What a weird coincidence that this would really help let's say a company that used google.com as well as google.co.uk and doubleclick.com as their "first party" set. Good that W3C stopped it.
W3C slaps down Google's proposal to treat multiple domains as same origin
71–80 of 128 posts
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#72(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…
I probably have a naive understanding of this, but why not? In your Shopify example, users should certainly be taught that Shopify does have ownership of mystore.shopify.com (in at least the 'security' and 'privacy' areas of concern from the write-up). Likewise, entities proxying resources controlled by others through their own domains (e.g. CNAME cloaking) should take responsibility for what they are serving and how they are exposing their clients.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#73Earlier quoted context omitted.
Until Google implements the behavior and applies it to their sites. Then Google services stop working smoothly on Firefox and Safari because the shared session on those sites is only functional on Chrome. Imagine having to log into gmail, calendar, drive, etc. individually each time. In theory it's not that big of a deal, but in practice could end up driving the casual users to Chrome since the tools they use work be…
Even Google probably doesn’t want to fuck over 33% of users in Germany. And considering iPhone market share in the US, the same might go there. And as a fun fact: Edge (12.62%) moved past Safari (11.24%) on Desktop in Germany.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#74What a weird coincidence that this would really help let's say a company that used google.com as well as google.co.uk and doubleclick.com as their "first party" set. Good that W3C stopped it.
W3C doesn't really have any real power over what happens in the internet today. It's browser vendors associated with WHATWG that draw the straws now.
> Google has already implemented both First Party Sets and SameParty cookies in Chrome 89, the current version, where they are included as an "origin trial" to "allow developers to try out new features and give feedback."
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#75Earlier quoted context omitted.
Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.
How is this faster? More DNS requests, more TCP connections. At first this is purely slower.
For instance, if you had a 128kbps DSL upstream and each request was 2KB (loaded up with cookies), you're already limited to 8 requests/second. A cookie-less domain for small resources helped this a lot.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#76Hmmm, what stops Google from doing it anyway? Chrome is the de-facto standard nowadays with every other browser being under 10% market share except Safari holding out around 20%.
> Google has already implemented both First Party Sets and SameParty cookies in Chrome 89, the current version, where they are included as an "origin trial" to "allow developers to try out new features and give feedback."
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#77Earlier quoted context omitted.
How is this faster? More DNS requests, more TCP connections. At first this is purely slower.
It spreads out the load on disks and outbound bandwidth.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#78Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#79(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…
Really? Um, MS led the way with IE6 and all of the baggage they brought. Google took the mantle with Chrome. Ultimately, it is the browser vendors and their "interpretations" on how to handle things. Rather than working with the governing bodies (yes, they are slow), they forged ahead with their own implementations and forced everyone to follow. No browser is perfect, but the travesty that IE left us with should have been the glaring example of what not to do, but yet Google went and did it again.
The internet is nothing without the browsers. If the browsers didn't do bad things, we'd be in a lot better situation.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#80Earlier quoted context omitted.
Given Chrome's market share, that is mostly Google. The irony that IE fighters are the same that helped Google reached their position, because "developer tools" and "don't like FF UI changes". Now don't complain, how is it again? Ah, Chrome is available as open source so it isn't comparable to IE.
Chromium is open source, not Google Chrome. And much of the documentation about Chromium and V8 is not public.