People like you and me are unfortunately a small minority. Most people go along with it, so they set about steamrolling over us through coercion or just not doing business with us

Will you change your bank when it refuses to work with Firefox? What if most other banks do the same?

This is how things are in Android now – online banking, online games and even subscription media services are mostly unavailable to those who would like to use non-official OS.

website authors will want to limit their own audience for the benefit of some company?

Many websites already refuse to work with anything not-chrome-based – so website authors often don’t care.

Banks see that as ‘security’, so they are ok with ‘losing’ a small percentage of customers who want ‘insecure’ devices. In fact they would hardly lose anything, as their customers usually depend more on the bank, than the bank on any particular customer.

For media providers, that is another ‘anti-piracy’ measure (DRM) – they will also happily sacrifice Linux users, as insignificant fraction of users, probably less then ‘actual pirates’ on Windows or Mac. Netflix already won’t stream in high quality to Firefox on Linux.

For online game providers this will be easy anti-cheat measure – they will also not care about that insignificant fraction of user.

Each of those service providers would loose maybe 5% of their user base (probably less… as most users would eventually accommodate), but the affected users would use major number of services they care about.

do they think somehow people like me will change our minds?

Yeah. I use Firefox too, and when a site doesn’t work, I open it in chromium

Apple sold this feature as an alternative to captchas.

In order to sign up for Lemmy, I had to pass a captcha check to prove I’m human. Now that bots can trivially be better than any human at captchas we have to find something else. Is attestation a good option? We can debate that, but it’s definitely on the table. And I expect Firefox will implement it (even if only via a plugin) if it becomes widely adopted.

I just wrote a funny script and corresponding web page:

"use strict";

(() => {
  if (navigator.getEnvironmentIntegrity !== undefined) {
    window.location.href = "https://dblsaiko.net/no-wei";
  }
})()

If this API actually becomes a thing, I might put it on all my pages.

As an aspiring web developer, I shall refuse to use it once I learn.

If an internet giant like Cloudflare has already implemented and adopted this, there won’t be a lot that individual web developers can do unless this gets shot down as anti-competitive behavior (which it is). The alternative is not using CDNs and paying for servers and storage to self-host content, which will be prohibitively expensive for smaller businesses or individual hobbyists.

It wasn’t super secret, it’s just that the HTTP protocol standard is getting quite large. HTTP standard site.

Same with HTML, the standard for HTML 5 is just so massive no one person can know all of it. It is completely unknowable to a single person at this point (without referring back to the standard).

The protocols and standards underpinning the Web have become over engineered in my opinion. I’m sure it was with “best intention” but I recommend gemini protocol at this point for “fun” and http for “business”. Corporations owns HTTP at this point and there’s little that can be done to change it. It has become the modern Adobe flash with the veneer of openness to satiate the causal observer.

But that’s my two cents.

• Alice gives Bob a Secret Note.
• Alice and Bob agree on a way for Bob to scramble the Secret Note so that Alice can unscramble it.
• Bob scrambles the Secret Note.
• Bob gives Carol the Scrambled Secret Note.
• Carol gives Alice the Scrambled Secret Note.
• Alice descrambles the Scrambled Secret Note.
• Alice tells Carol the Secret Note came from Bob.

Now, Carol trusts Alice and Alice trusts Bob. By passing this note around, Carol can trust Bob since Alice trusts Bob and she trusts Alice.

Passing the note around tells Carol (Web Server) that Bob (Web Browser) has trust from Alice (Attestation Server) and is not some imposter just claiming to be Bob.

But the problem they try to solve is: user’s device is not under full control of the service provider. The only solution to that problem is to take away the control from the device owner. You cannot have both.

Which problems? As far as I can tell this solves zero problems for users of websites. Wanting to replace captchas with this is just another arms race that normal users will suffer from.