Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google proposed Web Bundles could threaten the Web as we know it

ghacks.net

Post reply on HN
Print view View original

41–50 of 84 posts

Re: Google proposed Web Bundles could threaten the Web as we know it

#41

Post by stefan_ »

tmd83 wrote: post #5

I am really curious what's the general opinion on Googler's as a web developer. I have seen a long while ago some nice articles from Google about site optimization. Do they even follow any of their original advice or Google basically keep doing over engineered stuff fixed by adding another set of over engineered staff? Let's talk gmail. I just refreshed the window and it did close to 400 request, ~8MB download which…

GMail is literally the interface where you delete a mail, go to close the tab and a fucking modal popup appears because there are still ill-specified network requests in flight. It is so unbelievably bad.

Re: Google proposed Web Bundles could threaten the Web as we know it

#42

Post by cflat »

judge2020 wrote: post #40
cflat wrote: post #38

Let’s call a spade a spade. The only real world problem that WebBundles (and Signed Exchanges) really solve is to allow AMP to impersonate your website. Google wants all the click data and the click through navigation data about users (by way of passive logs) so they can sell more ads. There are no other real world problems that web bundles solve.

Links on the page are the same as before signed, so the only actual problem with them is not being able to change/delete the documents hosted elsewhere immediately.

Yea, but the web server delivering them is now google. Google now gets the access logs and using the persistent tls socket can follow the users activity. Sure the content is signed, but the delivery is no longer private.

Re: Google proposed Web Bundles could threaten the Web as we know it

#43

Post by Spivak »

cflat wrote: post #38

Let’s call a spade a spade. The only real world problem that WebBundles (and Signed Exchanges) really solve is to allow AMP to impersonate your website. Google wants all the click data and the click through navigation data about users (by way of passive logs) so they can sell more ads. There are no other real world problems that web bundles solve.

The real world problem web bundles solve is distributed caching. Right now sites have pick one or a few CDNs and have a trust relationship with them and allow them to impersonate your site.

Web bundles changes this relationship so that anyone can cache sites if it benefits them to do so. If you share a link on Twitter or Facebook or Discord or Slack they can cache the page on their servers and deliver it through the connection you already have open to them.

Web Bundles also open the door for network-local caches that don’t require MitM or trusting the cache.

Re: Google proposed Web Bundles could threaten the Web as we know it

#44

Post by Spivak »

cflat wrote: post #42
judge2020 wrote: post #40

Earlier quoted context omitted.

Links on the page are the same as before signed, so the only actual problem with them is not being able to change/delete the documents hosted elsewhere immediately.

Yea, but the web server delivering them is now google. Google now gets the access logs and using the persistent tls socket can follow the users activity. Sure the content is signed, but the delivery is no longer private.

Because of CDNs the delivery was never all that private to begin with.

Re: Google proposed Web Bundles could threaten the Web as we know it

#45

Post by drewbug01 »

jasode wrote: post #29

Fyi... Web Bundles and Signed HTTP Exchanges are confusing topics so I think it's worth reading 2 previous threads with comments from 2 Google employees (spankalee, jefftk) [1]. One may still choose to discount their explanations because they may be biased sources but I still think everyone should try to understand what they're saying. Hopefully, being familiar with the technical details will elevate the discussion s…

> Hopefully, being familiar with the technical details will elevate the discussion so people who disagree can point out specific and concrete technical flaws

Asserting that an elevated discussion should center only on technical flaws and disagreements is a myopic way to look at a topic.

There’s more to the web than the technology used to power it. How a technology is used, and what it enables (good or bad) is an appropriate topic for this forum and constitutes elevated discussion.

Re: Google proposed Web Bundles could threaten the Web as we know it

#46

Post by jimbobimbo »

Web bundles look like a great thing for Electron and PWA like scenarios, specifically due to signature support. We had to drop service workers and reinvent the wheel with APPX (basically a signed ZIP file) in one of our apps, to ensure code integrity.

Re: Google proposed Web Bundles could threaten the Web as we know it

#47

Post by cflat »

Spivak wrote: post #44
cflat wrote: post #42

Earlier quoted context omitted.

Yea, but the web server delivering them is now google. Google now gets the access logs and using the persistent tls socket can follow the users activity. Sure the content is signed, but the delivery is no longer private.

Because of CDNs the delivery was never all that private to begin with.

CDNs are a known commodity with business relationships. You can’t have an unknown CDN in the mix. They are an extension of your infrastructure and you can control if they are or aren’t in the path of control. They key here is that there is also a legal and business relationship.

Re: Google proposed Web Bundles could threaten the Web as we know it

#48

Post by jeroenhd »

Is there anything in the web bundle standard that forces outdated pages to be refreshed? The spec seems to say little more than "detecting stolen keys is not our problem".

I can imagine this being a problem when news stories turn out to be false alarm and Google happily keeps serving the original content instead of the corrected content.

There's also a risk of vulnerability here, as getting a signed package might very well be used to host phishing pages on web caches.

Re: Google proposed Web Bundles could threaten the Web as we know it

#49

Post by cflat »

Spivak wrote: post #43
cflat wrote: post #38

Let’s call a spade a spade. The only real world problem that WebBundles (and Signed Exchanges) really solve is to allow AMP to impersonate your website. Google wants all the click data and the click through navigation data about users (by way of passive logs) so they can sell more ads. There are no other real world problems that web bundles solve.

The real world problem web bundles solve is distributed caching. Right now sites have pick one or a few CDNs and have a trust relationship with them and allow them to impersonate your site. Web bundles changes this relationship so that anyone can cache sites if it benefits them to do so. If you share a link on Twitter or Facebook or Discord or Slack they can cache the page on their servers and deliver it through the…

This feels contrived. Rarely do I, as a brand or content creator, want it circulating without my control. It doesn’t make business sense.

Re: Google proposed Web Bundles could threaten the Web as we know it

#50

Post by noisy_boy »

The only answer is to not click on ads. Do your research via review videos/amazon etc (I know that they are/could be indirect advertisements but atleast the creators get some sponsorship money). Then go to the brick and mortar shop, check it out and then, here is the kicker, pay the extra $5 bucks to buy from them.
Post reply on HN