Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AMP pages displaying your own domain

webmasters.googleblog.com

Post reply on HN
Print view View original

221–230 of 340 posts

Re: AMP pages displaying your own domain

#221

Post by dwild »

sandov wrote: post #31
48309248302 wrote: post #11

This sounds terrible. Does it mean that browsers will begin lying to users and say that the users are visiting the website's server when they are really visiting a restricted version of the website that is hosted in Google's cache? I don't want my content restricted or hosted in Google's cache. AMP doesn't load in a privacy sensitive way. It's on Google's servers and it takes many seconds to load if you have JavaScri…

I didn't even know about "HTTP Exchanges", and I'm more interested than ~98% of the population about this kind of stuff. Showing the name of the "signer" in the address bar, instead of the server where the content is actually hosted goes against decades of browser UI design. Good on Mozilla for marking it as harmful.

This is just semantic.

Do a trace route on any domain and you'll see that the server isn't the one that give you the answer, but some intermediary. Sure in that case when you did the request, the content is fresh and the server answered RIGHT NOW, but that cache still get the content from the server, it's just a bit older.

Re: AMP pages displaying your own domain

#222

Post by e12e »

gregable wrote: post #159
rum3 wrote: post #151

Earlier quoted context omitted.

How does the browser verify that the AMP is up to date?

Good question. The publisher signs an expiration timestamp in the Signed HTTP Exchange. The publisher can choose this timestamp and the browser will not respect signatures with expirations in the past. Note also that the specification requires, and browsers enforce, that the expiration cannot be more than 7 days in the future.

Wouldn't it be better to borrow from HTTP and allow a head request to the original source - with a reply of a current signature?

Isn't this whole exercise really just adapting public key signatures on top of old school caching?

With a http proxy you ask for an url, the proxy fetches or serves on behalf of the owner. This adds some circumvention around the way tls/ssl breaks that type of caching. But it should still be able to do a head-like request for a current signature - with no need to download the content again if it is unchanged?

Re: AMP pages displaying your own domain

#223

Post by tcd »

jefftk wrote: post #182
mtberatwork wrote: post #134

Earlier quoted context omitted.

Well, I wouldn't call this a solution just yet. If you read through the documentation, you'll find that this won't work on shared hosts and requires a TLS certificate "that supports the CanSignHttpEchanges flag. As of April 2019, only DigiCert provides this extension." [1] Plus, as if the lift of transforming HTML into AMP HTML wasn't already big enough for your average web site owner, implementing signed exchanges w…

> as if the lift of transforming HTML into AMP HTML wasn't already big enough for your average web site owner, implementing signed exchanges will be over the head of 99% of the folks building web pages on the Web Converting web pages into AMP isn't something you can automate, but supporting signed exchanges is. You need certificate authorities to support the flag and web servers support the protocol, but if this catc…

Well, it's disappointing DigiCert didn't tell Google to fuck off. I hope this never comes to something like Let's Encrypt, so the vast majority of developers can never use this.

Sometimes, Google needs a gentle nudge from users saying "we don't like this" and hope they reconsider (I doubt it).

Re: AMP pages displaying your own domain

#224

Post by ihuman »

Tepix wrote: post #180

Using the signed exchange mechanism means you allow anyone to serve your content. You will no longer know when it has been served and by whom. Instead, Google will know more about what your users are consuming on your website than you - despite HTTPS! Also, there is no mechanism to limit who is allowed to serve your content for you. I see no technical reason why the content has to be prefetched from Google instead of…

> You will no longer know when it has been served and by whom

I'm OK with publishers knowing less about the people seeing their content.

Re: AMP pages displaying your own domain

#225

Post by bo1024 »

smilliken wrote: post #209
IgorPartola wrote: post #206

I can’t believe there is no way to opt out of AMP as the end user. The UX is so terrible. Often times I will search for something and have a Reddit result come back. When I tap the link, I get the AMP page which: * does not show all comments, often ones I am actually looking for * does not let me collapse comment sections * uses the default white background theme which burns my retinas if I am looking at my phone in…

You won't see AMP if you switch search engines.

Using DuckDuckGo with a backup of !g (send search to google), I don't think I've ever hit an AMP page in search results in my life. Maybe because I only use !g for really technical searches.

Re: AMP pages displaying your own domain

#226

Post by zackbloom »

Tepix wrote: post #180

Using the signed exchange mechanism means you allow anyone to serve your content. You will no longer know when it has been served and by whom. Instead, Google will know more about what your users are consuming on your website than you - despite HTTPS! Also, there is no mechanism to limit who is allowed to serve your content for you. I see no technical reason why the content has to be prefetched from Google instead of…

The reason it has to be prefetched from not-you is to protect the users privacy. Until they click a link it is not considered acceptable to leak their search to the potential destination. Links have to be fetched from a third-party who the search engine trusts not to share the data, that at the moment is Google but will hopefully expand.

Re: AMP pages displaying your own domain

#228

Post by fartcannon »

jefftk wrote: post #182
mtberatwork wrote: post #134

Earlier quoted context omitted.

Well, I wouldn't call this a solution just yet. If you read through the documentation, you'll find that this won't work on shared hosts and requires a TLS certificate "that supports the CanSignHttpEchanges flag. As of April 2019, only DigiCert provides this extension." [1] Plus, as if the lift of transforming HTML into AMP HTML wasn't already big enough for your average web site owner, implementing signed exchanges w…

> as if the lift of transforming HTML into AMP HTML wasn't already big enough for your average web site owner, implementing signed exchanges will be over the head of 99% of the folks building web pages on the Web Converting web pages into AMP isn't something you can automate, but supporting signed exchanges is. You need certificate authorities to support the flag and web servers support the protocol, but if this catc…

How do you personally feel about AMP? It looks like an attempt to make the web a walled garden.

Re: AMP pages displaying your own domain

#230

Post by galaxyLogic »

mrweasel wrote: post #132
albertgoeswoof wrote: post #7

Let’s hope AMP, like most google products, is shut down within the next 2-3 years

What's wrong with it exactly... beside being weird. I'm not a fan of manipulating the URL the way they do with this change, but couldn't you just opt to not use AMP if you don't like it? Ideally people would develop fast sites on their own, but apparently they need the help of Google.

I don't known much about AMP so my question is why can't it be a standard?

If there are some benefits to it why shouldn't those benefits be standardized? Is Google preventing the standardization of AMP?

Post reply on HN