W3C slaps down Google's proposal to treat multiple domains as same origin • Hacker News Board

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#51

Post by sdflhasjd » Fri, Apr 09, 2021, 1:33 PM UTC

gsich wrote: post #28

bigth wrote: post #26

Earlier quoted context omitted.

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

How is this faster? More DNS requests, more TCP connections. At first this is purely slower.

It spreads out the load on disks and outbound bandwidth.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#52

Post by random5634 » Fri, Apr 09, 2021, 1:41 PM UTC

Daho0n wrote: post #11

random5634 wrote: post #5

How did w3c get such power to “slap down” google. If users can’t access gmail / YouTube etc, they will be ignoring the w3c. Another workaround if google can’t try this in chrome (it can) do cookies on a google sub domain (yt.google.com etc)

Users can't ignore W3C. Browser makers can. This "feature" would open up for tracking using today's modern analysis systems with year 2000 privacy protections.

And google hosting everything under a google.com domain wouldn’t?

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#53

Post by Semaphor » Fri, Apr 09, 2021, 1:43 PM UTC

ysavir wrote: post #46

Jaxkr wrote: post #33

Earlier quoted context omitted.

Firefox when combined with Safari are a formidable opponent to Google’s monopoly. The First Party Sets standard couldn’t be forced through because Firefox and Safari wouldn’t accept it.

Until Google implements the behavior and applies it to their sites. Then Google services stop working smoothly on Firefox and Safari because the shared session on those sites is only functional on Chrome. Imagine having to log into gmail, calendar, drive, etc. individually each time. In theory it's not that big of a deal, but in practice could end up driving the casual users to Chrome since the tools they use work be…

Even Google probably doesn’t want to fuck over 33% of users in Germany. And considering iPhone market share in the US, the same might go there.

And as a fun fact: Edge (12.62%) moved past Safari (11.24%) on Desktop in Germany.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#54

Post by random5634 » Fri, Apr 09, 2021, 1:43 PM UTC

dmitriid wrote: post #8

random5634 wrote: post #5

How did w3c get such power to “slap down” google. If users can’t access gmail / YouTube etc, they will be ignoring the w3c. Another workaround if google can’t try this in chrome (it can) do cookies on a google sub domain (yt.google.com etc)

> If users can’t access gmail / YouTube etc, they will be ignoring the w3c. Are users unable to access gmail / YouTube etc now?

Users will use / do what is required to access YT. Google could proxy through a google.com domain so same site cookies could be set, they could implement this in chrome and users would follow along

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#55

Post by Semaphor » Fri, Apr 09, 2021, 1:45 PM UTC

youngtaff wrote: post #18

gscott wrote: post #17

Earlier quoted context omitted.

FireFox just follows in the steps of Chrome now. Whatever Google decides Firefox will just go along with it.

As far as consumer usage goes Firefox is effectively dead It's rare that see FF usage above 1% on any of my customers' sites and I think it's only at something like 2% on gov.uk Of course there's a debate to be had over how much FF users blocking analytics affects the numbers but the numbers tie up with the log mining I've done too

Germany: FF has 20.4% on Desktop here, and at my work’s website it’s the most used single browser over all platforms (though all Chromium browsers summed up are higher). Caveat: Our website sucks on mobile.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#56

Post by ThrowawayR2 » Fri, Apr 09, 2021, 1:46 PM UTC

TheChaplain wrote: post #4

Hmmm, what stops Google from doing it anyway? Chrome is the de-facto standard nowadays with every other browser being under 10% market share except Safari holding out around 20%.

> "Hmmm, what stops Google from doing it anyway?"

The fear of getting a smackdown for being anti-competitive and too dominant, hopefully, much like the one Microsoft got during IE's dominance a couple of decades ago.

Microsoft adopting Chrome's code for its Edge browser is a brilliant bit of jujutsu; not only do they get to join the chorus of voices that say "Google's so powerful and anti-competitive that we had no choice but to adopt their browser engine", they also cut their engineering costs dramatically for their built in browser by having a competitor pay for it.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#57

Post by mwexler » Fri, Apr 09, 2021, 1:48 PM UTC

bilekas wrote: post #37

I'm not sure why this would be such a big deal for Google.. I know they might be communicating between .co.uk .com etc.. But apart from that, why would Google benefit so much from this ?

It's Google's proposal, but it actually affects any entity having multiple domains. Think of publishers like Conde who have multiple magazines, or a company with regional domains (company.co.uk, company.com) or a content site set up for specific company-driven event (thecoolshow.com)... All of these would enable the entity to manage user experiences better, instead of having to do hacks, multiple logins, or other user hassles.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#58

Post by mwexler » Fri, Apr 09, 2021, 1:52 PM UTC

Daho0n wrote: post #11

random5634 wrote: post #5

How did w3c get such power to “slap down” google. If users can’t access gmail / YouTube etc, they will be ignoring the w3c. Another workaround if google can’t try this in chrome (it can) do cookies on a google sub domain (yt.google.com etc)

Users can't ignore W3C. Browser makers can. This "feature" would open up for tracking using today's modern analysis systems with year 2000 privacy protections.

I'm not sure I understand. In the year 2000, we let any domain get access to it's cookie. In this proposal, an entity can let domains it controls have access to a shared cookie, all others are still blocked. But fair point: if I am allowed to say that I have a "relationship" with eviltracker.com, then they could get the shared cookie... But it's easy to add requirements like ownership vs partnership, or purpose-based access, or other enhancements.

So, not really as bad as you suggest, but true, some problem cases can arise.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#59

Post by aasasd » Fri, Apr 09, 2021, 1:52 PM UTC

TheChaplain wrote: post #4

Hmmm, what stops Google from doing it anyway? Chrome is the de-facto standard nowadays with every other browser being under 10% market share except Safari holding out around 20%.

Exactly: I can see Chrome implementing a slightly different approach where all sites function as they do now, except anything coming Google which is allowed to do what it wants.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#60

Post by fuzzy2 » Fri, Apr 09, 2021, 1:55 PM UTC

gsich wrote: post #28

bigth wrote: post #26

Earlier quoted context omitted.

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

How is this faster? More DNS requests, more TCP connections. At first this is purely slower.

A separate domain name for static assets would not receive any cookies of the actual site. This means less data transferred and in theory a proxy closer to the user could more easily cache these requests, even for multiple clients.