sabreW4K3 comments on Mozilla officially opposes Web Enviroment Integrity API (DRM for web pages proposal from Google)

Mozilla officially opposes Web Enviroment Integrity API (DRM for web pages proposal from Google) (github.com)

submitted 3 years ago by sabreW4K3@lemmy.tf to c/firefox@lemmy.ml

127 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] sabreW4K3@lemmy.tf [S] 92 points 3 years ago (22 children)

Sure thing. With this current proposal, when you visit a website, the site asks your browser if you're willing to display it as intended, basically with all and any adverts. If the answer is no, then you can't see the content, if the answer is yes, then you're likely using Chrome or a Chromium based browser and Google can guarantee more ad impressions, because they're first and foremost an advert selling company.

parent

hideshow 22 child comments

[–] donnachaidh@lemmy.world 35 points 3 years ago (5 children)

I may not be 100% right, as I haven't looked at it in detail, but I think it's even a bit more than that. Since the way that's proven is by the browser vendor signing the request (I assume with an HTTP header or something), you could also verify it's from a specific vendor. So even if Mozilla says, yes, we'll display your ads, a website could still lock down to Chrome. It would probably also significantly hamper new browsers, and browsers with a security/anti-ad focus, as they won't be recognised by major websites that use the new protocol until they have market share, which they won't get if they don't have access to major websites.

parent

hideshow 5 child comments

[+] bob_wiley@lemmy.world 29 points 3 years ago* (last edited 2 years ago) (2 children)

[deleted]

parent

hideshow 2 child comments

[–] donnachaidh@lemmy.world 21 points 3 years ago (1 child)

A) Maybe not you, maybe not me or anyone else here, but 99.99% of the rest of the world? And when the rest leave, is Mozilla really going to be able to justify maintaining a browser for those that remain? B) There might not be a website that would do it, but what about if practically all websites with any corporate backing did it?

parent

hideshow 1 child comment

[–] JubilantJaguar@lemmy.world 4 points 3 years ago

This is the fundamental point that so many techies fail to get. Saying "I'll be fine, I'll do X" is irrelevant. If nobody's doing what you want to do, then eventually you won't be able to do it either.

parent

[+] pennomi@lemmy.world 5 points 3 years ago* (last edited 2 months ago) (1 child)

[deleted]

parent

hideshow 1 child comment

[–] fuzzzerd@kbin.social 7 points 3 years ago

Which is why all browsers cross identify as other browsers. This would make it easier for sites to block and harder for browsers to work around.

parent

[–] WaffleFriends@lemmy.world 5 points 3 years ago

Thanks so much, I understand now. God, is that a shitty move for Google to pull

parent

[–] wanderingmagus@lemm.ee 4 points 3 years ago (1 child)

Why can't your browser lie and say "yes of course I'm displaying everything my fingers definitely aren't crossed behind my back"?

parent

hideshow 1 child comment

[–] DrQuint@lemmy.world 7 points 3 years ago

Because it's not just going to say yes. It's going to say yes, and then present an unique key that browser made for themselves. Other browsers might be able to spoof the key, but the proposal might have cryptographically expensive to even try.

parent

[–] disconnectikacio@lemmy.world 2 points 3 years ago (3 children)

What about replying yes, then blocking ads?

parent

hideshow 3 child comments

[–] sabreW4K3@lemmy.tf [S] 1 point 3 years ago (2 children)

Your device would return a signature to say that there's no adblocking software on the device.

parent

hideshow 2 child comments

[–] wanderingmagus@lemmy.world 2 points 3 years ago (1 child)

And that signature can't be spoofed? Or the browser can't be sandboxed and quarantined so it is made unaware of such software, and the software applied retroactively?

parent

hideshow 1 child comment

[–] sabreW4K3@lemmy.tf [S] 1 point 3 years ago

People will always find a workaround, look at rooting of phones for example. But they shouldn't have to. I mean look at how banking apps refuse to work on rooted phones but work in a browser on your desktop without any issues. It will be the same with this. Your device is rooted, we can't show you this webpage.

parent

[–] Whirlybird@aussie.zone 1 point 3 years ago* (8 children)

That’s not true - you can still use ad blockers etc as normal.

It’s also not a browser check, it’s a device check. It’s to check that the device can be trusted, like android itself hasn’t been tampered with.

parent

hideshow 8 child comments

[–] rainh@kbin.social 19 points 3 years ago* (2 children)

That's equally stupid though... why shouldn't I be able to tamper with my phone's operating system? And how is it any of a website's business if I do?

parent

hideshow 2 child comments

[+] Whirlybird@aussie.zone -6 points 3 years ago (1 child)

You can tamper all you want, but apps can already block access to devices that have been tampered with. This just gives that same power to websites.

parent

hideshow 1 child comment

[–] rainh@kbin.social 6 points 3 years ago

... yes, and I am obviously very against giving that same power to websites lol. An app is built from the ground up as a UX created by the company, and that is what you are signing up for when you use an app. A browser should be a contained way of rendering data from some webserver according to a user's preferences. Google is apparently trying to "app-ify" web protocols in order to give themselves more power over a user's experience to the detriment of the user.

parent

[–] conciselyverbose@kbin.social 14 points 3 years ago

It's literallly impossible for there to be a valid reason for a website to be entitled to know that under any circumstances.

parent

[–] DarkThoughts@kbin.social 7 points 3 years ago (2 children)

So people with custom roms or on various Linux distros would be fucked?

parent

hideshow 2 child comments

[–] Whirlybird@aussie.zone 0 points 3 years ago (1 child)

Well with custom roms they already are for many apps.

parent

hideshow 1 child comment

[–] DarkThoughts@kbin.social 1 point 3 years ago

True, but that's within their own ecosystem. The internet is not owned by Google. But I guess a certain part of the majority wants it that way with how popular Chromium based browsers are.

parent

[–] whatsarefoogee@lemmy.world -2 points 3 years ago

How could it not be a browser check if the website relies on the browser to be a middle man? The WebDRM that was pushed by a terrorist organization W3C, currently requires per-browser licensing.

Per wikipedia:

EME has been highly controversial because it places a necessarily proprietary, closed decryption component which requires per-browser licensing fees into what might otherwise be an entirely open and free software ecosystem.

parent