Doesn't seem that different from how the web works currently, just less hacky then existing solutions. Am i missing something?
Its not like the status quo is that two separate domains run by same entity can't talk to each other.
W3C slaps down Google's proposal to treat multiple domains as same origin
21–30 of 128 posts
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#22Earlier quoted context omitted.
well I mean if Google shipped something in the browser that is now pretty much the only option that really helped their other business interests without getting standards imprimatur that might end up being anti-trust fodder.
Why do you think Firefox isn't an option? Firefox is great.
for the purposes of anti-trust law somewhere around 3% market share isn't really considered an option.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#23Earlier quoted context omitted.
Just look at Project Fugu. Google is putting the implementation first, the spec to "standards wash" their implementation comes later. And if WHAT WG doesn't want to play along (and why wouldn't they? most browser vendors are now downstream from Chromium so they get the implementation by default) they can just leave it in as "experimental" with a "draft" spec. W3C doesn't really get a say in this.
This isn't any different than most of the internet standard development. "Rough consensus and running code". Most of the internet-drafts and RFCs start out life as prototype implementations, instead of writing specs first, experimental prototypes are developed, and the spec is extracted out of the winners. People are acting like internet and web specs start life as a standards doc, it's iterated on until finalized, a…
The difference is Chrome moves ahead anyway. This is why I'm calling it "standards-washing" -- if you take away the RFC it's no different from the browser wars era or Apple's proprietary CSS extensions for Safari back in the day.
How the standards process is supposed to work is something like this:
1. Someone creates a rough proposal. Discussion happens.
2. Someone creates a proof of concept toy implementation. Discussion happens.
3. Consensus is reached, a spec is written.
4. Other vendors implement the spec. Spec stabilizes with implementers' feedback.
How it now happens is like this:
1. Google writes feature proposal.
2. Google implements the feature behind a server-side flag.
3. Google creates training materials for developers to use the "upcoming" feature.
4. Optional: Google writes an actual spec.
5. Google either scraps the feature or makes it available without the flag.
Of course they "gather feedback" and "ask for input" but concerns from Mozilla routinely get ignored and implementation progresses regardless. It's entirely up to Google and they'll ship it if they like it. The "standard" just becomes a fig leaf.
This isn't entirely new, but the "standards-washing" gives it the appearance of being consensus-driven when in reality it's just more proprietary vendor extensions with marginally better documentation.
Google has an explicit agenda of what the future of the web should look like and they're taking Chrome down that route regardless of whether other vendors agree or not. There's nothing necessarily wrong with this, but consensus-driven or "open standards" this is not.
Contrast this with WHAT WG's promise in the early HTML 5 days: user concerns trump author concerns trump implementer concerns trump academic concerns. Google has decided that it is the sole authority on what users want and uses that to justify ignoring anyone else's concerns or objections.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#24(googler here, but this is my opinion)
I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself.
For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for several unrelated parties, think hosting a store on Shopify (1 domain for N parties). This is so ambiguous that even inside the browser you have two different implementations on the way you handle this attribution, one for cookies and one for Single-Origin Policy.
There's a good write up about this problem at https://github.com/sleevi/psl-problems. Sometimes I wonder how the web got here with the amount of kludge that we have to carry.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#25Earlier quoted context omitted.
Depends what sites you look at - for many consumer sites in the UK Chrome / Safari split on mobile is close to equal and 60%+ of visitors are on mobile Chrome not being available on iOS is good from an anti-monoculture perspective but not so good from a browser feature perspective
FireFox just follows in the steps of Chrome now. Whatever Google decides Firefox will just go along with it.
Hence why Firefox fully implemented the privacy disaster known as the AudioContext API, which leaks sensitive information about your audio peripherals without your consent or notification, even on sites with no audio whatsoever.
It's abused almost exclusively by ad networks, including Google's DoubleClick on major sites like StackOverflow.
These new APIs are used almost entirely for fingerprinting, and this was implemented after the Chrome team claimed they would carefully consider the security ramifications of new APIs. I guess it doesn't matter if the business unit next door prints money as a result.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#26(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…
Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#27Earlier quoted context omitted.
Given Chrome's market share, that is mostly Google. The irony that IE fighters are the same that helped Google reached their position, because "developer tools" and "don't like FF UI changes". Now don't complain, how is it again? Ah, Chrome is available as open source so it isn't comparable to IE.
Chromium is open source, not Google Chrome. And much of the documentation about Chromium and V8 is not public.
Correct, that doesn't change the arguments that were being pushed around as defence why Chrome isn't IE.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#28(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…
Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.
How is this faster?
More DNS requests, more TCP connections. At first this is purely slower.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#29Earlier quoted context omitted.
Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.
How is this faster? More DNS requests, more TCP connections. At first this is purely slower.
Pretty sure in HTTP 1.1, there was a max amount of concurrent requests per server/proxy. So using different domains allowed more rq/s.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#30Earlier quoted context omitted.
Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.
How is this faster? More DNS requests, more TCP connections. At first this is purely slower.
Browsers used to/still do max number of connections per domain. Adding more domains allows you to do more concurrent requests.