We (me with a friend) created this page https://openwebdefenders.org and planning to create banners for websites that may want to inform their users on what’s going on.
Thank you for making an informative and non-alarmist website around the topic of Web Environment Integrity.
I’ve seen (and being downvoted for arguing against) so many articles, posts, and comments taking a sensationalized approach to the discussion around it, and it’s nice to finally see some genuine and wholly factual coverage of it.
I really can’t understate how much I appreciate your efforts towards ethical reporting here. You guys don’t use alarm words like “DRM,” and you went through the effort of actually explaining both what WEI does and how it poses a risk for the open web. Nothing clickybaity, ragebaity, and you don’t frame it dishonesty. Just a good, objective description of what it is in its current form and how that could be changed to everything people are worried about.
Is there anything that someone like me could help contribute with? It seems like our goals (informing users without inciting them, so they can create useful feedback without FUD and misinformation) align, and I’d love to help out any way I can. I read the (at the time incomplete) specs and explainer for WEI, and I could probably write a couple of paragraphs going over what they promised or omitted. If you check my post history, I also have a couple of my own example of how the WEI spec could be abused to harm users.
Unless something changed in the specification since I read it last, the attested environment payload only contains minimal information. The only information the browser is required to send about the environment is that: this browser is {{the browser ID}}, and it is not being used by a bot (e.g. headless Chrome) or automated process.
Depending on how pedantic people want to be about the definition of DRM, that makes it both DRM and not DRM. It’s DRM in the sense that it’s “technology to control access to copyrighted material” by blocking bots. But, it’s not DRM in the sense that it “enables copyright holders and content creators to manage what users can do with their content.”
It’s the latter definition that people colloquially know DRM as being. When they’re thinking about DRM and its user-hostility, they’re thinking about things like Denuvo, HDCP, always-online requirements, and soforth. Technologies that restrict how a user interacts with content after they download/buy it.
Calling web environment integrity “DRM” is at best being pedantic to a definition that the average person doesn’t use, and at worst, trying to alarm/incite/anger readers by describing it using an emotionally-charged term. As it stands right now, once someone is granted access to content gated behind web environment integrity, they’re free to use it however they want. I can load a website that enforces WEI and run an adblocker to my heart’s content, and it can’t do anything to stop that once it serves me the page. It can’t tell the browser to disable extensions, and it can’t enforce integrity of the DOM.
That’s not to say it’s harmless or can’t be turned into user-hostile DRM later, though. There’s a number of privacy, usability, ethical, and walled-garden-ecosystem concerns with it right now. If it ever gets to widespread implementation and use, they could later amend it to require sending an extra field that says “user has an adblocker installed”. With that knowledge, a website could refuse to serve me the page—and that would be restricing how I use the content in the sense that my options then become their way (with disabled extensions and/or an unmodified DOM) or the highway.
The whole concept of web environment integrity is still dubious and reeks of ulterior motives, but my belief is that calling it “DRM” undermines efforts to push back against it. If the whole point of its creation is to lead way to future DRM efforts (as the latter definition), having a crowd of people raising pitchforks over something they incorrectly claim it does it just gives proponents of WEI an excuse to say “the users don’t know what they’re talking about” and ignore our feedback as being mob mentality. Feedback pointing out current problems and properly articulating future concerns is a lot harder to sweep under the rug.
What a stupid argument. Google doesn’t give a fuck about feedback from anything but paying companies and shareholders, so we might as well enjoy our pitchforks.
Hi. Thanks a lot for your kind words and enthusiasm!
We are currently thinking about this “movement” and trying to plan stuff. If you have something on your mind, you are more than welcomed to create an issue.
I really appreciate your passion on this matter, and will kindly contact you after we structure stuff on our minds.
Cheers!
I don’t know about web environment integrity or where this will lead but I remember the time trusted computing and TPMs came up. At this time, people were really scared that this is the end of Linux (on PC). Today, I use secure boot (with my MOK) on my consumer distro just fine.
Had Trusted Computing happened as it was originally envisioned, you wouldn’t be. You’d be using Windows because that’s the only operating system you’d be allowed to use.
And now here we are again, facing down a plot to extinguish FOSS competition under the guise of security. Yes, it’s happened before, but that doesn’t mean the outcome is guaranteed to be as favorable as it was last time.
Change the sentence “Do you use browsers other than the mainstream ones like Chrome or Firefox” because Firefox is already a very small third-party browser.
I would consider changing the sentence not because Firefox is not mainstream, but because Firefox is also at risk for not implementing WEI.
In the end many might consider Firefox mainstream - not in terms of its current user base that change every year - but because a large percentage of internet users recognize the Firefox name. But being mainstream or not - and what that means - is not that relevant here.
How is Firefox a small 3rd party browser? FF is the basis for browsers like libreoffice, icewolf etc… it is not 3rd party, it is first party like chrome, opera and safari. Actually if you want to go that far, chrome actually started off as a fork of opera
I do too, but his reasoning is flawed. Based on his reasoning that would be saying Lemmy is a third party site because it doesn’t have the user share that Reddit does.
Microsoft’s edge browser is a fork of chromium, it’s not even first party anymore, like IE was.
Firefox is used by less than 3% of the users, it should not be used in this sentence. Also I’m not sure they’ll implement the integrity thing, which is another issue.
I agree Firefox doesn’t have a large share of the browsers, but if you are basing it on user share then the only mainstream browsers are safari and chrome. However, the term third party is generally utilized as a fork of a primary access point or is the access point via another means, even if it’s original.
For example, the apps to access lemmy are third party as they are not created by the original devs for lemmy. In this argument FF is classified as first party not third.
Don’t get me wrong I understood what you were trying to say, but based on your reply then pretty much chrome would be the only mainstream browser.
And that’s exactly what Google wants. Everything already works best with Google Chrome, so what’s wrong a little more incentive to convert more users into using a telemetry-laden spyware browser?
very true, but if you remember correctly a similar thought process killed IE, and is now harming Edge on windows. The only draw back is everyone wants to use chrome, not realizing how much info they are handing out to Google. Many just don’t care, and yet they will gladly complain about privacy on other matters.
Do you use browsers other than the mainstream ones like Chrome or Firefox? Third-party browsers, especially those that prioritize privacy or offer unique features, might be labeled “untrusted,” limiting your browsing experience.
This suggests that firefox will be trusted, because it’s mainstream, which is not true, because Mozilla won’t implement WEI, and therefore malicious websites won’t be able to verify “environment integrity”
Besides that, nice website and thanks for your efforts on fighting with WEI.
I’d also argue Firefox is hardly mainstream at ~3% usage. Edge would be a better replacement given it comes with every Windows install (and many corporate environments don’t allow using an alternative).
It is only used by 3%!? Wasn’t it at around 30% some years ago (not counting netscape)? This comes really as a surprise to me because in my circles even around half of non-tech inclined windows users use firefox.
Yes. But what kind of person needs to be told this stuff? The kind of person that already knows about WEI and that most mainstream browsers are chrome based except ff?
No. This message, then, isn’t for you and me, is it? Normal folks out there will hear that chrome is the issue and they’ll switch to edge. The suggestion, while not technically accurate, achieves the goal much more efficiently.
But isn’t it quite the jump from mozilla accepting drm from a service in an indistry that has invented drm to them accepting a blanket drm for the web? I think it’s kind of not guilty until proven for mozilla. They have so far (to my knowledge) not done anything very anti consumer.
They are going to fight against WEI. Tooth and nails, for our sakes!
Just like they did with EME, the closed source video DRM in 2014. By being deeply concerned with the direction the web is going, and definitely against it, but…
We face a choice between a feature our users want and the degree to which that feature can be built to embody user control and privacy.
With most competing browsers and the content industry embracing the W3C EME specification, Mozilla has little choice but to implement EME as well so our users can continue to access all content they want to enjoy.
Despite our dislike of DRM, we have come to believe Firefox needs to provide a mechanism for people to watch DRM-controlled content.
DRM requires closed systems to operate as currently required and is designed to remove user control, so Mozilla is taking steps to find alternative solutions to DRM. But Mozilla also believes that until an alternative system is in place, Firefox users should be able to choose whether to interact with DRM in order to watch streaming videos in the browser.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
Follow the programming.dev instance rules
Keep content related to programming in some way
If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos
I like this, but I would appreciate a definition of “the web environment” somewhere near the top.
Thank you for making an informative and non-alarmist website around the topic of Web Environment Integrity.
I’ve seen (and being downvoted for arguing against) so many articles, posts, and comments taking a sensationalized approach to the discussion around it, and it’s nice to finally see some genuine and wholly factual coverage of it.
I really can’t understate how much I appreciate your efforts towards ethical reporting here. You guys don’t use alarm words like “DRM,” and you went through the effort of actually explaining both what WEI does and how it poses a risk for the open web. Nothing clickybaity, ragebaity, and you don’t frame it dishonesty. Just a good, objective description of what it is in its current form and how that could be changed to everything people are worried about.
Is there anything that someone like me could help contribute with? It seems like our goals (informing users without inciting them, so they can create useful feedback without FUD and misinformation) align, and I’d love to help out any way I can. I read the (at the time incomplete) specs and explainer for WEI, and I could probably write a couple of paragraphs going over what they promised or omitted. If you check my post history, I also have a couple of my own example of how the WEI spec could be abused to harm users.
Genuine question, how do web integrity checks differ from DRM?
Unless something changed in the specification since I read it last, the attested environment payload only contains minimal information. The only information the browser is required to send about the environment is that: this browser is {{the browser ID}}, and it is not being used by a bot (e.g. headless Chrome) or automated process.
Depending on how pedantic people want to be about the definition of DRM, that makes it both DRM and not DRM. It’s DRM in the sense that it’s “technology to control access to copyrighted material” by blocking bots. But, it’s not DRM in the sense that it “enables copyright holders and content creators to manage what users can do with their content.”
It’s the latter definition that people colloquially know DRM as being. When they’re thinking about DRM and its user-hostility, they’re thinking about things like Denuvo, HDCP, always-online requirements, and soforth. Technologies that restrict how a user interacts with content after they download/buy it.
Calling web environment integrity “DRM” is at best being pedantic to a definition that the average person doesn’t use, and at worst, trying to alarm/incite/anger readers by describing it using an emotionally-charged term. As it stands right now, once someone is granted access to content gated behind web environment integrity, they’re free to use it however they want. I can load a website that enforces WEI and run an adblocker to my heart’s content, and it can’t do anything to stop that once it serves me the page. It can’t tell the browser to disable extensions, and it can’t enforce integrity of the DOM.
That’s not to say it’s harmless or can’t be turned into user-hostile DRM later, though. There’s a number of privacy, usability, ethical, and walled-garden-ecosystem concerns with it right now. If it ever gets to widespread implementation and use, they could later amend it to require sending an extra field that says “user has an adblocker installed”. With that knowledge, a website could refuse to serve me the page—and that would be restricing how I use the content in the sense that my options then become their way (with disabled extensions and/or an unmodified DOM) or the highway.
The whole concept of web environment integrity is still dubious and reeks of ulterior motives, but my belief is that calling it “DRM” undermines efforts to push back against it. If the whole point of its creation is to lead way to future DRM efforts (as the latter definition), having a crowd of people raising pitchforks over something they incorrectly claim it does it just gives proponents of WEI an excuse to say “the users don’t know what they’re talking about” and ignore our feedback as being mob mentality. Feedback pointing out current problems and properly articulating future concerns is a lot harder to sweep under the rug.
What a stupid argument. Google doesn’t give a fuck about feedback from anything but paying companies and shareholders, so we might as well enjoy our pitchforks.
In case anyone in the back didn’t hear
This garbage is DRM
Hi. Thanks a lot for your kind words and enthusiasm!
We are currently thinking about this “movement” and trying to plan stuff. If you have something on your mind, you are more than welcomed to create an issue.
I really appreciate your passion on this matter, and will kindly contact you after we structure stuff on our minds. Cheers!
I don’t know about web environment integrity or where this will lead but I remember the time trusted computing and TPMs came up. At this time, people were really scared that this is the end of Linux (on PC). Today, I use secure boot (with my MOK) on my consumer distro just fine.
Had Trusted Computing happened as it was originally envisioned, you wouldn’t be. You’d be using Windows because that’s the only operating system you’d be allowed to use.
And now here we are again, facing down a plot to extinguish FOSS competition under the guise of security. Yes, it’s happened before, but that doesn’t mean the outcome is guaranteed to be as favorable as it was last time.
We’re going to beat this thing. Then, we’re going to deal with it, all over again, in about a decade.
You have some duplicated paragraphs on the page, otherwise, appreciate the effort in raising awareness!
Can you please specify which ones do you mean?
Change the sentence “Do you use browsers other than the mainstream ones like Chrome or Firefox” because Firefox is already a very small third-party browser.
I would consider changing the sentence not because Firefox is not mainstream, but because Firefox is also at risk for not implementing WEI.
In the end many might consider Firefox mainstream - not in terms of its current user base that change every year - but because a large percentage of internet users recognize the Firefox name. But being mainstream or not - and what that means - is not that relevant here.
How is Firefox a small 3rd party browser? FF is the basis for browsers like libreoffice, icewolf etc… it is not 3rd party, it is first party like chrome, opera and safari. Actually if you want to go that far, chrome actually started off as a fork of opera
I understand what glad_cat means, and they are kinda correct. On the other hand, FF (at least, for now) won’t be implementing this change.
I do too, but his reasoning is flawed. Based on his reasoning that would be saying Lemmy is a third party site because it doesn’t have the user share that Reddit does.
Microsoft’s edge browser is a fork of chromium, it’s not even first party anymore, like IE was.
This is a nice analogy. Thanks 👍
You’re welcome
Firefox is used by less than 3% of the users, it should not be used in this sentence. Also I’m not sure they’ll implement the integrity thing, which is another issue.
Firefox had over 30% some time ago and it still is to spec, often more than chrome is.
I agree Firefox doesn’t have a large share of the browsers, but if you are basing it on user share then the only mainstream browsers are safari and chrome. However, the term third party is generally utilized as a fork of a primary access point or is the access point via another means, even if it’s original.
For example, the apps to access lemmy are third party as they are not created by the original devs for lemmy. In this argument FF is classified as first party not third.
Don’t get me wrong I understood what you were trying to say, but based on your reply then pretty much chrome would be the only mainstream browser.
And that’s exactly what Google wants. Everything already works best with Google Chrome, so what’s wrong a little more incentive to convert more users into using a telemetry-laden spyware browser?
very true, but if you remember correctly a similar thought process killed IE, and is now harming Edge on windows. The only draw back is everyone wants to use chrome, not realizing how much info they are handing out to Google. Many just don’t care, and yet they will gladly complain about privacy on other matters.
Exactly.
They won’t implement this, see this comment on github
Thanks for pointing out. Will definitely consider your feedback!
This suggests that firefox will be trusted, because it’s mainstream, which is not true, because Mozilla won’t implement WEI, and therefore malicious websites won’t be able to verify “environment integrity”
Besides that, nice website and thanks for your efforts on fighting with WEI.
I’d also argue Firefox is hardly mainstream at ~3% usage. Edge would be a better replacement given it comes with every Windows install (and many corporate environments don’t allow using an alternative).
It is only used by 3%!? Wasn’t it at around 30% some years ago (not counting netscape)? This comes really as a surprise to me because in my circles even around half of non-tech inclined windows users use firefox.
Why did it lose so many users?
google pr
edge is chrome
Yes. But what kind of person needs to be told this stuff? The kind of person that already knows about WEI and that most mainstream browsers are chrome based except ff?
No. This message, then, isn’t for you and me, is it? Normal folks out there will hear that chrome is the issue and they’ll switch to edge. The suggestion, while not technically accurate, achieves the goal much more efficiently.
I am not convinced Mozilla will refuse to implement WEI when push comes to shove. Mozilla already supports Netflix playback with drm, right?
But isn’t it quite the jump from mozilla accepting drm from a service in an indistry that has invented drm to them accepting a blanket drm for the web? I think it’s kind of not guilty until proven for mozilla. They have so far (to my knowledge) not done anything very anti consumer.
I’m just saying we can’t just trust Mozilla leadership will do the right thing…
Nah, I say we don’t run around villainizing everyone and stay with thos who fucked us over in the past. Otherwise we can trust exactly no one.
That’s exactly right. Don’t blindly trust anyone. Hold them accountable.
Take a look at this
I am glad to be proven wrong. Thank you for the link.
web is not movies and tv shows.
They are going to fight against WEI. Tooth and nails, for our sakes!
Just like they did with EME, the closed source video DRM in 2014. By being deeply concerned with the direction the web is going, and definitely against it, but…
https://blog.mozilla.org/en/mozilla/drm-and-the-challenge-of-serving-users/
https://hacks.mozilla.org/2014/05/reconciling-mozillas-mission-and-w3c-eme/