Live data from Hacker News

W3C slaps down Google's proposal to treat multiple domains as same origin

theregister.com

71–80 of 128 posts

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#71
post #2

What a weird coincidence that this would really help let's say a company that used google.com as well as google.co.uk and doubleclick.com as their "first party" set. Good that W3C stopped it.

It would also help a company that grows rapidly by acquisition. It's a real beast to deal with cross-domain synchronized authentication.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#72
post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

>in a way that we shouldn't assume any ownership only based on the domain itself.

I probably have a naive understanding of this, but why not? In your Shopify example, users should certainly be taught that Shopify does have ownership of mystore.shopify.com (in at least the 'security' and 'privacy' areas of concern from the write-up). Likewise, entities proxying resources controlled by others through their own domains (e.g. CNAME cloaking) should take responsibility for what they are serving and how they are exposing their clients.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#73
post #46

Earlier quoted context omitted.

Until Google implements the behavior and applies it to their sites. Then Google services stop working smoothly on Firefox and Safari because the shared session on those sites is only functional on Chrome. Imagine having to log into gmail, calendar, drive, etc. individually each time. In theory it's not that big of a deal, but in practice could end up driving the casual users to Chrome since the tools they use work be…

Even Google probably doesn’t want to fuck over 33% of users in Germany. And considering iPhone market share in the US, the same might go there. And as a fun fact: Edge (12.62%) moved past Safari (11.24%) on Desktop in Germany.

Hopefully! But I also have to look at how well Google Hangouts works in Firefox, and how well Zoom meetings work in browsers at all, and consequently limit my faith that marketshare is a heavy determinant in client behavior.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#74
post #2

What a weird coincidence that this would really help let's say a company that used google.com as well as google.co.uk and doubleclick.com as their "first party" set. Good that W3C stopped it.

W3C doesn't really have any real power over what happens in the internet today. It's browser vendors associated with WHATWG that draw the straws now.

Yep, Google had already gone ahead with this anyway.

> Google has already implemented both First Party Sets and SameParty cookies in Chrome 89, the current version, where they are included as an "origin trial" to "allow developers to try out new features and give feedback."

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#75
post #28
post #26

Earlier quoted context omitted.

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

How is this faster? More DNS requests, more TCP connections. At first this is purely slower.

Upstreams were very limited, and HTTP requests send cookie data in each GET.

For instance, if you had a 128kbps DSL upstream and each request was 2KB (loaded up with cookies), you're already limited to 8 requests/second. A cookie-less domain for small resources helped this a lot.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#76

Hmmm, what stops Google from doing it anyway? Chrome is the de-facto standard nowadays with every other browser being under 10% market share except Safari holding out around 20%.

They are doing it anyway.

> Google has already implemented both First Party Sets and SameParty cookies in Chrome 89, the current version, where they are included as an "origin trial" to "allow developers to try out new features and give feedback."

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#77
post #28

Earlier quoted context omitted.

How is this faster? More DNS requests, more TCP connections. At first this is purely slower.

It spreads out the load on disks and outbound bandwidth.

You are making the assumption that the domain pointed to different physical servers. To get the benefits of what everyone else is describing it does not matter what the domains actually are pointing to.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#79
post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

>Sometimes I wonder how the web got here with the amount of kludge that we have to carry.

Really? Um, MS led the way with IE6 and all of the baggage they brought. Google took the mantle with Chrome. Ultimately, it is the browser vendors and their "interpretations" on how to handle things. Rather than working with the governing bodies (yes, they are slow), they forged ahead with their own implementations and forced everyone to follow. No browser is perfect, but the travesty that IE left us with should have been the glaring example of what not to do, but yet Google went and did it again.

The internet is nothing without the browsers. If the browsers didn't do bad things, we'd be in a lot better situation.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#80
post #9

Earlier quoted context omitted.

Given Chrome's market share, that is mostly Google. The irony that IE fighters are the same that helped Google reached their position, because "developer tools" and "don't like FF UI changes". Now don't complain, how is it again? Ah, Chrome is available as open source so it isn't comparable to IE.

Chromium is open source, not Google Chrome. And much of the documentation about Chromium and V8 is not public.

Former V8er. We moved the vast majority of V8 documentation to public sites. What is non-public is mostly design docs, proposals, strategy, experiments, etc, i.e. the inner workings of the team mechanics. The technical details of V8 are not secret in any way. They may be radically complex, but not secret.
Post reply on HN