My favorite part is when they ask you to give them the benefit of the doubt, but also anyone who disagrees with them in a way that doesn't fit their expectations is "noise."

Wow, that blog post is truly nauseating and infuriating to read, knowing the context.

Fuck Google. They're the Nestlé of tech.

[Don't assume consensus nor finished state]

Often a proposal is just that - someone trying to solve a problem by proposing technical means to address it. Having a proposal sent out to public forums doesn't necessarily imply that the sender's employer is determined on pushing that proposal as is.

It also doesn't mean that the proposal is "done" and the proposal authors won't appreciate constructive suggestions for improvement.

[Be the signal, not the noise]

In cases where controversial browser proposals (or lack of adoption for features folks want, which is a related, but different, subject), it's not uncommon to see issues with dozens or even hundreds of comments from presumably well-intentioned folks, trying to influence the team working on the feature to change their minds.

In the many years I've been working on the web platform, I've yet to see this work. Not even once.

.....?
What is this, "Good vibes only?"

@TheYang Exactly! Came here to say this. Everybody actively using chromium based browsers is a part of the problem.

Firefox depends on google for funding though. Google could probably deal a killing blow quite easily.

I've never donated to Mozilla before, but will now.

you need a Microsoft signed stub to boot anything other than Windows on a PC

Not necessarily, most motherboards and laptops (at least every single one I've ever owned) allow users to enroll their own Secure Boot keys and maintain an entirely non-Microsoft chain of trust. You can also disable secure boot entirely.

Major distros like Ubuntu and Fedora started shipping with Microsoft-signed boot shims as a matter of convenience, not necessity.

Secure Boot itself is not some nefarious mechanism, it is a component of the open UEFI standard. Where Microsoft comes in to play is the fact that most PC vendors are going to pre-enroll Microsoft keys because they are all shipping computers with Windows, and Microsoft wants Secure Boot enabled by default on machines shipping with with their operating system.

I started looking at Mac's for my next computer. Due to this amazing project. https://asahilinux.org/

you need a Microsoft signed stub to boot anything other than Windows on a PC

False. Every PC I've had has allowed Secure Boot to be turned off, and some of them allow me to add another trusted certificate as well.

you need Apple’s blessing to boot anything on a Mac

False. The Mac boot process is completely unlocked, at least on Intel Macs.

your smartphone manufacturer decides whether you can unlock it and lose attestation

My Pixel 6 allows me to unlock the boot loader at any time.

Attestation exists, unfortunately, but it's not nearly as pervasive as you seem to think.

This is the next logical step, to add “web app” attestation, since the previous ones had barely any pushback

Uh, there was huge pushback. That's why even a Microsoft Surface won't stop you from installing Linux.

Please drink verification can

Or they just ban you without recourse and poof all your data and accounts are dead.

Edit: consider using Google Takeout to download your data periodically as a hedge against trouble with your account. This will help prevent data loss in the event your account suddenly goes poof. It won't help you with the apps you bought though.

Or have some letters removed all together.

Pretty much the entire US needs a healthy dose of monopoly busting.

Hell, just look at the Ma Bell breakup and the path all of those companies took to where they are now. We're basically back to step 1.

Yeah, as if github aka Microsoft is going to do anything about it ... but hey, anything to keep the pressure up and not letting this go through.

My ELI5 version:

Basically, the 'Web Environment Integrity' proposal is a new technique that verifies whether a visitor of a website is actually a human or a bot.

Currently, there are captchas where you need to select all the crosswalks, cars, bicycles, etc. which checks whether you're a bot, but this can sometimes be bypassed by the bots themselves.

This new 'Web Environment Integrity' thing goes as follows:

1. You visit a website
2. Website wants to know whether you're a human or a bot.
3. Your browser (or the 'client') will send request an 'environment attestation' from an 'attester'. This means that your browser (such as Firefox or Chrome) will request approval from some third-party (like Google or something) and the third-party (which is referred to as 'attester') will send your browser a message, which basically says 'This user is a bot' or 'This user is a human being'.
4. Your browser receives this message and will then send it to the website, together with the 'attester public key'. The 'attester public key' can be used by the website to verify whether the attester (a.k.a. the third-party checking whether you're a human or not) is trustworthy and will then check whether the attester says that you're a human or not.

I hope this clears things up and if I misinterpreted the GitHub explainer, please correct me.

The reason people (rightfully) worry about this, is because it gives attesters A LOT of power. If Google decides they don't like you, they won't tell the website that you're a human. Or maybe, if Google doesn't like the website you're trying to visit, they won't even cooperate with attesting. Lots of things can go wrong here.

Here you go