Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 69: “www.” subdomain missing from URL

bugs.chromium.org

Post reply on HN
Print view View original

161–170 of 919 posts

Re: Chrome 69: “www.” subdomain missing from URL

#161

Post by CydeWeys »

uberman wrote: post #105
tschellenbach wrote: post #62

Just updated to see it in action. Seems like a nice improvement for end users. Don't think there is any reason not to do this, other than a nostalgic desire for things to stay the same. Most sites already have a www. to . redirect in place and if you don't its a trivial change.

Why not drop the .com then as well? Most sites are on .com domains after all.

The obvious difference is that that's higher up in the hierarchy rather than lower in it. www.example.com and example.com are controlled by the same entity; example.com and example.foo may well not be.

Re: Chrome 69: “www.” subdomain missing from URL

#162

Post by ben174 »

ozfive wrote: post #43

This and many other changes over a course of a short period of time have caused me to go to Firefox exclusively now. I heard Firefox is going to stop third party cookie tracking altogether. Why not give Google the big finger and use a different browser? Vote with your cold hard actions if you feel so strongly about something.

I would love to, but Firefox just feels more clunky. Not sure what it is, but the scrolling doesn't feel native to me (MacOS, Magic Trackpad and Logitech Mouse)

Re: Chrome 69: “www.” subdomain missing from URL

#163

Post by ars »

DamnInteresting wrote: post #22

If the browser uses some technique to detect that www.domain.com is functionally identical to domain.com for a given domain, then I don't see a serious problem with this. But if they are short of that certainty, they're obscuring a critical part of the URL, and harming usability (e.g., if I want to jot down a site's URL for later use, I might get something unexpected).

From one of the comments there:

http://www.pool.ntp.org vs http://pool.ntp.org ?

One takes you to the website about the project, the other goes to a random ntp server.

Re: Chrome 69: “www.” subdomain missing from URL

#164

Post by dragonwriter »

wpietri wrote: post #100
soared wrote: post #60

Earlier quoted context omitted.

99.9% of users have no idea what any of the words you just said mean. The change was made for them, not for you (the .1%)

You're missing jwr's point. He's arguing that this is harmful for users, especially the ones who don't know what the words mean. If I were solving this, I'd instead push to eliminate "www" altogether, not sweep it under the rug. It was useful circa 1996, when users might plausibly be using something other than the WWW with a browser. But it has become entirely vestigial.

> If I were solving this, I'd instead push to eliminate "www" altogether, not sweep it under the rug. It was useful circa 1996, when users might plausibly be using something other than the WWW with a browser.

No, it was useful when abstracting machine identity from domain names such that there was a many-to-many relationship was less common, so “www” was the most specific domain name element for the server being accessed. (And a system that needed more than one server might have a homepage on “www”, and various subsites and apps on “www1”, “www2”, etc.)

OTOH, there may be places that still allocate servers that way for simplicity.

Re: Chrome 69: “www.” subdomain missing from URL

#165

Post by eam »

soared wrote: post #60
jwr wrote: post #30

This is idiotic and harmful. We already lost information about the protocol, because somebody believed it is "too complex" for users. Now we're losing other parts of the URL. It's making a joke of the SSL/TLS padlock, too — what exactly is the padlock supposed to tell me? It used to signify that a "known authority" certified that I'm connected to whatever I see in the URL bar. But now that browsers take liberties wit…

99.9% of users have no idea what any of the words you just said mean. The change was made for them, not for you (the .1%)

Well, might as well drop then entire stuff after the domain.com/{dump all this out} (the file path) since non-techy people don't really care about it. All they care is about clicking links and navigating...

/end sarcasm

Re: Chrome 69: “www.” subdomain missing from URL

#166

Post by dagenix »

tinus_hn wrote: post #75
soared wrote: post #60

Earlier quoted context omitted.

99.9% of users have no idea what any of the words you just said mean. The change was made for them, not for you (the .1%)

So they can be hacked in serene bliss. A stupid decision.

Hacked how?

Re: Chrome 69: “www.” subdomain missing from URL

#167

Post by dwheeler »

shawn wrote: post #47

Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number…

> This: Every character in the URL bar unrelated to the apex name is a deadly distraction.

I'm not convinced. When your tools lie you (as this does), you are LESS likely to notice a problem when you're busy. Another way to view this approach is:

> Every character in the URL bar different from the actual URL is a deadly lie.

Distraction is a problem, I totally agree, but other methods like Firefox's color-shading seem to work just fine.

Re: Chrome 69: “www.” subdomain missing from URL

#168

Post by berbec »

eam wrote: post #165
soared wrote: post #60

Earlier quoted context omitted.

99.9% of users have no idea what any of the words you just said mean. The change was made for them, not for you (the .1%)

Well, might as well drop then entire stuff after the domain.com/{dump all this out} (the file path) since non-techy people don't really care about it. All they care is about clicking links and navigating... /end sarcasm

Doesn't Safari on macos do this?

Re: Chrome 69: “www.” subdomain missing from URL

#169

Post by uberman »

wpietri wrote: post #139
uberman wrote: post #127

Earlier quoted context omitted.

Why not drop .com then as well? Most sites are on .com domains after all. It is exactly the same issue. A domain is a domain. Google is arbitrarily dictating your CNAME from the user's perspective. What if you don't serve your site off of mysite.com is google going to automatically try again at www.mysite.com? What if you have distinct content at both domains? This decision is stupid.

It's not the same issue at all, in that domains with different suffixes are controlled by different people while foo.com and www.foo.com are controlled by the same people. If you have an example of somebody who needs to serve different web content for foo.com and www.foo.com, I look forward to seeing it. But I've never seen one, and when I've seen it happen accidentally it's due to idiocy.

I realize it is an important distinction, I'm glad you do as well.

Just as ftp.mysite.com is not mysite.com and mysite.com in not mysite.io and http://mysite.com is not https://mysite.com. You get the point.

They are all different and important in my opinion. Any argument that hiding the "www." part makes it easier for the user is equally applicable (and wrong) to ".com"

Re: Chrome 69: “www.” subdomain missing from URL

#170

Post by Sohcahtoa82 »

fmpwizard wrote: post #83
shawn wrote: post #47

Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number…

if the idea is to protect users so that you don't end up clicking on https://news.ycombinator.com.myhackerdomain.com , you then open the attack of a platform where they offer custom subdomains, and you have https://original.blogger.com and then https://fake-original.blogger.com if I make them look the same, and the address will hide the subdomain, it looks like a step backwards in securing the web now, imagine the ac…

Only supposed "trivial" subdomains are hidden, such as www. and m.

Anything else is still shown. fake-original.blogger.com will still show up as fake-original.blogger.com because fake-original. isn't a trivial subdomain.

I still think it's a stupid move, though. It's a simplification that is incredibly unnecessary and may be harmful when dealing with the rare site that doesn't treat www.domain.com and domain.com as the same.

Post reply on HN