Live data from Hacker News

W3C slaps down Google's proposal to treat multiple domains as same origin

theregister.com

11–20 of 128 posts

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#11

How did w3c get such power to “slap down” google. If users can’t access gmail / YouTube etc, they will be ignoring the w3c. Another workaround if google can’t try this in chrome (it can) do cookies on a google sub domain (yt.google.com etc)

Users can't ignore W3C. Browser makers can.

This "feature" would open up for tracking using today's modern analysis systems with year 2000 privacy protections.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#12
post #10
post #7

Earlier quoted context omitted.

Correction: it's the single browser vendor that draws the straws now. And it's Google. They've literally stopped caring about any objections to any of their proposals and just ship them.

Just look at Project Fugu. Google is putting the implementation first, the spec to "standards wash" their implementation comes later. And if WHAT WG doesn't want to play along (and why wouldn't they? most browser vendors are now downstream from Chromium so they get the implementation by default) they can just leave it in as "experimental" with a "draft" spec. W3C doesn't really get a say in this.

Even the washing is so bad now, that it doesn't even matter:

- The spec we're discussing was "proposed" sometime in 2019. Here's a comment from WebKit on March 27 2020:

--- quote ---

I notice that this proposal still exists only in a random personal repo. Could it please be contributed to an appropriate standards or incubation group?

--- end quote ---

At sometime they did move it to the appropriate group

- WebHID that is now shipped in Chrome. They asked for Mozilla's position, and Mozilla couldn't even understand the proposal: https://github.com/mozilla/standards-positions/issues/459

And this keeps happening over and over and over and over again.

Their reaction when they are called out? When Mozilla and Safari flat-out refused to implement Constructible StyleSheets as they were spec'ed, Chrome still released them (because their own devs from lit-html relied on them), and said https://twitter.com/slightlylate/status/1220451799032877057

--- quote ---

We often lead, balancing risk/reward rather than demanding a particular point in an arbitrary process.

Leadership is rather the point of having an engine team, after all.

--- end quote ---

That is what they call "leadership".

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#13
post #10
post #7

Earlier quoted context omitted.

Correction: it's the single browser vendor that draws the straws now. And it's Google. They've literally stopped caring about any objections to any of their proposals and just ship them.

Just look at Project Fugu. Google is putting the implementation first, the spec to "standards wash" their implementation comes later. And if WHAT WG doesn't want to play along (and why wouldn't they? most browser vendors are now downstream from Chromium so they get the implementation by default) they can just leave it in as "experimental" with a "draft" spec. W3C doesn't really get a say in this.

This isn't any different than most of the internet standard development. "Rough consensus and running code". Most of the internet-drafts and RFCs start out life as prototype implementations, instead of writing specs first, experimental prototypes are developed, and the spec is extracted out of the winners.

People are acting like internet and web specs start life as a standards doc, it's iterated on until finalized, and then vendors start implementing it. That's very far from the truth, and I'd actually say harmful, as design by committee without real world experience often turns out terrible.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#14
post #2

What a weird coincidence that this would really help let's say a company that used google.com as well as google.co.uk and doubleclick.com as their "first party" set. Good that W3C stopped it.

W3C doesn't really have any real power over what happens in the internet today. It's browser vendors associated with WHATWG that draw the straws now.

well I mean if Google shipped something in the browser that is now pretty much the only option that really helped their other business interests without getting standards imprimatur that might end up being anti-trust fodder.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#15
post #10

Earlier quoted context omitted.

Just look at Project Fugu. Google is putting the implementation first, the spec to "standards wash" their implementation comes later. And if WHAT WG doesn't want to play along (and why wouldn't they? most browser vendors are now downstream from Chromium so they get the implementation by default) they can just leave it in as "experimental" with a "draft" spec. W3C doesn't really get a say in this.

This isn't any different than most of the internet standard development. "Rough consensus and running code". Most of the internet-drafts and RFCs start out life as prototype implementations, instead of writing specs first, experimental prototypes are developed, and the spec is extracted out of the winners. People are acting like internet and web specs start life as a standards doc, it's iterated on until finalized, a…

> That's very far from the truth, and I'd actually say harmful, as design by committee without real world experience often turns out terrible.

Google, however, actively ignores a lot of input, including full-on objections from other browser vendors (who do have real-world experience).

Designed by IE, sorry, Chrome, alone is just as bad.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#16
post #9

Earlier quoted context omitted.

W3C doesn't really have any real power over what happens in the internet today. It's browser vendors associated with WHATWG that draw the straws now.

Given Chrome's market share, that is mostly Google. The irony that IE fighters are the same that helped Google reached their position, because "developer tools" and "don't like FF UI changes". Now don't complain, how is it again? Ah, Chrome is available as open source so it isn't comparable to IE.

Chromium is open source, not Google Chrome.

And much of the documentation about Chromium and V8 is not public.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#17

Hmmm, what stops Google from doing it anyway? Chrome is the de-facto standard nowadays with every other browser being under 10% market share except Safari holding out around 20%.

Depends what sites you look at - for many consumer sites in the UK Chrome / Safari split on mobile is close to equal and 60%+ of visitors are on mobile Chrome not being available on iOS is good from an anti-monoculture perspective but not so good from a browser feature perspective

FireFox just follows in the steps of Chrome now. Whatever Google decides Firefox will just go along with it.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#18
post #17

Earlier quoted context omitted.

Depends what sites you look at - for many consumer sites in the UK Chrome / Safari split on mobile is close to equal and 60%+ of visitors are on mobile Chrome not being available on iOS is good from an anti-monoculture perspective but not so good from a browser feature perspective

FireFox just follows in the steps of Chrome now. Whatever Google decides Firefox will just go along with it.

As far as consumer usage goes Firefox is effectively dead

It's rare that see FF usage above 1% on any of my customers' sites and I think it's only at something like 2% on gov.uk

Of course there's a debate to be had over how much FF users blocking analytics affects the numbers but the numbers tie up with the log mining I've done too

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#19

Earlier quoted context omitted.

W3C doesn't really have any real power over what happens in the internet today. It's browser vendors associated with WHATWG that draw the straws now.

well I mean if Google shipped something in the browser that is now pretty much the only option that really helped their other business interests without getting standards imprimatur that might end up being anti-trust fodder.

Why do you think Firefox isn't an option? Firefox is great.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#20
post #9

Earlier quoted context omitted.

Given Chrome's market share, that is mostly Google. The irony that IE fighters are the same that helped Google reached their position, because "developer tools" and "don't like FF UI changes". Now don't complain, how is it again? Ah, Chrome is available as open source so it isn't comparable to IE.

Chromium is open source, not Google Chrome. And much of the documentation about Chromium and V8 is not public.

> And much of the documentation about Chromium and V8 is not public.

Nearly all the documentation is public... Private stuff is mostly accidentally created google docs where the engineer has selected "anyone within google.com with the link" instead of "anyone with the link". Anytime I request one of those documents be opened up, it has been done within a matter of hours.

Post reply on HN