zlacker

[return to "Web Environment Integrity API Proposal"]
1. quenix+Wg[view] [source] 2023-07-21 19:26:32
>>reacto+(OP)
What's strange to me is that the main author of the spec -- Ben Wiser -- seems to be against closed, wall-garden paradigms as he has written in a blog post "I just spent £700 to have my own app on my iPhone" [1]. In the post, he laments the state of the App Store monopoly on iOS and ponders returning to Android for the app installation freedom.

How can he reconciliate these views with this spec, which he is the main author of? Surely Ben sees the parallels?

He writes: "Apple’s strategy with this is obvious, and it clearly works, but it still greatly upsets me that I couldn’t just build an app with my linux laptop. If I want the app to persist for longer than a month, and to make it easy for friends to install, I had to pay $99 for a developer account. Come on Apple, I know you want people to use the app story but this is just a little cruel. I basically have to pay $99 a year now just to keep using my little app."

It's honestly comical and a little sad.

[1]: http://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-o...

◧◩
2. jefftk+Ab1[view] [source] 2023-07-22 00:23:57
>>quenix+Wg
A good explanation of how he would reconcile his proposal and the ideas he's previously expressed: https://github.com/RupertBenWiser/Web-Environment-Integrity/...
◧◩◪
3. saagar+4l1[view] [source] 2023-07-22 02:04:06
>>jefftk+Ab1
This just seems like a generic “oh people might hate this proposal here’s a place where we mention this”, not a response to the question asked above.
◧◩◪◨
4. Thorre+ZK1[view] [source] 2023-07-22 07:09:09
>>saagar+4l1
Why isn't it a response to the question above asked? The question above seems to be saying that this API will be used to create walled gardens; the linked part of the design is about how to prevent the API from being used to create walled gardens.

Disclosure: I work at Google but not on this.

◧◩◪◨⬒
5. saagar+HW3[view] [source] 2023-07-23 04:07:57
>>Thorre+ZK1
It doesn’t have very concrete answers. It’s really more of a couple of ie thoughts, with an exhortation for people to provide ideas on how to fix this. For example:

> Attesters will be required to offer their service under the same conditions to any browser who wishes to use it and meets certain baseline requirements.

What prevents this set of baseline requirements from being e.g. “the device is backed by a TPM from these four vendors”?

> Although a holdback would prevent the attestation signal from being used for per-request enforcement decisions, there remains immense value for measurement in aggregate populations. However, a holdback also has significant drawbacks.

“So, like, here’s a vague idea on how we might prevent this. However this idea has significant problems.” Not a very convincing argument?

> If the community thinks it's important for the attestation to include the platform identity of the application

“If we assume that we can’t actually solve this…”

Basically there’s not much in the way of answers there. Generally when you put out proposals with a history of significant pushback I’d expect the likely feedback to be addressed in more depth than this.

(I guess since we’re doing disclaimers I also work at Google but not on this.)

[go to top]