Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google proposed Web Bundles could threaten the Web as we know it

ghacks.net

Post reply on HN
Print view View original

61–70 of 84 posts

Re: Google proposed Web Bundles could threaten the Web as we know it

#61

Post by jlokier »

geofft wrote: post #21
otterley wrote: post #13

Earlier quoted context omitted.

Browsers like Safari are increasingly enabling privacy features that, among other techniques, block third party cookies by default. So this could be Google’s way of reacting to this change.

I don't see how. Web bundles don't affect whether a cookie is considered third-party or not. Either the content is provided and signed by the actual website, which cannot place cookies for the advertiser's domain, or it's provided and signed by the advertiser, at which point it would be subject to blocking just like normal web traffic from the advertiser. Is this any different with bundles?

The third-party cookie will be blocked, but when both sites are served via the same proxy server, over the same TLS/QUIC connection, the third-party can get similar tracking information they would have had with a cookie, without needing a cookie. It's not exact, but it's good enough for inference.

Re: Google proposed Web Bundles could threaten the Web as we know it

#62

Post by geofft »

TekMol wrote: post #52
geofft wrote: post #25

Earlier quoted context omitted.

> But the benefit for Google would be that if they deliver the bundle, they would know that their ads are in there. Heck, they would know everything that is in there. Is this a problem for Google currently? 1. They already get loaded/notified for the ads themselves. Do they have a problem with sites claiming they're serving ads and not doing so? (Wouldn't those sites just not get paid?) 2. They'd be serving this in r…

They already get loaded/notified for the ads themselves Because the ads are loaded from their servers. Which makes it easy to block them. A simple text or image in the website would currently not be tracked by Google. But if they deliver it, they can track it.

In order to do that, you'd need a change on the website's server to load and embed a Google ad into the web bundle. But if you could do that, you could just make a change on the website's server to render a Google ad into a normal web page - it's a less complicated change, and it can be done right now without adding a new feature to every browser.

I also don't really follow the attack that Google is supposedly trying to protect itself from. Is it trying to track whether websites that have signed up for Google ads are actually serving those ads to users? (Why would they care about that? If ads aren't being served, websites aren't making money.) Is it trying to track whether ads are showing up on users' screens and not being blocked by an ad-blocker? (Then it doesn't make a difference if Google views a signed web bundle or injects a script to monitor the page, and again, they're already injecting a script.) If a Google script is blocked, isn't the answer to track it as "zero" - i.e., what's the problem with (potentially) more ads being shown than Google knows about?

Re: Google proposed Web Bundles could threaten the Web as we know it

#63

Post by jsnell »

drewbug01 wrote: post #56
jhall1468 wrote: post #55

Earlier quoted context omitted.

I think you misunderstood the point you were replying to. The idea is that you can’t really have a discussion about what it enables or how it’s used unless you already understand the technical details. And that shows as a lot of the comments/blog posts about this topic are using underlying technical assumptions that are entirely incorrect.

The plain language of the comment doesn’t say that: > so people who disagree can point out specific and concrete technical flaws That’s the basis of my reply. I think you have a good point; but it isn’t what the parent said.

The criticism the original post has of WebBundles is fundamentally technical. All of their privacy and anti-adblocker claims stem from the idea that the bundles have special URL randomization powers that the current one-resource-per-request model can't replicate.

If that technical basis is incorrect, the whole thing just collapses. There's nothing left. Not allowing disproving the technical basis of these kinds of posts would mean that we have to just accept conspiracy theories at face value. That does not seem like a healthy outcome.

(Or to put it another way: you wanted to discuss "how this technology will be used". But how can we possibly have that discussion without agreeing on "what the techology can do" first?)

Re: Google proposed Web Bundles could threaten the Web as we know it

#64

Post by Spivak »

cflat wrote: post #49
Spivak wrote: post #43

Earlier quoted context omitted.

The real world problem web bundles solve is distributed caching. Right now sites have pick one or a few CDNs and have a trust relationship with them and allow them to impersonate your site. Web bundles changes this relationship so that anyone can cache sites if it benefits them to do so. If you share a link on Twitter or Facebook or Discord or Slack they can cache the page on their servers and deliver it through the…

This feels contrived. Rarely do I, as a brand or content creator, want it circulating without my control. It doesn’t make business sense.

This feels like such a weird stance. I can’t imagine someone saying something to the effect of “I don’t want my DNS records just circulating without my control.” This isn’t like AP giving CNN republishing rights, this is getting a magazine from the stand at the convenience store rather than having going to the Condé Nast corporate HQ.

Like it’s your site, exactly as it would be if it was delivered by your server just delivered by someone who already had a copy on hand rather than fetching a new one every time. This is what HTTP proxies used to do, what DNS caches and browsers still do. TLS broke web caches because TLS secured the connection instead of the content.

Re: Google proposed Web Bundles could threaten the Web as we know it

#65

Post by fartcannon »

bogwog wrote: post #60

Google should just fork the web already. Let them create their own private platform and do whatever they want. The massive control Chrome and Android gives them means they can do whatever they want already, but at least with a private platform they won’t have to fight people and deal with the negative PR of doing evil stuff. And then the rest of us who like privacy and competition and ad blockers can use the “legacy”…

Then they'll just pay a few journalists to run a couple hit pieces on the open web, saying it's a place where people who kick puppies reside.

Re: Google proposed Web Bundles could threaten the Web as we know it

#66

Post by dlubarov »

jlokier wrote: post #61
geofft wrote: post #21

Earlier quoted context omitted.

I don't see how. Web bundles don't affect whether a cookie is considered third-party or not. Either the content is provided and signed by the actual website, which cannot place cookies for the advertiser's domain, or it's provided and signed by the advertiser, at which point it would be subject to blocking just like normal web traffic from the advertiser. Is this any different with bundles?

The third-party cookie will be blocked, but when both sites are served via the same proxy server, over the same TLS/QUIC connection, the third-party can get similar tracking information they would have had with a cookie, without needing a cookie. It's not exact, but it's good enough for inference.

Assuming that the third party in this scenario is distinct from the party serving the bundle, they wouldn't be involved in the TLS/QUIC connection, right?

So it seems like a third party wouldn't even know that their resource was delivered, unless the party delivering the bundle notified them, or their script makes a separate request to their own server. (And those are options already, so AFAIK bundles wouldn't give third parties any new capabilities.)

Re: Google proposed Web Bundles could threaten the Web as we know it

#67

Post by jariel »

Spivak wrote: post #64
cflat wrote: post #49

Earlier quoted context omitted.

This feels contrived. Rarely do I, as a brand or content creator, want it circulating without my control. It doesn’t make business sense.

This feels like such a weird stance. I can’t imagine someone saying something to the effect of “I don’t want my DNS records just circulating without my control.” This isn’t like AP giving CNN republishing rights, this is getting a magazine from the stand at the convenience store rather than having going to the Condé Nast corporate HQ. Like it’s your site, exactly as it would be if it was delivered by your server just…

It's not weird to reject arbitrary complexity.

The most important issues is the 'lack of value' - not anything else.

Complexity compounds to imbue cost geometrically, we don't need stuff 'because', we need stuff that solves real problems.

Re: Google proposed Web Bundles could threaten the Web as we know it

#68

Post by cflat »

Spivak wrote: post #64
cflat wrote: post #49

Earlier quoted context omitted.

This feels contrived. Rarely do I, as a brand or content creator, want it circulating without my control. It doesn’t make business sense.

This feels like such a weird stance. I can’t imagine someone saying something to the effect of “I don’t want my DNS records just circulating without my control.” This isn’t like AP giving CNN republishing rights, this is getting a magazine from the stand at the convenience store rather than having going to the Condé Nast corporate HQ. Like it’s your site, exactly as it would be if it was delivered by your server just…

DNS is not content.

HTTP caches were always problematic from a business perspective. Great for downloading large binaries (installs) but problematic when they don’t expire as expected, or if content needs to change for contractual reasons.

Re: Google proposed Web Bundles could threaten the Web as we know it

#69

Post by jlokier »

dlubarov wrote: post #66
jlokier wrote: post #61

Earlier quoted context omitted.

The third-party cookie will be blocked, but when both sites are served via the same proxy server, over the same TLS/QUIC connection, the third-party can get similar tracking information they would have had with a cookie, without needing a cookie. It's not exact, but it's good enough for inference.

Assuming that the third party in this scenario is distinct from the party serving the bundle, they wouldn't be involved in the TLS/QUIC connection, right? So it seems like a third party wouldn't even know that their resource was delivered, unless the party delivering the bundle notified them, or their script makes a separate request to their own server. (And those are options already, so AFAIK bundles wouldn't give t…

In the scenario, the third party is the advertising broker, Google, who are also the entity serving the signed bundle.

Re: Google proposed Web Bundles could threaten the Web as we know it

#70

Post by dlubarov »

jlokier wrote: post #69
dlubarov wrote: post #66

Earlier quoted context omitted.

Assuming that the third party in this scenario is distinct from the party serving the bundle, they wouldn't be involved in the TLS/QUIC connection, right? So it seems like a third party wouldn't even know that their resource was delivered, unless the party delivering the bundle notified them, or their script makes a separate request to their own server. (And those are options already, so AFAIK bundles wouldn't give t…

In the scenario, the third party is the advertising broker, Google, who are also the entity serving the signed bundle.

Hm okay, but then wouldn't Google get the same fingerprinting data (IP, headers, TLS params) in either scenario, whether they're serving a bundle or just a script?
Post reply on HN