaborate on the consequences of the proposal...
Could it be used to prevent ad blocking? Yes. There are two hypothetical ways this could hurt adblock extensions:
Knowing this data and trusting it's not fake, a website could choose to refuse to serve contents to browsers that have extensions or ad blocking software.
Websites could then require that users visit from a browser that doesn't support adblock extensions.
I'm not saying the proposal is harmless and should be implemented. It has consequences that will hurt both users and adblockers, but it shouldn't be sensationalized to "Google wants to add DRM to web pages".
Edit 2: Most of the recent feedback on the GitHub issues seems to be lacking in feedback on the proposal itself, but here's some good ones that bring up excellent concerns:
Browsers developed and distributed by large tech firms have a conflict of interest with holding back or limiting attestation. Attestation enables the web to be restricted in a way that benefits tech firms. For example, Office 365 could require that it is used only on Windows and/or only through Edge.
Similarly to what I brought up, having the ability for websites to trust a (browser, os) tuple could allow for certain browsers to be preferred, simply because they do not support extensions.
How it will create hostile discrimination, and two-tiered services based on whether browsers are attested or not.
The proposal does not do an adequate job explaining how a browser may be attested to.. Would this require something like Secure Boot in order for a browser to be attested to? That would discriminate against users with outdated hardware lacking support for boot integrity, or users who don't have it enabled for some reason or another.
Ah yes Google said it's a non goal so we can rest easy
Frankly, I don't trust that the end result won't hurt users. This kind of thing, allowing browser environments to be sent to websites, is ripe for abuse and is a slippery slope to a walled garden of "approved" browsers and devices.
That being said, the post title is misleading, and that was my whole reason to comment. It frames the proposal as a direct and intentional attack on users ability to locally modify the web pages served to them. I wouldn't have said anything if the post body made a reasonable attempt to objectively describe the proposal and explain why it would likely hurt users who install adblockers.
It's not a goal, just a happy accident they found along they way!
Is just the first step in a series of corporate decisions that inevitably leads to
Google took "do no evil" out of their mission statement. Why would you trust them to stick to their word and not develop this tech in a way that helps their own ad platform make money?
In my other comments, I did say that I don't trust this proposal either. I even edited the comment you're replying to to explain how the proposal could be used in a way to hurt adblockers.
My issue is strictly with how the original post is framed. It's using a sensationalized title, doesn't attempt to describe the proposal, and doesn't explain how the conclusion of "Google [...] [wants] to introduce DRM for web pages" follows the premise (the linked proposal).
I wouldn't be here commenting if the post had used a better title such as "Google proposing web standard for web browser verification: a slippery slope that may hurt adblockers and the open web," summarized the proposal, and explained the potential consequences of it being implemented.
So they essentially pinky-swear not to use this in the way they are obviously intending to use it.
It doesn't aim to destroy extensions but point #1 within the problem statement:
Oh, for sure. When bullet point number one involves advertising, they don't make it hard to see that the underlying motivation is to assist advertising platforms somehow.
I think this is an extremely slippery and dangerous slope to go down, and I've commented as such and explained how this sort of thing could end up harming users directly as well as providing ways to shut out users with adblocking software.
But, that doesn't change my opinion that the original post is framed in a sensationalized manner and comes across as ragebaiting and misinforming. The proposal doesn't directly endorse or enable DRMing of web pages and their contents, and the post text does not explain how the conclusion of adblockers being killed follows from the premise of the proposal being implemented. To understand how OP came to that conclusion, I had to read the full document, read the feedback on the GitHub issues, and put myself in the shoes of someone trying to abuse it. Unfortunately, not everyone will take the time to do that.
As an open community, we need to do better than incite anger and lead others into jumping to conclusions. Teach and explain. Help readers understand what this is all about, and then show them how these changes would negatively impact them.
And yet, this proposal would make it easier to do so.
Are you intentionally trying to be dense?
Did you read until the end, or was it more important to accuse me of either being stupid or a corporate shill? I have nothing against you, and I don't see how it's constructive to be hostile towards me.
I said that the proposal itself does not aim to be DRM or adblock repellent, and cited the text directly from the document. It's possible that something got lost in communication, but that wasn't me trying to suggest that we should just blindly trust that this proposal has the users' best interests at heart, or that motivations behind creating it could never, ever be disingenuous.
Hell, I even made sure to edit my post to clarify how the proposal—if implemented—could be used to prevent ad blockers. The paragraphs right after the one you quoted say:
It's not about you, it's about your attitude towards the problem.
I read the entire document and several replies form beginning to end. I've also lived through several internet enshittifications. The point of the article is that while sure, that's what it says on print, we've gotta learn to read between the lines, in particular when it comes to big corps like Google. They "say" on non-commital writing it doesn't aim to be DRM, sure; that's just soft doublespeak to try and appease the first wave of peer review. This was even called out on mastodon by one of the contributors to #28 where they even quoted the dogwhistle-style wording.
Frankly? We already know how to auto-translate this corpo speak, we've had decades of this (and a fair amount of from Google itself, too). They say this, they say that, as they have countless times before. "We are inventing some Doomsday parts here. Might be useful in case someone wants to do Doomsday Stuff that we have done before on the weekly but don't officially approve of on record. Like, say, build the Doomsaday Device from the book 'Don't Invent the Doomsday Device'." If you say this does not intend to lock the web, you are lying to yourself and to others. Whether by evil intent or by negligence, I leave that one up to you.
Fair and respectable points, but I don't think we're going to see eye to eye on this. It seems like we have different priorities when it comes to reporting on issues.
Honestly, I don't disagree with you in thinking that the ulterior motive of the proposal is to undermine user freedom, user privacy, and/or ad blockers. Given Google's history with Manifest V3 and using Chrome's dominance to force vendors to adopt out-of-spec changes to web standards (passive scroll listeners come to mind), it would be burying my head in the sand to expect otherwise. My issue here is with portraying speculation and personal opinions as objective truths. Even if I agree that a locked down web is the most likely outcome, it's just not a fact until someone working on that proposal outright says it was their intent, or it actually happens.
That doesn't mean I think we should ignore the Doomsday device factory until it starts creating Doomsday devices, either, though. Google will never outright state that is their goal to cripple adblockers or control the web, and if it comes to happen, they'll just rely on corporate weasel words to claim that they never promised they wouldn't. And since we can't trust corporations to be transparent and truthful, we shouldn't be taking their promises or claims at face value. You're absolutely right about that.
Going back to reporting about this kind of stuff, though: It's not wrong for the original post to look past the surface-level claims, or for people to point out the corporate speak and lack of commitment. If there's a factory labeled "Not Doomsday Devices" that pinkie promises they aren't building Doomsday devices, I definitely would want someone to bring attention to it. I just don't think the right way to do it is with a pitchfork-wielding mob of angry citizens who were told the factory is unquestionably building anthrax bioweapons, however.
We don't gain much from readers being told things that will worry them and piss them off. I mean—sure—there's now more awareness about the issue. But it's not actually all that constructive if they aren’t critically engaging with the proposal. Google and web standards committees aren't going to listen to a bunch of angry Lemmy users reiterating the same talking points over and over. They're just going to treat it as a brigade and block further feedback until people forget about it (which they did).
If the topic was broached in a balanced and accurate way that refrained from making conclusions before providing readers with the facts, there would be less knee-jerk reactions. Maybe this is just me being naive, but I think it's more likely that Google would be receptive to well-thought-out, respectful criticism as opposed to a significant quantity of hostile accusations.
With that being said, I will concede that I overcorrected for the original post too much. I should have written a response covering the issue in a way that I found more ideal, rather than trying to balance out the bias from the original post. My goal was to point out the ragebait title and add missing information so readers could come to their own informed conclusions, not defend Google.
At which point it will be too late to decry it as such. You'll already be locked out (or in).
Honestly, it seems we just naturally can't see at the same eye leve, yeahl. You seem to be looking for dangers "down", on newspaper reports on stuff already gone; I'm looking for dangers "up", to the clouds in the sky and what meteorologists have to say about them.