Aw. I was going to post the link to his video, but you beat me to it.
But yeah, Technology Connections makes some excellent and informative videos. To anyone else who sees this: If heat pumps, refrigeration, or climate control technology aren't your cup of tea, he also covers older technology based around electromechanical designs (as in, pre-dating microcontrollers and programmable logic) and analog media recording devices.
Adding another issue to the pile:
Even if it isn't the intent of the spec, it's dangerous to allow for websites to differentiate between unverified browsers, browsers attested to by party A, and browser attested to by party B. Providing a mechanism for cryptographic verification opens the door for specific browsers to be enforced for websites.
For a corporate example:
Suppose we have ExampleTechFirm, a huge investor in a private AI company, ShutAI. ExampleTechFirm happens to also make a web browser, Sledge. ExampleTechFirm could exert influence on ShutAI so that ShutAI adds rate limiting to all browsers that aren't verified with ShutAI as the attester. Now, anyone who isn't using Sledge is being given a degraded experience. Because attesting uses cryptographic signatures, you can't bypass this user-hostile quality of service mechanism; you have to install Sledge.
For a political example:
Consider that I'm General Aladeen, the leader of the country Wadiya. I want to spy on my citizens and know what all of them are doing on their computers. I don't want to start a revolt by making it illegal to own a computer without my spyware EyeOfAladeen, nor do I have the resources to do that.
Instead, I enact a law that makes it illegal for companies to operate in Wadiya unless their web services refuse access to Wadiyan citizens that aren't using a browser attested to by the "free, non-profit" Wadiyan Web Agency. Next, I have my scientists create and release a renamed versions of Chromium and Firefox with EyeOfAladeen bundled in them. Those are the only two browsers that are attested by the Wadiyan Web Agency.
Now, all my citizens are being encouraged to unknowingly install spyware. Goal achieved!
I have a 7950X, a pile of RAM, and an unfairly expensive RTX 4000-series GPU. The cursor occasionally hitches for ~400ms whenever doing things like opening task manager or resuming from the lock screen, so that checks out unfortunately.
And here's a concern about the decentralized-but-still-centralized nature of attesters:
From my understanding, attesting is conceptually similar to how the SSL/TLS infrastructure currently works:
Each ultimately-trusted attester has their own key pair (e.g. root certificate) for signing.
Some non-profit group or corporation collects all the public keys of these attesters and bundles them together.
The requesting party (web browser for TLS, web server for WEI) checks the signature sent by the other party against public keys in the requesting party's bundle. If it matches one of them, the other party is trusted. If it doesn't, they are not not trusted.
This works for TLS because we have a ton of root certificates, intermediate certificates, and signing authorities. If CA Foo is prejudice against you or your domain name, you can always go to another of the hundreds of CAs.
For WEI, there isn't such an infrastructure in place. It's likely that we'll have these attesters to start with:
But hey, maybe we'll have some intermediate attesters as well:
Even with that list, though, it doesn't bode well for FOSS software. Who's going to attest to various browser forks, or for browsers running on different operating systems that aren't backed by corporations?
Furthermore, if this is meant to verify the integrity of browser environments, what is that going to mean for devices that don't support Secure Boot? Will they be considered unverified because the OS can't ensure it wasn't tampered with by the bootloader?
Thank you for making an informative and non-alarmist website around the topic of Web Environment Integrity.
I've seen (and being downvoted for arguing against) so many articles, posts, and comments taking a sensationalized approach to the discussion around it, and it's nice to finally see some genuine and wholly factual coverage of it.
I really can't understate how much I appreciate your efforts towards ethical reporting here. You guys don't use alarm words like "DRM," and you went through the effort of actually explaining both what WEI does and how it poses a risk for the open web. Nothing clickybaity, ragebaity, and you don't frame it dishonesty. Just a good, objective description of what it is in its current form and how that could be changed to everything people are worried about.
Is there anything that someone like me could help contribute with? It seems like our goals (informing users without inciting them, so they can create useful feedback without FUD and misinformation) align, and I'd love to help out any way I can. I read the (at the time incomplete) specs and explainer for WEI, and I could probably write a couple of paragraphs going over what they promised or omitted. If you check my post history, I also have a couple of my own example of how the WEI spec could be abused to harm users.
Good article. Not clickbait/ragebait, and it explains the specification simply and succinctly, while also demonstrating why it's dangerous for the open web.
I hope you were being sarcastic, because, ideally, nobody implements this.
I glossed through some of the specifications, and it appears to be voluntary. In a way, it's similar to signing git commits: you create an image and chose to give provenance to (sign) it. If someone else edits the image, they can choose to keep the record going by signing the change with their identity. Different images can also be combined, and that would be noted down and signed as well.
So, suppose I see some image that claims to be an advertisement for "the world's cheapest car", a literal rectangle of sheet metal and wooden wheels. I could then inspect the image to try and figure out if that's a legitimate product by BestCars Ltd, or if someone was trolling/memeing. It turns out that the image was signed by LegitimateAdCompany, Inc and combined signed assets from BestCars, Ltd and StockPhotos, LLC. Seeing that all of those are legitimate businesses, the chain of provenance isn't broken, and BestCars being known to work with LegitimateAdCompany, I can be fairly confident that it's not a meme photo.
Now, with that being said...
It doesn't preclude scummy camera or phone manufacturers from generating identities unique their customers and/or hardware and signing photos without the user's consent. Thankfully, at least, it seems like you can just strip away all the provenance data by copy-pasting the raw pixel data into a new image using a program that doesn't support it (Paint?).
All bets are off if you publish or upload the photo first, though—a perceptual hash lookup could just link the image back to original one that does contain provenance data.
But the real questions is, can we change them?
Imagine this:
A couple years back, I had some fun proof-of-concepting the terrible UX of preventing password managers or pasting passwords.
It can get so much worse than just an alert() when right-clicking.
A small note: It doesn't work with mobile virtual keyboards, since they don't send keystrokes. Maybe that's a bug, or maybe it's a security feature ;)
But yeah, best tried with a laptop or desktop computer.
How it detects password managers:
Unexpected CSS or DOM changes to the input element, such as an icon overlay for LastPass.
Paste event listening.
Right clicking.
Detecting if more than one character is inserted or deleted at a time.
In hindsight, it could be even worse by using Object.defineProperty to check if the value property is manipulated or if setAttribute is called with the value attribute.
Had to give up at rule 20 because I was using a phone.
::: spoiler Spoiler
As much fun pain as that was, highlighting with a touch screen is nowhere near fast enough to put out the fire.
:::
Would love to see a speedrun leaderboard for this, though.
Back when I was in school, we had typing classes. I'm not sure if that's because I'm younger than you and they assumed we has basic computer literacy, or older than you and they assumed we couldn't type at all. In either case, we used Macs.
It wasn't until university that we even had an option to use Linux on school computers, and that's only because they have a big CS program. They're also heavily locked-down Ubuntu instances that re-image the drive on boot, so it's not like we could tinker much or learn how to install anything.
Unfortunately—at least in North America—you really have to go out of your way to learn how to do things in Linux. That's just something most people don't have the time for, and there's not much incentive driving people to switch.
A small side note: I'm pretty thankful for Valve and the Steam Deck. I feel like it's been doing a pretty good job teaching people how to approach Linux.
By going for a polished console-like experience with game mode by default, people are shown that Linux isn't a big, scary mish-mash of terminal windows and obscure FOSS programs without a consistent design language. And by also making it possible to enter a desktop environment and plug in a keyboard and mouse, people can* explore a more conventional Linux graphical environment if they're comfortable trying that.
Firefox will probably survive if they bow and add WEI support.
I can't imagine Google, Microsoft, and Apple opening themselves up to further monopolization scrutiny by trying to keep attestation restricted to their own browsers on their own operating systems.
Self-built or community forks are probably screwed, though.
From what I can tell, that's basically what this is trying to do. Some company can sign a source image, then other companies can sign the changes made to the image. You can see that the image was created by so-and-so and then manipulated by so-and-other-so, and if you trust them both, you can trust the authenticity of the image.
It's basically git commit signing for images, but with the exclusionary characteristics of certificate signing (for their proposed trust model, at least. It could be used more like PGP, too).
Oh cool, there's a 200mp camera. Something that only pro photographers care about lol.
Oh this is a fun one! Trained, professional photographers generally don't care either, since more megapixels aren't guaranteed to make better photos.
Consider two sensors that take up the same physical space and capture light with the same efficiency/ability, but are 10 vs 40 megapixels. (Note: Realistically, a higher density would mean design trade-offs and more generous manufacturing tolerances.)
From a physics perspective, the higher megapixel sensor will collect the same amount of light spread over a more dense area. This means that the resolution of the captured light will be higher, but each single pixel will get less overall light.
So imagine we have 40 photons of light:
More Pixels Less Pixels
----------- -----------
1 2 1 5
2 6 2 3 11 11
1 9 0 1 15 3
4 1 1 1
When you zoom in to the individual pixels, the higher-resolution sensor will appear more noisy. This can be mitigated by pixel binning, which groups (or "bins") those physical pixels into larger, virtual ones—essentially mimicking the lower-resolution sensor. Software can get crafty and try to use some more tricks to de-noise it without ruining the sharpness, though. Or if you could sit completely still for a few seconds, you could significantly lower the ISO and get a better average for each pixel.
Strictly from a physics perspective (and assuming the sensors are the same overall quality), higher megapixel sensors are better simply because you can capture more detail and end up with similar quality when you scale the picture down to whatever you're comparing it against. More detail never hurts.
... Except when it does. Unless you save your photos as RAW (which take a massice amount of space), they're going to be compressed into a lossy image format like JPEG. And the lovely thing about JPEG, is that it takes advantage of human vision to strip away visual information that we generally wouldn't perceive, like slight color changes and high frequency details (like noise!)
And you can probably see where this is going: the way that the photo is encoded and stored destroys data that would have otherwise ensured you could eventually create a comparable (or better) photo. Luckily, though, the image is pre-processed by the camera software before encoding it as a JPEG, applying some of those quality-improving tricks before the data is lost. That leaves you at the mercy of the manufacturer's software, however.
In summary: more megapixels is better in theory. In practice, bad software and image compression negate the advantages that a higher resolution provides, and higher-density sensors likely mean lower-quality data. Also, don't expect more megapixels to mean better zoom. You would need an actual lense for that.
Did the formal education before the job ruin it for you, or did the job itself ruin it?
You say that like it hasn't been happening already for two decades.
https://www.cnet.com/news/privacy/fbi-taps-cell-phone-mic-as-eavesdropping-tool/
I can't read French so I only have others' translations and intepretations to rely on, but from what I understand, the differences here are that,
France lawmakers are being direct with their legislation, rather than relying on precedence or judges' interpretations of anti-terrorism or national security bills; and
Privileged conversations (e.g. between client and attorney) can still be admissible when recorded surreptitiously this way.
Apparently it would still need to be pre-approved by a judge. That doesn't inspire much confidence in it not being hand-wave allowed, though.
Would absolutely love for Serif Labs to create a port for Affinity Photo and Designer. Of the programs I've tried, those two have the closest UX to Photoshop and Illustrator without the software-as-a-service model.
Hell, I'd even take it if all they did was support it working under WINE. While I would prefer a seamless UI that fits in with both GTK and Qt, it's understandable that they might not consider it worth the effort.
Unless something changed in the specification since I read it last, the attested environment payload only contains minimal information. The only information the browser is required to send about the environment is that: this browser is {{the browser ID}}, and it is not being used by a bot (e.g. headless Chrome) or automated process.
Depending on how pedantic people want to be about the definition of DRM, that makes it both DRM and not DRM. It's DRM in the sense that it's "technology to control access to copyrighted material" by blocking bots. But, it's not DRM in the sense that it "enables copyright holders and content creators to manage what users can do with their content."
It's the latter definition that people colloquially know DRM as being. When they're thinking about DRM and its user-hostility, they're thinking about things like Denuvo, HDCP, always-online requirements, and soforth. Technologies that restrict how a user interacts with content after they download/buy it.
Calling web environment integrity "DRM" is at best being pedantic to a definition that the average person doesn't use, and at worst, trying to alarm/incite/anger readers by describing it using an emotionally-charged term. As it stands right now, once someone is granted access to content gated behind web environment integrity, they're free to use it however they want. I can load a website that enforces WEI and run an adblocker to my heart's content, and it can't do anything to stop that once it serves me the page. It can't tell the browser to disable extensions, and it can't enforce integrity of the DOM.
That's not to say it's harmless or can't be turned into user-hostile DRM later, though. There's a number of privacy, usability, ethical, and walled-garden-ecosystem concerns with it right now. If it ever gets to widespread implementation and use, they could later amend it to require sending an extra field that says "user has an adblocker installed". With that knowledge, a website could refuse to serve me the page—and that would be restricing how I use the content in the sense that my options then become their way (with disabled extensions and/or an unmodified DOM) or the highway.
The whole concept of web environment integrity is still dubious and reeks of ulterior motives, but my belief is that calling it "DRM" undermines efforts to push back against it. If the whole point of its creation is to lead way to future DRM efforts (as the latter definition), having a crowd of people raising pitchforks over something they incorrectly claim it does it just gives proponents of WEI an excuse to say "the users don't know what they're talking about" and ignore our feedback as being mob mentality. Feedback pointing out current problems and properly articulating future concerns is a lot harder to sweep under the rug.
I'm not a lawyer, nor do I have the full context of the legislation you're quoting, but my interpretation of that paragraph is that it only applies to aircrafts that are carrying passengers.
. . . in the air space in possession of another, by a person who is traveling in an aircraft, is privileged . . .
You're the one who does this for a hobby, though. I'm sure that you know the laws more than I do :)
In other posts, I've tried to point out how some of the articles and comments around WEI are more speculative than factual and received downvotes and accusations of boot-licking for it. Welcome to the club, I guess.
The speculation isn't baseless, but I'm concerned about the lack of accurate information about WEI in its current form. If the majority of people believe WEI is immediately capable of enforcing web page integrity, share that incorrect fact around, and incite others, it's going to create a very good excuse for dismissing all dissenting feedback of WEI as FUD. The first post linking to the GitHub repository brought in so many pissed off/uninformed people that the authors of the proposal actually locked the repo issues, preventing anyone else from voicing their concerns or providing examples of how implementing the specification could have unintended or negative consequences.
Furthermore, by highlighting the DRM and anti-adblock aspect of WEI, it's failing to give proper attention to many of the other valid concerns like:
I very well could be wrong, but I think our (the public) opinions would have held more weight if they were presented in a rational, informed, and objective manner. Talking to software engineers as people generally goes down better than treating them like emotionless cogs in the corporate machine, you know?
It's a "feature," in fact...
Under What to expect on this support page, it says:
The phone branding, network configuration, carrier features, and system apps will be different based on the SIM card you insert or the carrier linked to the eSIM.
The new carrier's settings menus will be applied.
The previous carrier's apps will be disabled.
The correct approach from a UX perspective would have been to display an out-of-box experience wizard that gives the user an option to either use the recommended defaults, or customize what gets installed.
Unfortunately, many manufacturers don't do that, and just install the apps unconditionally and with system-level permissions. And even if they did, it's likely that many of the carrier apps will either have a manifest value that requires them to be installed, be unlabeled (e.g. com.example.carrier.msm.mdm.MDM), or misleadingly named to appear essential (e.g. "Mobile Services Manager").
I bought an unlocked phone directly from the manufacturer and still didn't get the choice.
Inserting a SIM card wiped the phone and provisioned it, installing all sorts of carrier-provided apps with system-level permissions.
As far as I've found, there's a few possible solutions:
Unlock the bootloader and install a custom ROM that doesn't automatically install carrier-provided apps. (Warning: This will blow the E-fuse on Samsung devices, disabling biometrics and other features provided by their proprietary HSM).
Manually disable the apps after they're forcibly installed for you. Install adb on a computer and use pm disable-user --user 0 the.app.package on every app you don't want. If your OEM ROM is particularly scummy, it might go out of its way to periodically re-enable some of them, though.
Find a SIM card for a carrier that doesn't install any apps, then insert that into a fresh phone and hope that the phone doesn't adopt the new carrier's apps (or wipe the phone) when you insert your actual SIM.
Can't have a runtime error if you don't have a compiled binary *taps forehead*
(For the record, I say this as someone who enjoys Rust)
Yep! I ended up doing my entire co-op with them, and it meshed really well with my interest in creating developer-focused tooling and automation.
Unfortunately I didn't have the time to make the necessary changes and get approval from legal to open-source it, but I spent a good few months creating a tool for validating constraints for deployments on a Kubernetes cluster. It basically lets the operations team specify rules to check deployments for footguns that affect the cluster health, and then can be run by the dev-ops teams locally or as a Kubernetes operator (a daemon service running on the cluster) that will spam a Slack channel if a team deploys something super dangerous.
The neat part was that the constraint checking logic was extremely powerful, completely customizable, versioned, and used a declarative policy language instead of a scripting language. None of the rules were hard-coded into the binary, and teams could even write their own rules to help them avoid past deployment issues. It handled iterating over arbitrary-sized lists, and even could access values across different files in the deployment to check complex constraints like some value in one manifest didn't exceed a value declared in some other manifest.
I'm not sure if a new tool has come along to fill the niche that mine did, but at the time, the others all had their own issues that failed to meet the needs I was trying to satisfy (e.g. hard-coded, used JavaScript, couldn't handle loops, couldn't check across file boundaries, etc.).
It's probably one of the tools I'm most proud of, honestly. I just wish I wrote the code better. Did not have much experience with Go at the time, and I really could have done a better job structuring the packages to have fewer layers of nested dependencies.
"Impede the replacement of" and "compatible battery" has a lot of room for interpretation. I hope they're defined explicitly somewhere, or else we're going to find implementations that effectively restrict non-OEM batteries while still adhering to the letter of the law.
For example, all batteries lacking a cryptographically-verified "certification" handshake could have safety restrictions such as:
Limited maximum amperage draw, achieved by under-clocking the SoC and sleeping performance cores.
Lower thermal limits while charging the device, meaning fast charging may be limited or preemptively disabled to ensure that the battery does not exceed an upper threshold of you-might-want-to-put-it-in-the-fridge degrees.
Disabling wireless charging capabilities, just in case magnetic induction affects the uncertified battery full of unknown and officially-untested components.
A pop-up warning the user every time the device is plugged into or unplugged from a charger.
All of that would technically meet the condition insofar that it's neither impeding the physical replacement nor rendering the device inoperable, but it would still effectively make the phone useless unless you pay for a (possibly-overpriced) OEM part.
If they explicitly defined "Impede the replacement of" as "prevent replacement of or significantly alter user experience as a result of replacing," and "compatible battery" as "electrically-compatible battery" all those cases would be covered.
Might be a bit of cynical take, but I don't have too much faith in the spirit of the law being adhered to when profits are part of the equation.
Ah, that's fair.
I'm having the opposite experience, unfortunately. I loved working at {co-op company} where I had a choice of developer environment (OS, IDE, and the permissions to freely install whatever software was needed without asking IT) and used Golang for most tasks.
The formal education has been nothing but stress and anxiety, though. Especially exams.
Anecdotally, I can confirm otherwise. I bought an unlocked Galaxy phone directly from Samsung, and putting in a SIM card provisioned it for my cell provider and installed their apps.
Thankfully, I'm not on a provider that pushes adware.
With regard to my examples, WEI provides full confidence and stability in identifying the browser.
Relying on detecting browsers by differentiating between their features and quirks involves on having a large suite of checks to run, some of which might become incorrect as browsers change over time. It's a maintenance burden, to say the least.
It's possible that Google doesn't, although that would be weird since the ability to push apps is probably standardized and baked into the stock Android OS source code.
Or maybe you just used MVNOs that don't purposefully install anything that isn't strictly necessary.
Android OS developers or software devs working for cell providers would probably know the answer, though.
If that were the case, wouldn't the mouse jump when the latest frame is presented? For me, it's more that it just stays still until after Windows stops having a fuss.
I went to one of their concerts, and their lead singer, David Draiman, was one of the most wholesome and honest guys I've ever seen. Funny headline, but I hope he recovers quickly and without any long-term effects.