Re:Fighting for the Open Web [image]
by foota on Sunday July 30, 2023 @04:30AM
(#36929107)
I think the main issue is the concern over whether you can access other resources on the web. E.g., windows doesn't allow websites to refuse service to you based on, say, your physical address; but the web integrity (WEI) proposal might allow a website to refuse service to your new custom browser because it can't implement WEI.
Imagine instead that chrome refuses to start if WEI can't be guaranteed (but otherwise it doesn't do anything). Is it annoying and dumb? Sure, but it doesn't limit how you can connect to the internet.
I mentioned here (https://news.ycombinator.com/item?id=36886572) that I think a better aligned proposal might be to introduce some system for pluggable 3rd party attestations that could be used by websites to verify the that the user is in some sense real. I imagine a lot of people would still object to this, but to me it would remove a lot of the concerns about the open web, since anyone would be able to build a browser integrating with the attestation services (I imagine some sort of service like LetsEncrypt would exist for this, although it's not clear what websites would settle on as being trusted attesters, if it's only a small set of companies then there's still some issues I think).
This whole debate has been interesting to me, since in some sense even with WEI the web is still a thing, it's just that it would be sent back to the 90s. E.g., any website would still be able to allow you to visit without WEI, but large swaths of the internet as used today might be unavailable without it.
Imagine instead that chrome refuses to start if WEI can't be guaranteed (but otherwise it doesn't do anything). Is it annoying and dumb? Sure, but it doesn't limit how you can connect to the internet.
I mentioned here (https://news.ycombinator.com/item?id=36886572) that I think a better aligned proposal might be to introduce some system for pluggable 3rd party attestations that could be used by websites to verify the that the user is in some sense real. I imagine a lot of people would still object to this, but to me it would remove a lot of the concerns about the open web, since anyone would be able to build a browser integrating with the attestation services (I imagine some sort of service like LetsEncrypt would exist for this, although it's not clear what websites would settle on as being trusted attesters, if it's only a small set of companies then there's still some issues I think).
This whole debate has been interesting to me, since in some sense even with WEI the web is still a thing, it's just that it would be sent back to the 90s. E.g., any website would still be able to allow you to visit without WEI, but large swaths of the internet as used today might be unavailable without it.