BSidesSF 2026 - Web standard consortiums are a game with Chrome as the monopoly... (Simon Wijckmans)

Thank you very much for joining us for the final talk of the day. I'd like to introduce our speaker, Simon Witzmans, from Belgium. He'll be talking about web standard consortiums are a game with Chrome as the monopoly man. Please give it up for Simon. Hello, hello people. Um Hi, everybody. Thanks for the warm intro. Um I was accidentally born in Belgium once. I'm not from Belgium. I live here and I've been out of Belgium since I was 18. But uh isn't it funny how we all showed up here thinking I was going to talk trash about Google all day, right? It's a click-baity title and it's on purpose because um this is about a rather complex thing

with a lot of different angles to it. But as a quick disclaimer and and I did put that on the slides, these are just my personal opinions. Um in in no way do I speak on behalf of W3C. I I'm not criticizing any W3C members. Um especially the big tech ones. Anyway, in fact, I actually do want to applaud uh Google for their contributions and how they've like over the years um I mean, I tried to keep that thing going properly. So, as a quick intro, um I'm Simon. I'm the founder and CEO of a company called Seaside. Seaside stands for client side. We are um one of the only web security companies in the world focused dedicated

on things that happen in browsers. Um both from monitoring malicious dependencies in browsers, how they behave there, whether they're open source or they're coming from marketing tools that you added or even ads or anything like that. Uh but also for fraud detection purposes, fingerprinting, understanding how people interact with your web application, um whether it's them as human or an AI agent, what kind of bad things they're trying to do and try and limit that. That's what I do as a day job, completely unrelated to what I'm talking about now. So, um I'm going to talk a little bit about the standards landscape. It's important that I scope it specifically to the thing that I know, and that is

the W3C, the World Wide Web Consortium. There are many other standards bodies like ECMAScript and TC whatever. The number is always funny. Uh but there are so many of these around the world in pretty much any industry. Um, currently this is the W3C logo. I'm not making a joke, that is their actual logo. Um, but it's important to kind of take a step back down history. So, um, after back in the day the internet was invented, which was honestly a group of universities around the world um, coming together and building this amazing network. Um, Tim Berners-Lee said, "Hey, this got to be standardized, protected to keep it freely available to people uh, because otherwise this thing's going

to become an evil weapon." And in many ways the W3C has very successfully actually achieved that. It became a standardized environment where organizations that hold significance in the internet um, can come together and talk about standards and try and make things better. And the thing is the term better is quite a broad statement, and that's kind of the purpose of this conversation today as well. So, like how it actually works. To be an eligible member, don't really need to be that special. You need to be a company, a non-profit university, um, or research institution, or an industry group of people wanting to contribute to the internet spec. Um, there are multiple mechanisms that you can leverage. There are working

groups that develop actual technical specifications. There are community groups uh, which are really just open communities that allow you to explore new ideas. Anybody can join. You don't even have to be a member for that. So, any one of us could be there right now. Um, but there's also like technical architecture groups uh, and advisory committees of specialists that are elected for those roles. Problem is, as all of us know, um, time is a scarce is a scarce asset. And the time investment in such things is rather substantial, especially if you think about how voting and all that corporate structure around it works. Um, often people that join these consortiums are working at larger technology companies that can afford to

have head count and time being spent on these types of programs, which is is but does make them quite a narrow group. Um, and you need to make sure you work at a company that actually sees the value in these types of things. And that is not that straightforward. A lot of companies that you might think of as substantial technology companies today are not contributing to standards. Um and that does beg the question, who actually is? Um consensus in an organizational environment like that where often people that are later in career come together to try and talk about standards can be very difficult. Um because there's so many different perspectives and different needs and honestly a lot of

people just benefiting off of the word no. Because why say yes to something that creates a bunch of work you can just say no. Uh and that would make things easier. And over the years the internet has also shifted. It's interesting cuz in the last 12 months, I think this is not news to anybody, um it was considered that Chromium is actually not a monopoly. And I think in the legal sense that is a correct assumption. Um but there is a a mechanism of the winner takes all in the web. We are not building web applications with five different browsers open. We are building web application thinking about where is this thing going to be used the most?

And and honestly, the biggest browser engine in the market is not WebKit. It's not any of the other ones either. It is Chromium and majority of browsers are built on top of Chromium. So Google owns a lot of power here. Um and honestly to my point, they've done a great job here. Um when you go to a W3C event, and every year there's multiple of those, but the big one, um last time was in Japan, you'll walk into a room and you'll find substantial presence of Google people. About 40% of the room will be Google. Um and those people are all there encouraged to talk about their perspective, not hold back. So you're sitting there in a meeting room, 40%

people from Google holding substantial power in the web. Um and they're arguing among each other, arguing their own perspectives, and you're sitting there. Can you imagine me as basically a dude it an Elmo suit running a small startup surrounded by Google, Microsoft, Meta, big banks, all that kind of stuff. And seeing there as the only startup founder that answers his own emails, writes the code, and thinks about the spec doing it end-to-end. And that's kind of the whole thing. And that's also kind of a problem here. These people don't often use the technology, the very thing that they are writing the spec for. They don't understand how it is really being used in production. Um when we talk about

things like, and I know this subject really deeply, for example, content security policies, these people have never tried to deploy content security policy in an environment with actual real production traffic. Maybe on their own personal blog, but that is not really what this thing is being used by. And the sad reality here is that because of the flexibility that this consortium has, acceptable feedback comes in totally unacceptable forms. For example, I don't think I would use it. That's acceptable feedback. And the thing is that even in an environment where that wouldn't be acceptable feedback, if people are allowed to say that and feel empowered to say it, it influences other people to say no as well.

Um but anyway, but I want to get back to it. Google is allowed to send a bunch of people to it, spend substantial money on it, and they're allowed to argue among each other in public with others, disagreeing while the other companies are around. And then I think is a really powerful thing. The problem is like how do you actually get things to move in an environment where everybody has the benefit of saying no, and that means less work for them, and you can end up just endlessly arguing because these people are not actually going to do the work anyway. They're just people doing the talking. Um honestly, dude, it comes down to the most substantial thing of it all. Comes

down to money. Um whereas my personal perspective on consortium work is not about money. It's about what are we doing here to make the web better? What are we doing here to make the web safer, make it more accessible, etc., etc. Of course, at the end of the day, we're all getting paid a wage and we need to do the best interest thing for the business. But, when I'm walking to a consortium environment, I'm not doing that. Um I'm thinking about what are we actually doing here to build a better web. So, let's take a look at what actually what that actually takes. Um imagine you wrote a magnificent spec. Um you're finding a way to save about

40% of bandwidth through some new image fetching methods. Great. Completely conceptual here, people. We've gone back and forth on image fetching. Please do not open that can of worms. Um completely with security built in, verification, 100% backwards compatible. There are absolutely no reasons not to do it. It's a total no-brainer. Thinking about it, this would have been a great point like great point to put something like musically in here cuz I was told that that was the the concept of this year. Had to have some musical element with it, but anyway, uh I missed that shot. Well, what you actually need to do, um for these steps, thing you have to think about everything that gets involved into

this supply chain. First of all, the browser vendor needs to want it. And as I said, they can just say no because they already do image fetching. Images have been part of the web for a long time. So, why should we change? Well, cuz it's 40% better. Well, I don't really care because I don't even run a website. Secondly, where are the images going to come from? Well, the CDN providers now also have to agree on it. All right, cool. And some of these CDN providers say, "Well, if Google is not interested, I'm not interested either because then we don't really have any traffic coming from it. So, why would I do that?" Okay. And then, well, CDN image hosting

is kind of the same thing. Great. Now, imagine that there is a very small change you have to make as a developer to make this image actually fetch using this new method. Well, then you need the web developers on board. And there isn't really a central point where you can talk to those people. And oh my god, they are hell opinionated about things. So, the odds of you adding a question online somewhere in a forum and getting a very strong no against it for whatever freaking reason is quite high. It's a bit like those neighbor watch neighborhood watch like WhatsApp groups. Like you will always have that one person with too much time that will

be very strongly opinionated about something that is actually very very straightforward. Um and then of course comes the question is this even secure? Well, I mean let's imagine yes, you still have to show it and actually pressure test this and get people to have their thumbs up as well. Um and then of course there is the accessibility part which I think I mean is the really the very valid point but we got to think about that across the board anyway. Um and of course those people will have their say. And as I said at any point any person in this process because they are at big tech and are already busy have every reason to say no.

No is a default that is honestly super damaging and because of course it's easy for you and you want to go home at 4:00 p.m. and pick up your kids but you're actually blocking. You're blocking by using the word no. But it's the easiest easiest answer. So what data do you need to present? This will take about 18 months. Developer and benchmark security analysis compatibility testing developer you get the drift. This is a a path right to get anything done. And then comes the comment circus. The comment circus oh my god and I've been there and I don't want to do that again but it's part of the game. Constructive have you considered edge case X or Y? And I'm totally fine with

that question because well sometimes I haven't and we got to talk about that. And so that's perfectly fine. This conflicts with specification why? I'm like great. Politically our business model depends on the current approach. Like sure. I mean I what do you want me to do with that info right? We need more time to evaluate. Well that is obviously an endless response and here comes the pedantic ones. Um debates about naming conventions. Oh developers love that. All right, we're very good at that. That can last months alone. Okay, great and then we still have And by the way, naming conventions I find hilarious here. Who here has seen referer header? Yeah. Yes. Arguments about naming convention from

that very group of people. Okay, then debates over um Sorry, the bikeshedding over syntax choices. Okay, great. And then one that I find particularly funny uh is this one. It's an anti-pattern. That sentence gets thrown around all the freaking time. It's like literally it's just everywhere. But this is coming from the very group that made SSL possible, which makes everything slower and was also an anti-pattern, and CSP, and CORS, and all of those things you define in an HTTP header. All of those things are by their very nature anti-patterns, but hold such significant security essentials. It's just doesn't freaking matter that it's a quote-unquote anti-pattern. I understand user experience is important and everything, especially when it comes to to optional

security things that we as people always think about, it's great to have the option. It doesn't mean that everybody needs to use it. And if user experience is quote-unquote an anti-pattern, well, it's up to those who adopt it whether or not they would even go there. Anyway, and the worst part is you're having an argument with people that are not the target user. And so I've been bitching about consortiums for quite a bit now. I'm going to continue a few more slides. The thing is that in the end, like in every situation, you come to compromises. And compromises hold together the world. And that's And it's own right okay, right? But you start with a Chihuahua and you

start making compromises and compromise and compromise and at the end you have a camel. And that's not what I wanted, right? I don't have space for that in my flat. Um And this has happened so often, right? And then okay, we come to a compromise and it doesn't really do what it needed to do in the first place anymore, but it ships. Um It's partially available, some browser support, some server supported, but not but not a lot of adoption because nobody's really excited about it anymore because it doesn't have a much strength that it used to have. You iterate and you iterate and you iterate and eventually support goes away. And there's so many of these examples. Do

Not Track is a great example. Content Security Policies, if anybody actually likes to use those, I would love to meet you, but I'm afraid you don't exist. Um, Web Components, that was not a fun one. And who here remembers Speech REP? P3P was a very funny one. So, P3P was an HTTP header that allowed you as the requester, as the browser, to specify your privacy compliant your privacy requirements, your privacy preferences. You can say I don't want this data to be used to be sold, for example. That was an HTTP header, so that meant that in your browser you could just like centrally set the setting and it would just be part of your request header.

This thing would have made complete sense in the the world we live in today, in the world of cookie banners, but at the time there were no cookie banners yet. So, this was a proactive solution to a problem that at the time wasn't an agenda item. Um, what went wrong here is that it got partially commercialized. If you wanted to do this on a Windows server, you had to pay a certain extra license, and it became wildly unpopular as a result. Um, people didn't really use it, and support gradually went away over time. We are now using this There's now this new thing that like really only in the last couple of months became a a

feature in more browsers, um, and it's effectively the same, but not using an HTTP header. It's like privacy control something and other things that Anyway. Um, history is long here, right? I just called out the ones that I know over the top of my head, but the history is long here. Um, and then there there one more bitching slide. I promise I'm going to stop bitching in a second. Um, old tooling. Oh my god, you should try and actually use tooling consortiums. And this is not for bad reasons. Like these people are using old tooling because they like it. No, no, no. Um, it is because they it's often those tools are available open source for free. They have to be

globally available because consortiums are open to the world. So it needs to work both in China and in Japan and in the US and in Europe. And there are honestly aren't that many hosted solutions that do because of things like the Great Firewall etc. So there's many good reasons why that is the case and also privacy compliance is really important thing so self-hosted things make a lot of sense. The other thing is I think a common problem with global time zones. If you can organize a call and people from Asia, the US and Europe need to join, it's usually for Europe on a Friday evening or Thursday evening which then means it's a morning for us here in the US and

then in Asia those people have to stay up really long. Which makes for very badly timed meetings and the result is nobody ever attends. So there is like a big agenda and it's being discussed by two people. And of course they don't make decisions there but some conversations do happen there when nobody's around. You're also not allowed to use any call meeting note taker which is another funny one because of the risk of AI because it might take somebody's job away or whatever. Anyway, for voting participation I find this one funny. Um I don't know the exact stats but there is a significantly larger amount of votes coming from Chinese contributors to standard specs than any other

nationality even combined. So voting participation is super low. So web standards are being voted by here, there and everywhere nobody. Anyway, um system is broken. I think I have achieved that I have Do you want me to more? I can I can do it more of that. Like, okay, great. Um And of course as a result we are going to live in a less consistent web that is less predictable, less safe, less accessible because this thing just doesn't all work anymore. There honestly isn't an easy fix. And this was another great opportunity for me to put a musical-esque feeling into it but anyway, I'm going to try and just do it do it like this. More startups

more startups. More startups. More startups. If startups were to contribute even just 30 minutes per month, which is still a time investment, but it should be doable. We would have not just better representation, but we would have any representation of innovators. I'm currently the only person in these meetings in these rooms often. I'm the only startup often. It's really shocking to me. We are honestly the only people really pushing for modern user experience. We're the ones talking to people. We're the ones doing the end-to-end job and usually are best equipped to give the feedback to people. Um it's also way easier to switch from the no by default attitude because we are startup people, we don't think in no by

default. We think in opportunity. We don't think in oh, this is going to cost me energy. Um that is very important shift in mentality. Um things like it doesn't even have to be a spec. You don't even have to do in like the whole policy, politics, writing spec stuff. Just by you being there and trying to change the energy in the room, you're making a huge difference. And then overall, if you look at a lot of companies out there on the floor including myself, we are finding ourselves having to hack around the spec a lot of the time. Finding ways around existing standards to try and do the thing we need to do. And that's fine because it gets you to

achieve something quick and we got to do that temporarily, but it would be way better if that feedback and that thing actually made it back to adjusted standards because the lot of the standards that we're building on top today and that we're hacking around are outdated and old and are not being changed, but are still a thing and will continue to be a thing. Um basically just continuing on the old ways and finding hack arounds. So, let's start fresh. Let's just imagine that we got to completely start from zero and start a new consortium for a better web with faster execution to get new standards out there and just also better communication. Like how can we get that

done? Well, I think we honestly have a lot to learn learn from startups here. Um we're in San Francisco, the city of Y Combinator. I think Y Combinator is a great example of what you can get when you get an organization of many innovators together to move things along. Um innovation is often something that happens in herds, people talking to each other that are equally invested in building something new. Uh and this city is a great example for that. Um things that startups logically think in a sense that also applies to standards. Who is the ideal customer persona? Like who is the intended user here? What is the actual value we're trying to deliver? What does it take to get this

value actually shipped? And what are the potential downsides we're looking at? For example, accessibility or security risk right? Um thing is that like we are also just better at accepting pushback. At startups, we constantly have to do things that don't scale, but for the right reasons to get certain things to a certain point. Um and that mindset is something that I think we are really missing in standards bodies. And in fact, the feedback loop that we as startups constantly get, you onboard a customer, you notice things are broken in that onboarding process, you immediately go ahead and fix it. That attitude is the fastest way to ship anything of real meaning and that is something that standards simply do not

have. Anyway, I think you get my call to action and again, I'm not affiliated with the W3C. I'm just really trying to make the web better. All of us need to contribute. If you hold any position in security and you care, um it is going to get better by contributing to standards. And it's not that hard. It's just a matter of starting. Going into a meeting once, going into that Slack environment, going into that long threaded email thread and pushing back against people that don't actually use the technology themselves. Making this thing move forward. Driving innovation instead of driving nose. Um and at the end of the day, we're all users of the internet. We kind of owe

this whole open source project that is the internet our opinions and our feedback. And we're often not doing that. I think people tend to forget that this whole concept of open source applies to the very infrastructure that it is built on top of as well. And this is our call to action. And anyway, that was my talk. I actually forgot to do the whole Q&A thingy in the beginning. There was a QR code there, but given how small the room is, we might as well just throw a microphone around. Is that a thing? Can we do that? Does anybody have any questions, remarks, any any things that they want me to like go deeper into in

my bitching session? I can I can happily do that. >> But but you could just be an invited expert. So, what about the mechanism where where the startups immediately say the moment I even have to take the time from the main thing being the main thing, getting customers, getting them happy, to submitting a W3C membership agreement to their own council to see if this is a good idea or not, and doing the patent policy. Already you're like losing people. Yeah. But you know, we're supposed to have a mechanism that has those motivated people involved. How's that going? 100%. So, yeah, the to the point that he made that don't think everybody has this context. You can be a member.

You can openly contribute to some of these work groups, community groups that is, or you can be an invited member. You are a significant expert in the field. We think you would be a real asset to have here. And there you go, we'd like you to join. That would be a great mechanism to invite startups, right? Well, that's currently not being used. But things nobody's asking for at the same time. And so, it is a bit of a cat and mouse problem here. I do believe that the people that are running that organization, which is ultimately like a company, basically, have all the best intentions, but they don't have the data, and it is getting gradually worse

over time. So, as a result, if we wouldn't ask, we wouldn't get. If people were to go knock on Seth's door, and I'm pretty sure he's very open to talk. You can find his email address on the website Seth@w3c.org. Send him an email. Send him an email say, "Hey, look, I'm a startup. I can afford a few minutes every month to help and I want to bring in the web better like to be better, but I can't afford a two grand fee. Um can I be an invited member? I'm pretty sure he'll think about it. These are people that want to make the web better. That's why they took this job. I'm pretty sure they could make

more money elsewhere if they wanted to. Um how do we prevent companies or countries from having outside influence in the longer term uh assuming we can drive more participation? That's a great question. Um the thing is that it ultimately comes down to a voting process. Um and your very concern is uh currently my concern of what is happening right now. As I said, it is not an equally distributed by nation voting system right now because of the lack of uh participation around the world. Um luckily there is outcry when things happen that don't make sense and they get stopped. Uh but that wouldn't be possible without some of these really large US companies. So, my advice is um

how would we solve that? Just have more people contribute and vote. I vote religiously. Um I think it makes a ton of sense to do even if I'm not the most qualified expert on it, I would still try to share my perspective in the concept of votes. Yes. What kind of roles uh active, inactive, experience, uh you know, positions would make valuable attention uh available, you know, addition to to the consortiums or just you know, maybe even just a meaningful watcher like you're saying. Change the energy. Um honestly all. All, literally all of it. If you're an early in career developer noticing that you're bumping into the same specific issues with how certain standards are

built, sometimes I find that really powerful, right? If you come into to computer science world as a total novice, not understanding some of the concepts that we started to use. You are a completely pure person walking into this with new fresh eyes. That can be super valuable. You can be an extremely experienced like engineer, staff level engineer at any company, and your experience would be super valuable. I honestly don't think there is a wrong here. The only thing that I would say is like if you have absolutely no technical understandings, then of course it's not the thing you would be doing. But then I mean people that don't like cooking food wouldn't join a cooking class, right? So

it's sort of that same thing. If this is something that appeals to you, the odds are you are the right person. Um there is no too little or too much experience for this sort of thing. It is really just an element of going in, trying to reason and understand. If you're like crazy opinionated and don't want to don't want to talk to people and just want to push your own thing, well obviously this is not going to work. You're going to waste your time. You're going to get blocked by everybody. Um but overall there is no wrong here. I think contribution is in pos- in general positive. Yep. Um I'm using Internet Explorer 6 and I

can't load this. That was a joke. Um my question is um uh so back in well I mean around that time when we were having that debate about how do we get people to not only develop for IE6, it felt like there was a lot more momentum from the broader tech community. Like let's stop this monopoly. Let's get off of this. Let's promote more web standards, HTML 5 and and all of the what working group. It was a big thing. Um and then since then there have been just tons of um well obviously the world's shifted a lot since then, but I'm just wondering if you have any thoughts on why was it different then or like what

are we missing now that that cuz cuz I think people were talking about this as an issue um during the like uh DOM debates several years ago. Like um it it's come up a whole bunch of times and I'm I'm wondering why it doesn't feel like we have as much push or enough momentum as we did um for this kind of uh movement like The thing is everything comes down to the effort we put in individually, right? So if there's not enough of us going into these debates, then it's going to get worse, right? So there's that. I think it's also important to flag it like we are well, we are and I was going to

say we were but it's still very much a real risk. We are very close to a situation like where we are with operating systems where the people who actually built the operating systems and did the hard work of getting it from zero to one are retired, no longer know how it works and we're just building on top of all that we don't really get, right? And browsers are very much becoming the same thing. The only real contributors to browser internals are all working at Google working on Chromium. And of course there are some people that do that at WebKit cetera but statistically they're insignificant. Open source projects that actually built their own browsers, there's only one,

that's Servo, right? But like if I was currently working on like if I was an open source developer thinking about where I could be most valuable, I would probably be going at and actually building my own like browser from the ground up, not Chromium, not asking Cursor to use Chromium to build a browser. That's really not impressive, you can do that indeed using AI in a weekend but like show your skills where it actually matters most and do the hard work. There's not enough completely native from zero scratch new browsers being built today and I'm honestly worried about how the web is going to improve itself if we're completely building reliance on one company to maintain a

browser engine. So there's that. Um To your point of momentum, it's so hard. Like I think it's The thing is there are multiple of these standards bodies and ultimately if we don't have enough startup contributors to it, it's only going to get worse. That's really the core of it. The community can say what they want and then eventually one of the big players will crack over that pressure but it would be better if startups were to contribute in the first place. It's just faster. Yeah. I I we got time for one more question. Yes. Yep. So, part of it is age and history, right? The W3C was a foundational organization once upon a time that was inspired by

the X Consortium, which is really a manufacturer-led thing for a small number of develop companies to to have a voice. Has its roots in antitrust law in America that says kind of hard for companies to get together and even talk about technology without being accused of a conspiracy, at least back in the '70s. Now you can do whatever you want. Um but in the now we live in a world where kind of if you have half a thought of an idea, throw up a GitHub repo and not much more effort to throw up a new foundation of your own. And we live in a landscape where there is one of the most hilarious talkings out there is the

Linux Foundation landscape of landscapes of foundations at the Linux Foundation. Um yeah, you know, the the MCP thing just blew up a new one, the AI Agents Foundation. I'm trying to navigate OpenSSF. Do you think of an organization that you have had good experiences with? I'm not going to say better or worse, compare, just curious about you know, in this new landscape, what else do you look to and you say, "Hey, that was that was a good experience or some good things to borrow or hybridize from cuz there's now so many more organizations?" No honestly. No, I mean, I'll tell you why. The people that want to move things forward the fastest are naturally put

off by this And I am, too. Like, let's be real. Like, would I spend my time fighting people that don't get it, that are not the user over something that is very obvious to people that actually spend time on it? Sounds like a horrible use of time. But also necessary. So, do I enjoy it? Hell to the no. It would become 10 times more enjoyable if more people would join in with the right attitude, though. Um and to that point, it's what this whole session is about. Please, please, can more startups who have busy agendas and actual meaning, please, can you guys join? Because I'm completely on my own. Um and I'm feeling that more and more every

time I go to those meetings or see the conversations in those in those threads, it's just not following the real world. Like, the world has shifted so much, especially here in San Francisco. You can feel it. Um and the standard is not just years behind, but it feels decades behind. And the arguments are going very much to the nature of is this even a problem? I'm like, we're way past it. That problem was a problem, has been solved by people not following the spec. So, now you can decide what you want to do. You want to update the spec to follow the new reality or we're going to continue arguing over whether or not this is a

problem. Like, it's just ridiculous. Um but yes, um there are many of these other ones. Linux Foundation is another one. To be fair, the Linux Foundation has a lot of different little groups under there, all with their own little subculture, some way faster than others. Uh there's probably there like a few there that are better than others. Um I don't spend enough time with them, to be honest. Um because I went straight to the source, the W3C, the people that well, write the HTTP specs, etc. Um but yeah. Cool. Well, that was it for today. Thank you very much.