Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google no longer providing original URL in AMP for image search results

twitter.com

Post reply on HN
Print view View original

361–370 of 566 posts

Re: Google no longer providing original URL in AMP for image search results

#361

Post by joshuamorton »

tyingq wrote: post #359
joshuamorton wrote: post #349

Earlier quoted context omitted.

So if I understand correctly, your threat model is "Google will inject unwanted JS into a JS blob they host (like the amp.js from Google's CDN) and this will do nefarious (for some definition of nefarious) things to me without me knowing." How is this different than today, where many sites use js from google, either as a cdn or part of the ads infrastructure? I guess you can block some of those, but blocking the jque…

>>what kind of nefarious thing do you fear Google will do Well, the headline is one good example. That google controlled JS is EXACTLY how they removed access to the original URL...on somebody else's page that isn't theirs. "Signed exchanges" doesn't fix that either. It's also how they hijack the back button and swipe events for carousel navigated pages.

> That google controlled JS is EXACTLY how they removed access to the original URL...on somebody else's page that isn't theirs.

No, the Google AMP cache adds the header bar. That isn't added by the Google controlled AMP js. Let me repeat this: The AMP js didn't change. Google's AMP cache implementation changed. (if you disagree with this, please post the diff of the AMP js that removed the url bar, the js is opensource at [0])

> "Signed exchanges" doesn't fix that either.

Yes it does, in two ways:

1. It would prevent Google from mucking with the embedded page at all, like they do now.

2. It would remove the need for me to have the url redirect, since the url bar would point to the original site.

[0]: https://github.com/ampproject/amphtml/commits/master

Re: Google no longer providing original URL in AMP for image search results

#362

Post by snazz »

runawaybottle wrote: post #302
snazz wrote: post #160

Earlier quoted context omitted.

It's an iPhone 8. Safari with content blockers.

Then I mostly don’t believe you. Benchmarks please, I doubt you are unable to load a JavaScript heavy site.

I never said I was unable to load it, I said that the AMP site is noticeably faster. The problem is my currently slow network, not the phone. My phone processor gets the same single-core benchmark speeds as my desktop processor, so that's not the bottleneck.

Re: Google no longer providing original URL in AMP for image search results

#363

Post by asjw »

TechBro8615 wrote: post #34

How does anyone think this is a good idea? It should be clear which news site I am reading when I'm reading an article. Otherwise, how do I know which bias to apply? On iOS, the title bar says "google.com" whether I'm reading an article from CNN.com or WashingtonExaminer.com. Of all the anti-competitive actions google has taken around search results, AMP is by far the worst. I hope they get smacked down for it in the…

I wrote an extension to "unamp" the website of a popular Italian newspaper and as soon it reached a thousand users Google banned it and forced Firefox to do the same (shame on you Firefox)

So I guess worse is better we are supposed to accept it or else they'll police us into accepting it.

Re: Google no longer providing original URL in AMP for image search results

#364

Post by princevegeta89 »

TechBro8615 wrote: post #34

How does anyone think this is a good idea? It should be clear which news site I am reading when I'm reading an article. Otherwise, how do I know which bias to apply? On iOS, the title bar says "google.com" whether I'm reading an article from CNN.com or WashingtonExaminer.com. Of all the anti-competitive actions google has taken around search results, AMP is by far the worst. I hope they get smacked down for it in the…

This amp nonsense has long annoyed everyone and I'm puzzled why it's still around.

It makes everything harder and confuses deeplinking, sharing, identifying sites and general navigation between pages.

Re: Google no longer providing original URL in AMP for image search results

#365

Post by DevKoala »

joshuamorton wrote: post #353
DevKoala wrote: post #344

Earlier quoted context omitted.

Because now every asset you download from the web is a Google tracking resource. Is it really unclear what’s going on? When you perform a GET request for these assets you are being monitored. These requests end up being part of the profile built for you which is used for advertisement targeting and content recommendation. PS: You work for Google. Do you work on this project?

> When you perform a GET request for these assets you are being monitored. You'll only ever retrieve Google AMP cache results from the Google search page, where they were already able to track if you made such a request, since the link you clicked has trackers in it. So from that perspective, nothing changes. > PS: You work for Google. Do you work on this project? No, I work on mostly internal infrastructure. My inte…

> You'll only ever retrieve Google AMP cache results from the Google search page, where they were already able to track if you made such a request, since the link you clicked has trackers in it. So from that perspective, nothing changes.

I am not affected, I don’t use Google search. The problem is for individuals who use Google search and now don’t have an option to avoid in deep tracking. The difference between regular pixel trackers and multiple data points associated with every resource a site serves is immense. I work in ad-tech, not particularly in the identification side, but I started multiple projects in that end. From experience, a regular tracker can be fooled, but you cannot fool every resource request. One of the things I did to identify ad fraud bots was actually drive them to a site in which I controlled every resource. The resource request fingerprint for bots was easily distinguishable from real people. Moreover, some humans exhibited navigation patterns that were distinguishable from other humans. I remember I caught a QA person doing a shoddy job of testing the front end once due to it. That is the kind of power that Google is acquiring as more and more sites choose to use AMPs. It is scary to think that a single identity has that power.

Re: Google no longer providing original URL in AMP for image search results

#366

Post by rsync »

AlexandrB wrote: post #109
0x006A wrote: post #26

AMP really has to go away, its a MITM attack on the internet. Google discontinues so many services, why is AMP not one of them yet?

The worst thing I've seen recently is amp URLs for reddit threads. It's one bad thing (new reddit UI) wrapped in a worse thing (AMP), and getting back to classic reddit takes a lot of gymnastics. The stupid part is that the amp page is indistinguishable from the (new) reddit page (the AMP page comes complete with the "download our app" popup). So I don't see how it's providing any speed/experience benefit.

"The worst thing I've seen recently is amp URLs for reddit threads."

How can I see this very specific example ? I would like to understand exactly what this looks like ...

I am not a reddit user and I don't consume much web content on a phone, which is using Safari on an iPhone ...

Would I need to download google chrome onto my iphone, then do a google search for a reddit thread, then click on that search result ? Or would I see this result in Safari as well ?

Genuinely curious as I would like to recreate this specific result ...

Re: Google no longer providing original URL in AMP for image search results

#367

Post by kohtatsu »

joshuamorton wrote: post #353
DevKoala wrote: post #344

Earlier quoted context omitted.

Because now every asset you download from the web is a Google tracking resource. Is it really unclear what’s going on? When you perform a GET request for these assets you are being monitored. These requests end up being part of the profile built for you which is used for advertisement targeting and content recommendation. PS: You work for Google. Do you work on this project?

> When you perform a GET request for these assets you are being monitored. You'll only ever retrieve Google AMP cache results from the Google search page, where they were already able to track if you made such a request, since the link you clicked has trackers in it. So from that perspective, nothing changes. > PS: You work for Google. Do you work on this project? No, I work on mostly internal infrastructure. My inte…

Would you bat an eye at Google acquiring CloudFlare?

What they're pushing with Amp and the related technologies grants them a near-unavoidable man-in-the-middle position.

(FWIW I am careful to avoid Google properties at a pretty high cost.)

Re: Google no longer providing original URL in AMP for image search results

#368

Post by kbenson »

joshuamorton wrote: post #349
tyingq wrote: post #300

Earlier quoted context omitted.

Combined with that second thing I mentioned (required Google hosted JS), it is total control by Google with no straightforward way for me to detect it, block it or go around it, as I can today.

So if I understand correctly, your threat model is "Google will inject unwanted JS into a JS blob they host (like the amp.js from Google's CDN) and this will do nefarious (for some definition of nefarious) things to me without me knowing." How is this different than today, where many sites use js from google, either as a cdn or part of the ads infrastructure? I guess you can block some of those, but blocking the jque…

> How is this different than today, where many sites use js from google, either as a cdn or part of the ads infrastructure?

It's different because it's a requirement. nytimes.com is moving to phase out all third-party advertising data, so presumably they could design their page such that it only accesses their resources.

With a signed exchange, that would allow them to nicely compartmentalize and contain privacy to their site, if they aren't required to load and run some Google supplied JavaScript. The argument that Google already knows that someone visited the page so it's no big deal is not compelling, since there is a big different in knowing someone clicked to visit a page, and having carte blanche over loading your own code on the page in question.

Can you include the AMP rquiers JS inline such that it implement an AMP spec version, or do you need to load it externally? If you can supply it inline, that's great, and what people would want (as long as it doesn't load additional third party resources). If you can't then you're providing Google with an extra level of control that's not really needed, and that's what people are against.

> (And further, what kind of nefarious thing do you fear Google will do? How likely is it that they will do so, in your opinion?)

If we go forth only considering what we think people will do, and not limiting what they can do, we're destined to be upset with the outcome. If not from Google itself, then in twenty years when someone buys Google, or Google sells off a division that houses information, or there's a breach and it's exposed, or some other company rides on Google's coattails and uses the same precedence to get data but is less trustworthy.

The point is that some people don't want to share this information, and would choose not to do so if there was an easy way to tell when it was being gathered. Fighting against new methods that seek to make it implicit instead of explicit is the only real way to do that.

1: https://www.axios.com/new-york-times-advertising-792b3cd6-4b...

Re: Google no longer providing original URL in AMP for image search results

#369

Post by DevKoala »

thoraway1010 wrote: post #355
DevKoala wrote: post #344

Earlier quoted context omitted.

Because now every asset you download from the web is a Google tracking resource. Is it really unclear what’s going on? When you perform a GET request for these assets you are being monitored. These requests end up being part of the profile built for you which is used for advertisement targeting and content recommendation. PS: You work for Google. Do you work on this project?

DevKoala, I don't think you may realize how much of your online activity is already tracked by google / facebook / instagram. Google's javascript is everywhere, including explicit tracking with analytics, and lots of CDN loads for endless lists of things (js libraries, fonts etc). Their properties also track you, google search, youtube, email. They also make software you might use (chome / android / google maps / goo…

I work in ad tech, with years of experience doing identification and targeting. I understand exactly what is happening.

I wrote a reply to joshuamorton were I expressed my concerns.

Re: Google no longer providing original URL in AMP for image search results

#370

Post by hjek »

lightswitch05 wrote: post #77
TechBro8615 wrote: post #34

How does anyone think this is a good idea? It should be clear which news site I am reading when I'm reading an article. Otherwise, how do I know which bias to apply? On iOS, the title bar says "google.com" whether I'm reading an article from CNN.com or WashingtonExaminer.com. Of all the anti-competitive actions google has taken around search results, AMP is by far the worst. I hope they get smacked down for it in the…

I couldn't agree more that AMP is terrible. I do everything I can to avoid it. Using DuckDuckGo certainly helps, but I will still occasionally stumble on an AMP site. I've created a hosts block list to help me avoid AMP as much as possible. It currently has 3,569 unique domains (works great with a PiHole!). I'm really concerned about Chrome's 'signed exchanges' where they can fake the URL completely. I hope Firefox w…

Even better than blocking AMP is just redirecting to the proper page[0].

[0]: https://addons.mozilla.org/en-US/firefox/addon/amp2html/

Post reply on HN