THE BLOB! – Google’s new threat to Internet privacy and security

“Google is proposing a new standard called WebBundles,” according to Brave’s senior privacy researcher. Brave is an alternate web browser, competition to Chrome, Edge, and Firefox. From the Brave website:


WebBundles Harmful to Content Blocking, Security Tools, and the Open Web

This proposed standard allows websites to ‘bundle’ resources together, and will make it impossible for browsers to reason about sub-resources by URL.

This threatens to change the Web from a hyperlinked collection of resources (that can be audited, selectively fetched, or even replaced), to opaque all-or-nothing “blobs” (like PDFs or SWFs). Organizations, users, researchers and regulators who believe in an open, user-serving, transparent Web should oppose this standard…

The Web is valuable because it’s user-centric, user-controllable, user-editable. Users, with only a small amount of expertise, can see what web-resources a page includes, and decide which, if any, their browser should load; and non-expert users can take advantage of this knowledge by installing extensions or privacy protecting tools… At root, what makes the Web different, more open, more user-centric than other application systems, is the URL. Because URLs (generally) point to one thing, researchers and activists can measure, analyze and reason about those URLs in advance; other users can then use this information to make decisions about whether, and in what way, they’d like to load the thing the URL points to…

At a high level, WebBundles are a way of packing resources together, so that instead of downloading each Website, image and JavaScript file independently, your browser downloads just one “bundle”, and that file includes all the information needed to load the entire page. And URLs are no longer common, global references to resources on the Web, but arbitrary indexes into the bundle. Put differently, WebBundles make Websites behave like PDFs (or Flash SWFs). A PDF includes all the images, videos, and scripts needed to render the PDF; you don’t download each item individually. This has some convenience benefits, but also makes it near-impossible to reason about an image in a PDF independently from the PDF itself. This is, for example, why there are no content-blocking tools for PDFs. PDFs are effectively all or nothing propositions, and WebBundles would turn Websites into the same.

By changing URLs from meaningful, global identifiers into arbitrary, package-relative indexes, WebBundles give advertisers and trackers enormously powerful new ways to evade privacy and security protecting web tools… At root, the common cause of all these evasions is that WebBundles create a local namespace for resources, independent of what the rest of the world sees, and that this can cause all sorts of name confusion, undoing years of privacy-and-security-improving work by privacy activists and researchers…

We’ve tried to work at length with the WebBundle authors to address these concerns, with no success. We strongly encourage Google and the WebBundle group to pause development on this proposal until the privacy and security issues discussed in this post have been addressed. We also encourage others in the Web privacy and security community to engage in the conversation too, and to not implement the spec until these concerns have been resolved.

80 thoughts on “THE BLOB! – Google’s new threat to Internet privacy and security

  1. The Blob was the first horror movie I saw as a kid when we got our first TV in the early 60’s. Somehow even today I am still terrified by those images, and I fell now today we are being steamrollered by both Big Tech and Deep State to restrict our thought and be obedient and don’t question anything. Just like China or Russia, or any 3rd world country run by authoritarian dictatorships. The Web was supposed to be the last bastion of freedom and free thought. It looks more and more that we only have that on blogs like this where we can exercise First Amendment rights without fear of being ‘cancelled’. And most people on the good Earth don’t even have first amendment rights.

    • But you don’t have first amendment rights on this or any other blogs that aren’t owned by the
      US government. This site is moderated and they do a great job of keeping it readable and enjoyable.
      Otherwise it would end up like 8chan and other cess-pits of the internet.

      • Well Izaak, you don’t have the liberty to come into my house and start yelling at me, even though here in the US where I reside, there is a Frist Amendment right to free speech. I’ll kick you out if I like.

        This is Anthony’s “house.” He can kick out anyone he likes who violates his rules. That being said, this is also his hosting web provider’s “House” with its own terms of service. They also have content rules. If Anthony started recruiting for ISIS, or some other terrorist organization, they’d shut him down for violation of Terms of Service in his contract. The FBI would probably be knocking on his door the next day, but that’s a separate issue.

        However here in the USA, I can go onto a public street corner with my own sign that says “(fill-in the blank with some ethic group) Are All Pedophiles and K1llers”.

        In the UK or Australia, you might be arrested by the police for that “hate speech.” But not here in the USA.

        Now some one(s) as private individuals might get in my face and harass me and call me out for that bigoted statement, but I could stand on that street corner all day with that sign. The huge difference is the Government could not stop me. And that matters. The government carries the powers of the police force and the justice system. Those are far more worrisome if abused than some private individuals who don’t like my message.

        In the same vain, I can put a sandwich board sign on that says, “Climate Change is a Hoax on ignorant People” and stand on that corner all day too. In the UK and Australia one day that may become illegal and can be suppressed with the police powers of the State. That is dangerous. And that is why the US is a beacon of hope to suppressed people around the world who have experienced true State suppression with police powers to make people disappear, like in today’s Communist China.

        • actually Joel, Trump seems to think he can use force to move peaceful protesters from the streets so that he can walk to a church for a photo-op. What happened to the protesters first amendment rights?

          • Yes. First amendment rights aren’t absolute (neither are 2nd amendment)
            There’s a range of speech or writings that given lessor or no protection from government curbs
            Examples are obscenity, fraud, child pornography, speech integral to illegal conduct, speech that incites imminent lawless action, speech that violates intellectual property law, true threats, and commercial speech such as advertising.

          • Do you really think Trump makes his own Secret Service security details and plans and barks out orders to his security detail? Seriously Izaak, you’ve demonstrated yourself a fool here many times, that statement just reinforces it.

            When the President travels whole blocks of airspace for 20 nm radius are shutdown at his location. This is done for all US presidents now, Bush, Obama, Trump, after a security analysis of how long his security would need to successfully protect the President from an air attack. Those closures Seriously impacts many general aviation activities.
            I have no doubt the Secret Service has done similar security analyses for ground threats like snipers and bombers. So clearing out a park is just SS SOP for legallyrequired Protection of the President.
            But that is just the way it is.

          • Joel,
            Can you point me to the bit in the US constitution where its states that your first amendment rights can be over ruled so that a President can travel safely? And where
            does that start or end? Could a President confiscate some-one’s guns so that they could
            travel safely?

          • “What happened to the protesters first amendment rights?”

            You do not have the right to stop someone going where they want to go.

            That is a violation of their first amendment rights.

          • Trump seems to think he can use force to move peaceful protesters from the streets . . . What happened to the protesters first amendment rights?

            Nothing “happened” to their right to protest. Those protestors are free to protest somewhere else, e.g., wherever the city (or in this case, the Feds) deems it appropriate.

            Can you point me to the bit in the US constitution where its states that your first amendment rights can be over ruled so that a President can travel safely?

            Your logical fallacy is: Strawman

            No one’s first amendment rights are overruled so that a President can travel safely. Can you show me in the Constitution the declaration that one may protest wherever one wishes to protest? Or is it rather the case that local governments issue permits for such events? If the latter (and it is the latter) then local governments may (and do) also restrict WHERE you may have your “event.” It’s just so much common sense, Izaak:

            “The government may impose reasonable restrictions on the time, place, and manner of your event in order to reduce the amount of disruption it will cause. However, a demonstration should be allowed to take place within “sight and sound” of its intended audience. You can challenge efforts to re-route your march away from busy crowds or main streets or to dictate when it must start and end—because you can’t communicate your message if there’s nobody to hear it.”

            https://tinyurl.com/yacjpeyf

            Could a President confiscate some-one’s guns so that they could travel safely?

            Good grief, Izaak. Of COURSE the Secret Service could confiscate your gun if they believed it necessary to protect the President.

            If I attempt to carry my gun onto a commercial passenger aircraft in the United States, it will be confiscated upon detection at the TSA checkpoint. How much MORE then will my right to carry be restricted when the President of the United States is near enough for me to be a danger to him?

          • Have you ever been someplace when a president is scheduled to appear? I have. The president was President Clinton and the places was Rowes Wharf in Boston. The Secret Service gave everyone a colonoscopy to make sure that there were no weapons around. Metal detectors were set up and crowd control measures were used. The office in which I worked was searched. A similar effort was made at MIT when he appeared to talk.

            There are things known as compelling state interest and rational state interest. Rational state interest is the concept that somebody, someplace might thing something is a good idea. Compelling state interest is the standard for over-riding one of the normal freedoms granted under the constitution. It is a compelling state interest to prevent me from bringing a firearm to a place where the president is about to speak. That over-rides the second amendment for instance.

            Rioters chanting “Burn it down” may or may not have a rational state interest to be allowed to do so. They do not have a compelling state interest to be at a location where the president is to appear.

          • You can stand on a corner with a sandwich board, but 500 of you blocking a street or sidewalk are denying citizens free passage.

          • You are an idiot and I can say that because you commented on something that you clearly have no facts about.
            President Trump did not have the area cleared. The Park Service did that.
            Unless you think people lied to Congress:

            https://www.breitbart.com/news/watch-live-natl-guardsman-testifies-on-federal-response-to-d-c-protest/

            “The head of the U.S. Park Police told Congress on Tuesday that no one from the White House ordered protesters be cleared from Lafayette Square last month”

          • Speech is not bricks, bike locks, and Molotov cocktails.

            Actually, it also is not impeding the free movement of persons going about lawful activities, such as visiting a church. (The Left applauded just such a proper distinction when the issue was blocking access to a baby killing facility. They seem fine with blocking highways, streets, and access to retail businesses.)

          • First amendment doesn’t mean you can exercise them whenever or where ever you want.
            Being told to move your demonstration over there instead of right here is not a violation of the first amendment.

          • Matthew, the left wants their presidents to be dictators, so it’s natural for them to assume that other people’s presidents are already dictators.

          • markw,

            “Matthew, the left wants their presidents to be dictators, so it’s natural for them to assume that other people’s presidents are already dictators.”

            +100

          • Izaak Walton – September 1, 2020 at 12:31 am

            Trump seems to think he can use force to move peaceful protesters from the streets so that he can walk to a church for a photo-op.

            Izaak Walton, …… forget about President Trump, …… prove to us (and yourself) that you are not afraid to “walk the streets of Portland, New York, Chicago, etc.,” …….. when those “peaceful protesters” are out & about on the streets doing their rioting, robbing, looting, shooting, murdering, burning, pillaging, and/or destroying of other people’s property and lives.

            Go for it, ….. Izaak Walton, …… put your feet on the streets where your big mouth is, …. hang a “Blue Lives Matter” sign on your backside and take a leisurely stroll down the street(s) among those “peaceful protesters”.

            Maybe iffen you tell them you are on your way to church …………………….

          • Trump seems to think he can use force to move peaceful protesters from the streets

            1. If they are “in the streets” as in blocking traffic, without a permit then, yes, they can be removed from the streets. They are then violating the rights of others.
            2. “Peaceful protesters” do not riot and loot.
            (Reminds me of Fiona in Shrek, “By day one way, by night another.”

          • Izaak Walton: “peaceful protesters

            Hahahahahahahahahahahahahahahahahah!!!!

            You’ve surpassed your normal nonsense and entered into grim delusional hilarity, Izaak.

          • Except that’s not what actually happened. And you know that, or should know that, of course… except the truth doesn’t fit your narrative, so you don’t pursue the truth, you only pursue your narrative, regardless of the truth.

            In truth, those “peaceful protestors” were cleared from the area by park police because they’d attacked police officers.

            Park police even issued a statement that the “peaceful protestors” were cleared because they’d attacked police officers, and no tear gas was used in clearing them. In fact, the park police didn’t even know Trump would be visiting the church.

            Trump never ordered anything. But you know that, or should know that, of course… except the truth doesn’t fit your narrative, so you don’t pursue the truth, you only pursue your narrative, regardless of the truth.

            If you have to sell your ideology via continual and easily debunked lies, your ideology is a dangerous sham, and you’re either a willing participant in destroying society for your own gain, or you’re a useful idiot for the same cause. Cogitate on that for awhile, won’t you?

          • “What happened to the protesters first amendment rights?”

            The protesters were still protesting. They just had to do it a little bit farther away from the White House.

            Protesters don’t get to barge into the White House to voice their dissatisfaction. There are rules governing such things. If you don’t like it, go talk to the Secret Service.

        • Joel

          You say,
          “However here in the USA, I can go onto a public street corner with my own sign that says “(fill-in the blank with some ethic group) Are All Pedophiles and K1llers”.
          In the UK or Australia, you might be arrested by the police for that “hate speech.” But not here in the USA.”
          You might well be right but some years ago a presenter on BBC radio said that the words ‘paedophile’ and ‘priest’ were almost synonymous. When I complained to the BBC, they said that it was perfectly acceptable for the presenter to say what he did. The excuse they gave was that the average listener would not have been misled.

          • To the left, it’s only a violation when they are being insulted.
            In this case “the average listener” was assumed to be a hard core leftist.

      • Izaak
        Google/Youtube does a great job censuring content they or Soros tells them to censure.
        Time to break up Google, Facebook, Amazon.
        Where is Teddy Roosevelt when we need him.

      • Izaak,,

        There are perhaps better overviews of why the public (and not private citizens or corporations) own the radio spectrum and not only may, but must, regulate them:
        https://mtsu.edu/first-amendment/article/1090/radio-act-of-1912

        And this does not mention private citizens or corporation using public right-of-ways, nor does it address the common carrier regulations as regards to legal ramifications of restricting or controlling access.

      • When TF will the GOP wake up and repeal Section 230??? Hey GOP, did you see that the U.S. Chamber of Commerce has embraced the global warming hoax and just endorsed numerous Democrats? Wake TF up and stop doing whatever they want and embrace the repeal of Section 230. Repeal that and you’ll fix these companies.

    • Joe Biden was just elected the 46th President of the U.S.A. U.S.S.A…
      Welcome to the U.S.S.A.
      United
      Socialist
      States of
      America

      • We can’t even begin to imagine the Rivers of Liberal tears that will flow the night of November 3rd, when Wolf Blitzer has to once again declare Trump is the Winner and will be the US President for the next 4 years.

        I like Liberal tears. They taste like…. Victory and Freedom.

        • The other alternative is the Secret Service has to frog March the previous president out of the Whitehouse on Jan 20 after hecrefuses to accept the result…..to the cheers of the biggest crowd ..yes really..at an inauguration

          • I seriously doubt that, and IMO, it is going to be another close election, but the majority of people in rural areas are going to vote for stability and law and order, including new economic growth to grow the economy faster than the debt that is a millstone around our necks. So in that regard, it is looking like a repeat of the 2016 election. DJT will probably win a bigger majority, just because the majority, including ethic minorities would prefer stability to instability, which is what the Democrats are promoting.

            Especially with this nasty China virus that was unleashed on the world, in part to destabilize the global economy and try and unseat the current POTUS, whom the tyrants of the world really do fear. But when it comes time to cast that ballot, I am more confident than ever that the Republicans will legitimately hold onto power in the People’s House. Let’s hope for a clean sweep in the House and the Senate, so that the Supreme Court will have some balance for the decades to come when socialism and Marxism might rear its ugly head here.

          • Notice how the left assumes that Trump won’t voluntarily leave the White House.
            In the minds of the left, anyone who opposes them is evil and must be treated as such.

          • “The other alternative is the Secret Service has to frog March the previous president out of the Whitehouse on Jan 20 after hecrefuses to accept the result…..to the cheers of the biggest crowd ..yes really..at an inauguration”

            Where does the left get this meme? Trump was not a career politician. He stated in 2016 that he didn’t need to be President, he just wanted to straighten out the country.

            Nothing has changed. He has real things he can go back to if he is not elected. Biden? He’s a career politician. If he doesn’t win its back to retirement and obscurity for him! Biden is far more likely to not accept the result of the election than Trump.

  2. So, if a website made a decision to include pictures of unclothed people in the act of copulation without any warnings, I would not have the choice to block those images from the eyes of my children?

    And Google are ok with this?

      • Redge – September 1, 2020 at 12:14 am

        pictures of unclothed people in the act of copulation …….. I would not have the choice to block those images from the eyes of my children?

        Redge, ….. are the eyes of you children “blocked” from seeing any ‘nakedness’ that occurs in your home?

        Do you force you children to bathe themselves so that no one can see their nakedness?

        And why in hell are you even worried about it, …….. your children are being shown those “naked pictures” in their Sex Ed classes in the Public Schools with graphic instructions on copulating techniques.

          • Redge, …… that was a PP excuse for your pretense of being “cleaner in mind and body than newly fallen snow“.

            Testify, …… Redge, ……. TESTIFY, you will feel better for it.

  3. Maybe non-sheeple will have to go back to the old system we used in the 1970’s:
    I had a NASCOM and a GALAXY computer with 8kByte RAM and 15MByte HD, plus a modem 1.2kBaud and two 8″ floppy drives.
    I had the freedom to go to any server in the world, using the server’s telephone number, without having Big Brother or Big Tech spying on me.

    If you have no idea what a modem, a floppy disk and a POTS is, please feel free to look it up.

    Seriously, the bundle idea is indeed bad, but just like the non solvable Climate Change, the permanent Lock-down and the increasing censorship by Big Tech, the WebBundle will help speeding up the control of the people and change the society into the new GDR (Global Democratic Republic).

    • No idea what floppies are? Oh, puhleeze, kiddo, I have a box full of them… and a floppy reader, too. Now, if only I could find some extra typeballs for my IBM Selectric III and get the old girl a typing table, I could bang out copy all day long. 🙂 Maybe I could find an old Mergenthaler hot-type setter and put out my own newspaper, too.

      Really, if this kind of thing happens, restricting what The They think (they don’t really think) you want to see, ti’s just another hurdle to overcome. Nothing says you have to use it, you know, or even download it. And if you really can’t stand it, then — well, there is always handwritten stuff.

      The They are viewing this as a convenience. In reality, they seem to think we’re just a bunch of little kids who don’t know what we want. How many times must we be reminded that we’re under no obligation to use the internet at all?

  4. Web browsers (those not in the pocket Facebook et al, step back Microsoft, Apple and Android) will simply download the lot and pick through it to display the parts users want to see.

    On the other hand, they will just avoid blob sites. How many MSM news sites are actually informative these days? Informative, not solely focused to telling you what you ought to think. The kind of person who revels in Basefook, Twitter etc probably doesn’t have an ad-blocker anyway – which is what this is all about.

    • With only indexes (sub-page #55) and local names (picture44.jpg), how will they know what to censor? Right now filtering is done by looking at the entire URL, including the domain name. Blobs will make it 10 times as difficult to properly filter. This is almost certainly being done to make it harder to filter out advertising. I wouldn’t mind reasonable ads (like on WUWT), but some are so festooned with flashing, resizing ads, that the site is unusable.

  5. It has surprised me that large companies had not already tried to force an “all or nothing” on the public.

    Their blobs will be updated on demand by their servers to insert advertisements they deem best targeted to the user requesting the blob. They will put all sorts of protections into their blobs to keep people from disassembling them. Blobs will not be cached – the companies want to serve up directly to the end user so they can record their “interests”.

    Google needs to be dismantled into a set of competing companies. They are already dangerously powerful and influential.

  6. Well, my Firefox browser is chock full of ad blockers and other and I also do not own or watch/listen to any TV & radio programming, also do not have a cell phone much less a smartphone. The websites that block me due to the ad blockers always being active, I consider not worth my time to view. That being said, I highly doubt I have seen or heard any advertising for anything in well over 10 years, billboards excepted while driving.

    • ditto
      Im staggered when I see other peoples pcs without adblockers so much crap all over th page
      and we pay our gigs to have that dross appear?
      nah
      ditto TV i ditched the hubby the tv vidiot 30yrs ago
      life improved markedly
      again truly stunned when i visit someone with a tv and see what theyre inundated with
      scary shit.

      • Ghostery add-on for Firefox is good.

        Have to mute sound on TV and/or computer during commercials to save sanity. Wore out mute button on older tv remote.

    • There’s one classical station left on FM radio that I can get. The other stations are drek,

      Haven’t had a working TV in 10 years, don’t miss it.

      I do try to stay shy of unnecessary and unwanted junk on the internet, but sometimes, it’s unavoidable, so I keep a list handy of things I want to see and visit, and the rest is drek.

      I’m thinking about reinstalling a land line, for Pete’s sake.

  7. Back before there was a commercial Internet I was involved in the development of the MIME protocol (Multipurpose Internet Mail Extensions). At that time all email was sent as plain ASCII text, there were no binary (8 bit) attachments. The ability to send binary data by email resulted in the some of the first computer viruses. MIME is also the basis for much of the Hypertext protocol used to render web pages. It’s effect has been earth shaking and most of it unanticipated…

    I’m not saying that this bundling concept should be banned, but the implications should be examined very, very carefully. It is very a similar concept to virtual machines and could become quite powerful as well as extremely destructive.

    • I think virtual machines might be the answer. Browse the web with a virtual machine and, when you’re through browsing, poof, everything is gone. If you’re doing something sensitive like your on line banking, just start a virtual machine and terminate it when you’re through banking. As far as I can tell, malware doesn’t stand a chance.

      A similar idea is the frugal install of something like Damn Small Linux (DSL). Every time you reboot, you’re starting with a fresh machine.

      • I use Virtual Machines all the time for exactly that reason.
        You can run several instances of multiple OS or servers simultaneously.
        Take a snapshot of a particular machine setting and revert any time.

  8. “HAL, I only want to download what I want to download”
    “I’m sorry Dave I’m afraid I can’t do that”.

  9. I ran into this issue building flash web sites a decade or more ago. They were pretty and all, but I couldn’t link to any individual page. You also couldn’t see where a linked button was going to take you by hovering your mouse cursor over it. Which means you could be taken to/load some really bad stuff, and wouldn’t know it until it was too late.

    • Flash was an earlier example of the same problem — web site owners with bad attitudes. It is not their place to override the individual viewer’s choices of what should appear on his screen.

      I predict that the market for alternative browsers (Brave, Dissenter, DuckDuckGo) as a way of limiting these intrusions will only grow. For every presumption there is a countermeasure.

  10. There must be money and censorship involved to attempt the blob.

    No one except the sheriff believed Steve McQueen about the blob until they saw it. Good movie. As I recall they moved it to the one of the poles where the cold would keep it inactive. Kicking that problem down the road until it all melted. Maybe an acid bath would have eaten it up. Or bleach.

  11. I have a few bookshelves that actually have books in them. (A 1970’s set of The World Book Encyclopedia, about 30 Landmark Books from when I was kid, a bunch of American Heritage books, 10 or so of Allen Eckert’s books (The Frontiersmen etc.), 3 shelves with my Bible study references, plus humor and other stuff like Hammer’s Slammers, The Complete, Compleat Enchanter etc.) Some of the books contain valuable information, some just useful information and some are just for fun and entertainment.
    None of what they contain is susceptible to being erased, modified. If one is physically destroyed, I could find another with the same information. (Granted, some might be hard to track down. All the Landmark Books are out of print and one or two of my Eckerts are first editions.)
    But no one could change the content of all of the copies of a particular books content with a few keystrokes as can done with digital sources of information.
    (Too hard to get rid all the old stuff? “Update” the OS to where it can’t run the old programs that read the old info.)

  12. Google’s whole business model, is to steal the work of other people and then add their own advertising and/or political indoctrination (to support politicians who will allow google brainwashing to make Google more money & get them more power).

    You may as well hand over your chequebook, your mind and your future to the mafia.

Comments are closed.