W3C slaps down Google's proposal to treat multiple domains as same origin • Hacker News Board

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#91

Post by stjohnswarts » Fri, Apr 09, 2021, 4:03 PM UTC

mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

In my opinion that's something the website owner should handle and it's a tractable problem. It shouldn't be pushed to the browser other than as you mentioned through capabilities like SOP and cookies. The way it is is fine.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#92

Post by stjohnswarts » Fri, Apr 09, 2021, 4:04 PM UTC

ampdepolymerase wrote: post #82

dylan604 wrote: post #79

Earlier quoted context omitted.

>Sometimes I wonder how the web got here with the amount of kludge that we have to carry. Really? Um, MS led the way with IE6 and all of the baggage they brought. Google took the mantle with Chrome. Ultimately, it is the browser vendors and their "interpretations" on how to handle things. Rather than working with the governing bodies (yes, they are slow), they forged ahead with their own implementations and forced ev…

The standard and governing bodies has no right to demand anything. The internet is not a democracy. If they want something put the money where their mouth is. Until W3C ships their own browser engine and gets it into the hands of customers, relevance is nothing more than a nice-to-have.

You seriously want google to be defining what the internet is given their current and past activities and abuses? There is no way that could ever be a good thing. If they ever do expect a 50% carve out for targeted ad technologies.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#93

Post by stjohnswarts » Fri, Apr 09, 2021, 4:07 PM UTC

bigth wrote: post #26

mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

That's an infrastructure problem. Sure you can solve it with domains, but you can also easily use other current technologies for it with no issues as well and never change the domain name at all.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#94

Post by stjohnswarts » Fri, Apr 09, 2021, 4:11 PM UTC

ajdude wrote: post #41

datavirtue wrote: post #34

Earlier quoted context omitted.

So is Opera

Unfortunately Opera is also Chromium-based now, as are a growing number of browsers (edge was the nail in the coffin)

It's also owned by a Chinese company so no guarantee about backdoors for the CCP since it's not fully open source.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#95

Post by stjohnswarts » Fri, Apr 09, 2021, 4:15 PM UTC

hnbad wrote: post #23

cromwellian wrote: post #13

Earlier quoted context omitted.

This isn't any different than most of the internet standard development. "Rough consensus and running code". Most of the internet-drafts and RFCs start out life as prototype implementations, instead of writing specs first, experimental prototypes are developed, and the spec is extracted out of the winners. People are acting like internet and web specs start life as a standards doc, it's iterated on until finalized, a…

The difference is Chrome moves ahead anyway. This is why I'm calling it "standards-washing" -- if you take away the RFC it's no different from the browser wars era or Apple's proprietary CSS extensions for Safari back in the day. How the standards process is supposed to work is something like this: 1. Someone creates a rough proposal. Discussion happens. 2. Someone creates a proof of concept toy implementation. Discu…

Do you have know of a writeup or blog post from someone involved in such actions that cites actual situations where this happened when google railroaded a new standard through?

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#96

Post by stjohnswarts » Fri, Apr 09, 2021, 4:17 PM UTC

BiteCode_dev wrote: post #83

Of course they want to. This way if I accept a cookie on one site, they can track me on all the sites without having to ask. It will make the ubiquitous google account unique ID even easier to set. But I'm sure they'll say it's to lake shared login policies easier.

They already have that through fingerprinting anyway. This would just be a little easier.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#97

Post by danso » Fri, Apr 09, 2021, 4:27 PM UTC

ziml77 wrote: post #35

bryanrasmussen wrote: post #22

Earlier quoted context omitted.

for the purposes of anti-trust law somewhere around 3% market share isn't really considered an option.

They have a low market share now, but there's really not much of a barrier to switching. So if Chrome does still go through with implementing this, people can hop right on over to Firefox.

The barrier isn't just on the user side. The initial phase of government sites – i.e. web sites where the vast majority of the public are required to use to do official things — were designed with Internet Explorer in mind exclusively. Now many gov sites officially support Chrome as the default, and sometimes mobile Safari. Right now Firefox is at 2.7% [0] of us.gov visitors, almost half that of Microsoft Edge.

The average user, especially those in business/professional settings, are going to keep Chrome as their default for a long time, even if FF becomes equivalent or even superior.

[0] https://analytics.usa.gov/

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#98

Post by dylan604 » Fri, Apr 09, 2021, 4:28 PM UTC

zdragnar wrote: post #90

dylan604 wrote: post #79

Earlier quoted context omitted.

>Sometimes I wonder how the web got here with the amount of kludge that we have to carry. Really? Um, MS led the way with IE6 and all of the baggage they brought. Google took the mantle with Chrome. Ultimately, it is the browser vendors and their "interpretations" on how to handle things. Rather than working with the governing bodies (yes, they are slow), they forged ahead with their own implementations and forced ev…

IE6 also brought us AJAX, so there is something to be said for browser vendors implementing experimental features on their own. The difference between nice and awful, of course, is when developers and vendors treat such features as a given without providing graceful degradation (or progressive enhancement, if you prefer) for users of other browsers.

Sure, AJAX is cool. However, devs would not be allowed to release into the wild if the experimental features were not availalable in released browsers. That whole -strict, -transitional type stuff is just another example. Extreme specific personal reco would be to only allow experimental features available to devs that must compile their own browser from source. this would prevent the vast majority of users from ever seeing those experimental features in the wild. Devs could still dev against and find the bugs, but they would also be less willing to make the experimental features requirements on their product.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#99

Post by hinkley » Fri, Apr 09, 2021, 4:31 PM UTC

bigth wrote: post #26

mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

NCSA was using regional DNS for load balancing in '95. I don't know who invented it but it's at least 25 years old.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#100

Post by aasasd » Fri, Apr 09, 2021, 4:34 PM UTC

aasasd wrote: post #59

TheChaplain wrote: post #4

Hmmm, what stops Google from doing it anyway? Chrome is the de-facto standard nowadays with every other browser being under 10% market share except Safari holding out around 20%.

Exactly: I can see Chrome implementing a slightly different approach where all sites function as they do now, except anything coming Google which is allowed to do what it wants.

(from Google, of course.)