Software

Brave takes brave stand against Google's plan to turn websites into ad-blocker-thwarting Web Bundles

Draft spec reduces pages to inscrutable data blobs, says privacy bod


A proposed Google web specification threatens to turn websites into inscrutable digital blobs that resist content blocking and code scrutiny, according to Peter Snyder, senior privacy researcher at Brave Software.

On Tuesday, Snyder published a memo warning that Web Bundles threaten user agency and web code observability. He raised this issue back in February, noting that Web Bundles would prevent ad blockers from blocking unwanted subresources. He said at the time he was trying to work with the spec's authors to address concerns but evidently not much progress has been made.

His company makes the Brave web browser, which is based on Google's open-source Chromium project though implements privacy protections, by addition or omission, not available in Google's commercial incarnation of Chromium, known as Chrome.

Google's second stab at preserving both privacy and ad revenue draws fire

READ MORE

The Register asked Google to comment. Its spokespeople did not respond.

The Web Bundles API is a Google-backed web specification for bundling the multitude of files that make up a website into a single .wbn file, which can then be shared or delivered from a content delivery network node rather than a more distant server. It's one of several related specifications for packaging websites.

The problem, as Snyder sees it, is that Web Bundles takes away the very essence of the web, the URL.

"At root, what makes the web different, more open, more user-centric than other application systems, is the URL," he wrote. "Because URLs (generally) point to one thing, researchers and activists can measure, analyze and reason about those URLs in advance; other users can then use this information to make decisions about whether, and in what way, they’d like to load the thing the URL points to."

An individual concerned about security or privacy, for example, can examine a JavaScript file associated with a particular URL and take action if it looks abusive.

That becomes difficult when the file isn't easily teased out of a larger whole. Web Bundles set up private namespaces for URLs, so privacy tools that rely on URLs don't work.

"The concern is that by making URLs not meaningful, like just these arbitrary indexes into a package, the websites will become things like .SWF files or PDF files, just a big blob that you can't reason about independently, and it'll become an all or nothing deal," Snyder explained in a phone interview with The Register.

Omnibox orders

Separately, Google has been working to hide full URLs in the Chrome omnibox.

Snyder concedes that some of the goals these tools aim to realize may be valuable, like assertions of resource integrity through signatures, but he objects to means being applied to get there.

"I think that some of the ends of these tools are shooting for are valuable," he said. "I think the way that they're shooting for them is not valuable and has a kind of insidious side effect of allowing other things that are user hostile."

Snyder is not alone in his doubts about the spec. Apple WebKit engineer John Wilander filed two issues arguing that ad tech companies could use website packaging to bypass user privacy decisions.

And Maciej Stachowiak, a software engineer who leads the development of Apple's WebKit, also voiced opposition to Web Bundles.

Despite Google's disinterest in responding officially, various Google engineers challenged Snyder's claims and defended the technology on Twitter.

Alex Russell, senior staff software engineer at Google, contends that Snyder has misunderstood the various web packaging proposals, perhaps deliberately. And he insists that they don't break URLs.

What's clear is that there are more than a few open privacy issues that have been raised about these proposals; what's less obvious is whether Google, as the dominant player on the web, will accommodate critics or ignore them.

The erosion of user agency – the ability to control and modify one's own software and hardware – has been ongoing for years, driven by profit-minded tech giants, repair-hostile hardware designs, and the realization that the openness of the PC era would pose problems as phones and home appliances became more dependent on vulnerability-prone software and processors.

In his 2008 book [PDF], The Future of the Internet — And How to Stop It, Jonathan Zittrain pointed to the "sterile" iPhone as the endgame, quoting Steve Job's repudiation of third-party innovation on the newly introduced smartphone:

We define everything that is on the phone. . . . You don’t want your phone to be like a PC. The last thing you want is to have loaded three apps on your phone and then you go to make a call and it doesn’t work anymore. These are more like iPods than they are like computers.

Apple however backed away from a strict appliance model. As Zittrain mentioned in passing, a promised software development kit – unreleased at the time – might allow third-parties to create iPhone apps with Apple's permission. And that came to pass, creating the App Store model now on the defensive against trustbusters and aggrieved developers around the globe.

The web remained open, at least on a technical level, as smartphones proliferated over the past decade. It's been a small consolation for those annoyed by the paternalism of Apple and Google, which each in their own way limit native software in their respective smartphone platforms.

But ad companies have demonstrated that they're not thrilled with people being able to block their ads. Consider how Facebook, which proudly touts its commitment to open source software, routinely obfuscates the structure of its webpage code to prevent content blockers from working.

Google is in the midst of making changes to its browser ecosystem that affect code freedom and privacy. The ad biz has been trying to address a broad range of web security and privacy problems – many of which really do need to be dealt with – while also figuring out how its ad-based business model can thrive when starved of its rich diet of cookies. But in putting its house in order, the company has managed to step on a few toes.

Perhaps Google's motives are pure and it only wants what's best for the web. Perhaps the company's deprecated motto "Don't be evil" still motivates its employees. If so, the ad biz clearly has more work to do to convince people it's not trying to privatize the web and force ads on the unwilling.

"The Google argument is, to my mind, absurd," Snyder said in an email. "It goes something like 'this is already available if you buy service XYZ'; my point is that paying for XYZ is a meaningful, useful deterrent! Or they'll say 'blocking by URL is already imperfect because of ABC'; my point is that WebBundles are further eroding the effectiveness of an imperfect-but-none-the-less extremely useful tool, URL-based blocking." ®

Send us news
95 Comments

China’s COVID lockdowns bite e-commerce players

CEO of e-tail market leader JD perhaps boldly points out wider economic impact of zero-virus stance

The CEO of China’s top e-commerce company, JD, has pointed out the economic impact of China’s current COVID-19 lockdowns - and the news is not good.

Speaking on the company’s Q1 2022 earnings call, JD Retail CEO Lei Xu said that the first two years of the COVID-19 pandemic had brought positive effects for many Chinese e-tailers as buyer behaviour shifted to online purchases.

But Lei said the current lengthy and strict lockdowns in Shanghai and Beijing, plus shorter restrictions in other large cities, have started to bite all online businesses as well as their real-world counterparts.

Continue reading

Foxconn forms JV to build chip fab in Malaysia

Can't say when, where, nor price tag. Has promised 40k wafers a month at between 28nm and 40nm

Taiwanese contract manufacturer to the stars Foxconn is to build a chip fabrication plant in Malaysia.

The planned factory will emit 12-inch wafers, with process nodes ranging from 28 to 40nm, and will have a capacity of 40,000 wafers a month. By way of comparison, semiconductor-centric analyst house IC Insights rates global wafer capacity at 21 million a month, and Taiwanese TSMC’s four “gigafabs” can each crank out 250,000 wafers a month.

In terms of production volume and technology, this Malaysian facility will not therefore catapult Foxconn into the ranks of leading chipmakers.

Continue reading

NASA's InSight doomed as Mars dust coats solar panels

The little lander that couldn't (any longer)

The Martian InSight lander will no longer be able to function within months as dust continues to pile up on its solar panels, starving it of energy, NASA reported on Tuesday.

Launched from Earth in 2018, the six-metre-wide machine's mission was sent to study the Red Planet below its surface. InSight is armed with a range of instruments, including a robotic arm, seismometer, and a soil temperature sensor. Astronomers figured the data would help them understand how the rocky cores of planets in the Solar System formed and evolved over time.

"InSight has transformed our understanding of the interiors of rocky planets and set the stage for future missions," Lori Glaze, director of NASA's Planetary Science Division, said in a statement. "We can apply what we've learned about Mars' inner structure to Earth, the Moon, Venus, and even rocky planets in other solar systems."

Continue reading

The ‘substantial contributions’ Intel has promised to boost RISC-V adoption

With the benefit of maybe revitalizing the x86 giant’s foundry business

Analysis Here's something that would have seemed outlandish only a few years ago: to help fuel Intel's future growth, the x86 giant has vowed to do what it can to make the open-source RISC-V ISA worthy of widespread adoption.

In a presentation, an Intel representative shared some details of how the chipmaker plans to contribute to RISC-V as part of its bet that the instruction set architecture will fuel growth for its revitalized contract chip manufacturing business.

While Intel invested in RISC-V chip designer SiFive in 2018, the semiconductor titan's intentions with RISC-V evolved last year when it revealed that the contract manufacturing business key to its comeback, Intel Foundry Services, would be willing to make chips compatible with x86, Arm, and RISC-V ISAs. The chipmaker then announced in February it joined RISC-V International, the ISA's governing body, and launched a $1 billion innovation fund that will support chip designers, including those making RISC-V components.

Continue reading

FBI warns of North Korean cyberspies posing as foreign IT workers

Looking for tech talent? Kim Jong-un's friendly freelancers, at your service

Pay close attention to that resume before offering that work contract.

The FBI, in a joint advisory with the US government Departments of State and Treasury, has warned that North Korea's cyberspies are posing as non-North-Korean IT workers to bag Western jobs to advance Kim Jong-un's nefarious pursuits.

In guidance [PDF] issued this week, the Feds warned that these techies often use fake IDs and other documents to pose as non-North-Korean nationals to gain freelance employment in North America, Europe, and east Asia. Additionally, North Korean IT workers may accept foreign contracts and then outsource those projects to non-North-Korean folks.

Continue reading

Elon Musk says Twitter buy 'cannot move forward' until spam stats spat settled

A stunning surprise to no one in this Solar System

Elon Musk said his bid to acquire and privatize Twitter "cannot move forward" until the social network proves its claim that fake bot accounts make up less than five per cent of all users.

The world's richest meme lord formally launched efforts to take over Twitter last month after buying a 9.2 per cent stake in the biz. He declined an offer to join the board of directors, only to return asking if he could buy the social media platform outright at $54.20 per share. Twitter's board resisted Musk's plans at first, installing a "poison pill" to hamper a hostile takeover before accepting the deal, worth over $44 billion.

But then it appears Musk spotted something in Twitter's latest filing to America's financial watchdog, the SEC. The paperwork asserted that "fewer than five percent" of Twitter's monetizable daily active users (mDAUs) in the first quarter of 2022 were fake or spammer accounts, which Musk objected to: he felt that figure should be a lot higher. He had earlier proclaimed that ridding Twitter of spam bots was a priority for him, post-takeover.

Continue reading

Pentagon opens up about its database of 400 smudges that may or may not be UFOs

'We're open to all hypotheses, we're open to any conclusions' says official

A US House of Representatives subcommittee on Tuesday heard from Pentagon officials on reports of and investigations into unidentified aerial phenomena (UAP) – a category that encompasses unidentified flying objects (UFO) and saves room for optical illusions, lens flare, smudges in photos, and other possibilities like meteorological events.

The US military has researched UFOs in the past through initiatives like Project Blue Book (1947-1969), and the Pentagon’s Advanced Aerospace Threat Identification Program (AATIP) (2007-2012).

Following a New York Times report in 2017 about the shutdown of the classified $22m AATIP program, public pressure and Congressional interest led the Office of the Director of National Intelligence last June to release a preliminary report on UAP [PDF] dating back to 2004.

Continue reading

AMD claims its GPUs beat Nvidia on performance per dollar

* Terms, conditions, hardware specs and software may vary – a lot

As a slowdown in PC sales brings down prices for graphics cards, AMD is hoping to win over the market's remaining buyers with a bold, new claim that its latest Radeon cards provide better performance for the dollar than Nvidia's most recent GeForce cards.

In an image tweeted Monday by AMD's top gaming executive, the chip designer claims its lineup of Radeon RX 6000 cards provide better performance per dollar than competing ones from Nvidia, with all but two of the ten cards listed offering advantages in the double-digit percentages. AMD also claims to provide better performance for the power required by each card in all but two of the cards.

Continue reading

Google opens the pod doors on Bay View campus

A futuristic design won't make people want to come back – just ask Apple

After nearly a decade of planning and five years of construction, Google is cutting the ribbon on its Bay View campus, the first that Google itself designed.

The Bay View campus in Mountain View – slated to open this week – consists of two office buildings (one of which, Charleston East, is still under construction), 20 acres of open space, a 1,000-person event center and 240 short-term accommodations for Google employees. The search giant said the buildings at Bay View total 1.1 million square feet. For reference, that's less than half the size of Apple's spaceship. 

The roofs on the two main buildings, which look like pavilions roofed in sails, were designed that way for a purpose: They're a network of 90,000 scale-like solar panels nicknamed "dragonscales" for their layout and shimmer. By scaling the tiles, Google said the design minimises damage from wind, rain and snow, and the sloped pavilion-like roof improves solar capture by adding additional curves in the roof. 

Continue reading

Pentester pops open Tesla Model 3 using low-cost Bluetooth module

Anything that uses proximity-based BLE is vulnerable, claim researchers

Tesla Model 3 and Y owners, beware: the passive entry feature on your vehicle could potentially be hoodwinked by a relay attack, leading to the theft of the flash motor.

Discovered and demonstrated by researchers at NCC Group, the technique involves relaying the Bluetooth Low Energy (BLE) signals from a smartphone that has been paired with a Tesla back to the vehicle. Far from simply unlocking the door, this hack lets a miscreant start the car and drive away, too.

Essentially, what happens is this: the paired smartphone should be physically close by the Tesla to unlock it. NCC's technique involves one gadget near the paired phone, and another gadget near the car. The phone-side gadget relays signals from the phone to the car-side gadget, which forwards them to the vehicle to unlock and start it. This shouldn't normally happen because the phone and car are so far apart. The car has a defense mechanism – based on measuring transmission latency to detect that a paired device is too far away – that ideally prevents relayed signals from working, though this can be defeated by simply cutting the latency of the relay process.

Continue reading

Google assuring open-source code to secure software supply chains

Java and Python packages are the first on the list

Google has a plan — and a new product plus a partnership with developer-focused security shop Snyk — that attempts to make it easier for enterprises to secure their open source software dependencies.

The new service, announced today at the Google Cloud Security Summit, is called Assured Open Source Software. We're told it will initially focus on some Java and Python packages that Google's own developers prioritize in their workflows. 

These two programming languages have "particularly high-risk profiles," Google Cloud Cloud VP and GM Sunil Potti said in response to The Register's questions. "Remember Log4j?" Yes, quite vividly.

Continue reading