BSidesSF 2026 - Web standard consortiums are a game with Chrome as the monopoly... (Simon Wijckmans)

### Overview In this BSidesSF presentation, Simon Wijckmans, founder and CEO of client-side web security startup Seaside, discusses the internal dynamics and systemic flaws of web standard consortiums, focusing specifically on the World Wide Web Consortium (W3C). While acknowledging the historical importance of standards bodies envisioned by Tim Berners-Lee and praising Google's contributions, Wijckmans argues that the modern web standards process is heavily dominated by large tech corporations—particularly Chromium's vast market presence—and plagued by misaligned incentives, bureaucratic friction, and a lack of real-world operational perspective.

### Key Topics - **Consortium Composition and Dominance:** Large tech companies like Google, Microsoft, and Meta dominate working groups and meetings (e.g., Google often representing roughly 40% of attendees in rooms at major W3C events). Because these organizations have the headcount and capital to participate, early-stage innovators and startups are virtually absent. - **The 'Default to No' Mentality:** Participants in standards bodies frequently encounter incentives to reject new ideas or stall progress. Saying 'no' or raising pedantic objections requires less work and creates fewer obligations, resulting in stagnation. - **Disconnect from Production Reality:** Many individuals writing and debating specifications do not deploy or maintain these technologies in high-traffic production environments. Practical security tools like Content Security Policy (CSP) illustrate how specs can become cumbersome when crafted without pragmatic user empathy. - **The Comment Circus and Compromise Traps:** The path to shipping a standard—spanning browser vendors, CDNs, and web developers—often involves 18+ months of debate over naming conventions, bikeshedding syntax, or dismissing features as 'anti-patterns'. The resulting compromises turn focused proposals into unwieldy specifications that lose adoption or eventually get abandoned (e.g., Do Not Track, P3P). - **Structural and Operational Hurdles:** Consortiums rely on outdated, self-hosted tooling to comply with global accessibility and firewalls, face extreme time-zone friction across the US, Europe, and Asia, and suffer from skewed voting participation.

### Technical Details - **Browser Monoculture:** The dominance of the Chromium engine creates a de facto standard where non-Chromium implementations struggle, and CDNs or developers hesitate to adopt features unless Google backs them. Wijckmans points out that independent from-scratch browser engines are extremely rare (citing Servo as a lone open-source example). - **Protocol and Header Examples:** The speaker references real-world protocols and header specifications to highlight standards pitfalls: - *Referer Header:* A prime historical example of naming flaws persisting indefinitely. - *CSP, CORS, and SSL/TLS:* Essential security controls frequently criticized during development as performance hits or 'anti-patterns'. - *P3P (Platform for Privacy Preferences Project):* An early HTTP header designed for user privacy preferences that failed due to commercialization (licensing requirements on Windows servers) and lack of contemporary urgency, though modern mechanisms are now re-implementing similar goals. - *Workarounds:* Because standards lag behind modern development needs, companies frequently build hacks around outdated specifications rather than waiting for formal updates.

### Takeaways Wijckmans issues an urgent call to action for startups, practitioners, and security professionals to participate in standards bodies, even committing as little as 30 minutes a month or seeking invited expert status. By bringing fresh perspectives, real-world user empathy, and a bias toward execution, smaller companies can counterbalance corporate inertia, challenge the 'default to no' culture, and ensure the web remains open, secure, and modern.