search

explainers-by-googlers / Web-Environment-Integrity

538 stars 100 forks source link

Do not listen to ad blocking addicts, please ship this ASAP #51

Open zb3 opened 1 year ago

zb3 commented 1 year ago

Ad blocking virus is currently spreading and we all know it makes people unhappy, because people need to watch at least 250 ads per day to be happy. Ad blockers interfere with this and it's not hard to see their detrimental effects on mental health.

Ads make people SO HAPPY, they literally LOVE THEM, but unfortunately that horrible ad blocking addiction prevents those people from watching them. We all know that's a disaster which needs to be addressed immmediately.

In order to break free from the ad blocking addiction, users need help and that help should be provided by their devices. Fortunately, mobile devices are well-built for this purpose - their locked bootloader, TrustZone, Android/iOS system design, SafetyNet are the technologies that give us all the hope we need.

But even on mobile devices, currently the addiction still finds a way - it forces victims to install alternative browsers such as Firefox (shame on you) which even promote (!) the worst extension ever made - uBlock Origin (criminal).

While content providers and advertising platforms all have good intentions, currently the Web plaform lacks a critical API that would make it possible to reliably verify whether the user runs in an environment that's sufficiently protected against all the evil that ad blocking is AND from any attempt to extract the website code in order to attack the protection mechanism.

This API is EXACTLY the thing we all need. Thanks to this we can serve the real website code only after authenticating the platform. This way the code would be fully shielded from any kind of reverse engineering which could result in this horrible ad blocking virus again finding a way to prevent the user from experiencing true happiness.

Be aware though, my friends, that there's one more thing we need to tackle - web debugging. Website authors MUST have the ability to disable debugging, otherwise the environment is not fully free from ad blocking influence.

So:

  1. Ship this ASAP
  2. Remove Chrome remote debugging on Android

Maybe just disable attaching a remote debugger if the attestation API was used?

bleonard252 commented 1 year ago

Shhh don't give them ideas

kddlb commented 1 year ago

I think Poe's Law applies here.

zb3 commented 1 year ago

@yoavweiss before you close this, note the "remote debugging" point gives you an opportunity to clarify the intent of this proposal by addressing it

kkarhan commented 1 year ago

@zb3 Yeah this is peak shitposting...

fabioromeo commented 1 year ago

I'll bet 10 cents that this was written by a Google employee.

Lana-chan commented 1 year ago

i like how this one hasn't been closed yet

AshtonKem commented 1 year ago

I'll bet 10 cents that this was written by a Google employee.

I think Poe's law got you.