Email or username:

Password:

Forgot your password?
jaseg

Since it seems has decided to uni-laterally force through their new anti- euphemistically named "Web environment integrity", I decided to add a little bit of code to my website that blanks out the page and displays a protest message with a link to the firefox download page when you visit it from a browser with this DRM feature. Here's the source inside one toot, feel free to copy and put it at the end of your website's <body> before the closing tag:

24 comments
jaseg

<script>if(navigator.getEnvironmentIntegrity!==undefined)document.querySelector('body').innerHTML='<h1>Your browser contains Google DRM</h1>"Web Environment Integrity" is a Google euphemism for a DRM that is designed to prevent ad-blocking. In support of an open web, this website does not function with this DRM. Please install a browser such as <a href="mozilla.org/en-US/firefox/new/">Firefox</a> that respects your freedom and supports ad blockers.';</script>

jaseg

I'm using the API from github.com/chromium/chromium/b here, if you know a better way to detect the presence of the feature, please go ahead and tell me :)

Borealis AKA the LiteralGrill

@jaseg Well now, I think I'll try adding this to my site! Excellent idea :D

Lucy
@jaseg I wonder if there's a way to do this server-side instead...? Like, does Chrome send a header or smth? Cuz I'm sure Chrome could ironically just start blocking scripts like that adblocker-style.
ashe

@jaseg checking for the property on `navigator` is pretty standard in terms of JS feature detection so we think this is about as good a solution as any

(unless/until they start obfuscating it)

Catherine Berry

@jaseg

Wait, has WEI actually been enabled in Chrome?? I thought this was at the proposal stage.

jaseg

@isomeme There was a post on the orange website today to a commit on the main chrome repo where they integrated it.

Emelia/Emi

@isomeme "Officially" it's still in the proposal stage, but it's already in released chrome versions behind an experiment flag. Personally? that suggests to me an attempt to shoehorn this past the W3C as "standardizing existing behavior" (that they created by sidestepping the W3C to begin with) and should result in not only additional scrutiny by the W3C (why did they implement something this drastic to a "release-worthy" state without consulting us first?) and by various government anti-trust bodies (google is blatantly flexing it's market dominance in an attempt to unduly influence a standards organization for it's benefit; the "safeguards" are pretty clearly tailored to work perfectly for adtech "verified views" and be nigh-incompatible with any other use)

@isomeme "Officially" it's still in the proposal stage, but it's already in released chrome versions behind an experiment flag. Personally? that suggests to me an attempt to shoehorn this past the W3C as "standardizing existing behavior" (that they created by sidestepping the W3C to begin with) and should result in not only additional scrutiny by the W3C (why did they implement something this drastic to a "release-worthy" state without consulting us first?) and by various government anti-trust bodies...

Emelia/Emi

@jaseg I would also consider petitioning the W3C to remove google as a member, because it's clear they're trying to "works best with IE6" the internet again, which goes against the fundamental goals of the W3C.

Not so much that they have prototype code already written (that's actually not unreasonable to demonstrate feasibility/behavior in some cases) but that they're 'proposing' this through the private github account of one of their employees, rather than as a formal "google" or W3C proposal, which means they likely intend to shoehorn it past as "standardizing existing behavior" once they've rolled out their "beta" to end-users regardless of what the W3C has to say about it.

IMO undermining the entire purpose of a standards organization that you are part of by attempting to sidestep it should be grounds for instant antitrust actions from various governments. We do not need another IE6 incident.

@jaseg I would also consider petitioning the W3C to remove google as a member, because it's clear they're trying to "works best with IE6" the internet again, which goes against the fundamental goals of the W3C.

Not so much that they have prototype code already written (that's actually not unreasonable to demonstrate feasibility/behavior in some cases) but that they're 'proposing' this through the private github account of one of their employees, rather than as a formal "google" or W3C proposal, which...

jaseg

@becomethewaifu I was never particularly impressed by the governance of the W3C and I personally don't think it provides the amount of democratic legitimacy that would be necessary for an organization of its kind. I would be surprised if as an organization they cared at all for your or my complaints.

Ariadne Conill ๐Ÿฐ

@becomethewaifu @jaseg

W3C is honestly one of the best examples I can think of when it comes to regulatory capture:

- Google dominates WHATWG, many things which only have relevance to their interests are pushed, such as Encrypted Media Extensions (aka DRM), various things which should not be happening in an untrusted security context like WebUSB, etc. This browser attestation thing is just the latest example of their misbehavior.

- Facebook now dominates SocialCG, and effectively has editorial control over ActivityPub (sorry @evan, but this is the reality: $$$ rules the day at W3C, and we have much less than Facebook).

- The whole Web Monetization debacle, which has lovely players like Coinbase and PayPal involved.

@becomethewaifu @jaseg

W3C is honestly one of the best examples I can think of when it comes to regulatory capture:

- Google dominates WHATWG, many things which only have relevance to their interests are pushed, such as Encrypted Media Extensions (aka DRM), various things which should not be happening in an untrusted security context like WebUSB, etc. This browser attestation thing is just the latest example of their misbehavior.

Robin Burchell

@ariadne less about W3C and more simply that those doing (or ultimately paying for those doing) the work will have the most impact, right?

I understand why that can be concerning, but I also donโ€™t really see how itโ€™s at all avoidable, short of just not cooperating with big $, but that just means youโ€™ll end up with multiple competing specs, which isnโ€™t really an attractive proposition either

Ariadne Conill ๐Ÿฐ

@rburchell sure, it's not specific at all to W3C, but rather the observation that expecting a trade organization (which is effectively what the W3C has become) to be focused on what the community wants is silly.

Robin Burchell

@ariadne ah right, that I can completely agree with

Pierre Bourdon

@ariadne

> things which only have relevance to their interests are pushed, such as Encrypted Media Extensions

Does Google even run anything that uses EME? YouTube doesn't... maybe Play Movies? But that's very fringe (and probably happened *after* EME was standard).

The only way your argument makes sense is if "their interests" is "having more stuff be accessible on the web". But uh, that sounds like a good alignment for people developing new web standards?

Pierre Bourdon

@ariadne (if anything I'd say EME is a good example of Google pushing other companies' primary interests - Netflix, Hulu, etc. who want to provide DRM-ed content on the web - because it helps Google's more indirect interests of getting more people using the web, because that's more ads money. I suspect that happens more often than not.)

Geo

@jaseg Since I still know little about the web, I checked your website right away to see if my browser uses this DRM feature. It doesn't, I see everything fine. But I also use Firefox, so I shouldn't have been surprised.
Can you estimate which Browsers are or may be affected? I assume would be. Do you think Microsoft Edge would also adopt this DRM feature?

Uilebheist ๐Ÿณ๏ธโ€๐ŸŒˆ

@jaseg Some of my pages have a tiny bit of javascript which replace everything in the page with just "For security reasons please disable javascript".
Might change that with something to detect chrome only.

Go Up