Earlier quoted context omitted.
That's not how it works. W3C has generally been the codifer of standards with member agreement, W3C generally has not made a standard ahead of an implementation. Granted, XHTML was probably an example, an exception that proves the rule.
No. The browser vendors left the W3C. When the final browser vendor (Microsoft) left and joined the other vendors in WHATWG, the vendors collectively sent a letter to W3C asking W3C to please stop copying and introducing errors into the standards WHATWG wrote. See e.g. https://www.zdnet.com/article/browser-vendors-win-war-with-w...
W3C slaps down Google's proposal to treat multiple domains as same origin
121–128 of 128 posts
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#122Earlier quoted context omitted.
Users can't ignore W3C. Browser makers can. This "feature" would open up for tracking using today's modern analysis systems with year 2000 privacy protections.
And google hosting everything under a google.com domain wouldn’t?
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#123Earlier quoted context omitted.
And google hosting everything under a google.com domain wouldn’t?
But they don't and it wouldn't be an easy step.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#124Earlier quoted context omitted.
Free products are generally supported by advertising. We are being told the W3C has “slapped down” googles attempts around FPS. I am making the point that if google comes up with a workaround to this “slap down” - users will follow - even if you and others are yelling “it’s not W3C”. That could be modifying chrome to allow this, it could be hosting things under one domain etc
> Free products are generally supported by advertising. We are being told the W3C has “slapped down” googles attempts around FPS. You were talking about "If users can’t access gmail / YouTube etc, they will be ignoring the w3c". Now it's suddenly "free sites" and "advertising". And don't worry, advertising isn't going anywhere. > I am making the point that if google comes up with a workaround to this “slap down” - us…
They are supported by advertising.
This is not 'suddenly 'free sites' and 'advertising'" - this is how both of these sites have been from the beginning, adding paid options later.
If the w3c somehow forced users to jump through hoops to allow google to advertise to them so they could access their youtube and their Gmail, they would jump through those hoops rather than lose access.
That said, I'm not sure I even believe that W3C has actually been able to "slap down" Google - but we will see. Google, not the W3C makes the BY FAR most popular browser out there, and Microsoft has recently begun migrating ITS own users to, not away from chrome.
Because we are having some definitional issues around the basics of how gmail and youtube function in terms of revenue models and user engagement I'm going to let this rest here on my side.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#125First the issue is some recent changes by browser vendors that break the semantics of the web in the name of privacy:
What safari did was to ban cookie loading in framed origins if they weren't sub-origins of the parent. Basically they are forcing a frame-ancestors policy that is impossible to opt-out of, so if you are running a mashup, say on foomarket.com and you want to have different vendors vendorA.com, vendorB.com each have an iframe, then this will no longer work in safari as vendorA.com iframe wont send cookies back to vendorA if the site is framed.
The justification for this was the invented term of calling vendorA's cookies "third party", even though a framed site has its own window, it's own document and is a first party origin in the browser. Safari then decided if the framing origin is not a parent of the framed origin, then the framed origin will be labelled "third party" and it will not be able to send cookies back to its own origin. In other words, they crippled iframes, breaking websites that rely on iframes and the same origin policy for content isolation, especially for content isolation of authenticated domains. This is used in mashups for dashboards, vendors, multi-tenant pages, etc.
What Google is trying to do is to have a list of origins that the framing page can publish for which web-semantics would be preserved and iframes could do all the things we expect iframes to be able to do: run scripts, load cookies, etc, respecting the same origin policy of the frame rather than having the origin of the parent applied to it. This is iframe behavior since iframes were created up until 2019 when Safari redefined iframes to not be first party origins in the browser. Google's proposal is a completely reasonable solution that restores the viability of iframes as content isolation security mechanisms - presently the only content isolation security mechanism available in the browser that allows two origins to coexist without interfering with each other in the same browser tab.
The alternative is to force vendorA and vendorB to become subdomains of foomarket, so they would be vendorA.foomarket.com, etc. In the case of subdomains, apple does allow the cookies to be sent. But then you have cookie overwriting attacks in which vendorA could attack vendorB by setting cookies on the parent which would be read by all the children.
Thus sub-domains do not have the clean isolation of full-fledged separate origins, which is what iframes were designed to be, and which privacy advocates at Safari decided needed breaking because they saw that a lot of public sites used iframes for advertising. But that is not a good reason to destroy the semantics of iframes as there are many sites on the internet today that have nothing to do with advertising, and which rely on these features for secure isolation. Indeed the obsession of the Safari team with fighting advertising at the expense of breaking existing corporate intranets, PAAS/SAAS offering and mashups involving multiple tenants hosted on the same parent origin is pretty stunning. You'd think their only experience with the web was browsing public ad-based sites, and that this was the only use case they designed their browser to serve. You want to have a dashboard with different data providers serving their own data in their own isolated origin? But you don't want those data providers to send data anonymously but only if you are authenticated to their origin? Too bad, Safari thinks you are the Buzzfeed front page with one pixel trackers and that is the only use case they are designing their browser to support. You want to have a site studio where you load a website you are building in a frame and have it still run properly, without being able to interfere with your studio? Too bad. You want a municipal site where city vendors or authorities frame in various monitoring/reporting sites in a central command center, all framed in but with strong site isolation? Too bad. Want a content origin for html content to render but have it not be able to affect your own origin? Too bad.
There are many business sites, secured sites, multi-vendor sites that have nothing to do with advertising and rely on iframes for security isolation of authenticated data, and these sites no longer work with safari. Google is trying to make sure that these sites still work. And the Register -- another advertising based site -- is enraged by this.
HTML is no longer an advertising-first technology, and breaking existing frame-origin semantics in order to wage a war on advertising is not going to fly, regardless of the army of privacy warriors who have no interest in supporting more advanced use cases beyond front-page blogs. What will happen is we'll go back to the old days of all non-advertising sites requiring Chrome to work, much like corporate/government sites were built in IE in the 90s. And the sad thing is that this is because the other browser vendors are intentionally breaking existing web-semantics, not because Chrome is embracing/extending with new semantics.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#126Earlier quoted context omitted.
> Free products are generally supported by advertising. We are being told the W3C has “slapped down” googles attempts around FPS. You were talking about "If users can’t access gmail / YouTube etc, they will be ignoring the w3c". Now it's suddenly "free sites" and "advertising". And don't worry, advertising isn't going anywhere. > I am making the point that if google comes up with a workaround to this “slap down” - us…
Gmail and youtube are offered free to users. They are supported by advertising. This is not 'suddenly 'free sites' and 'advertising'" - this is how both of these sites have been from the beginning, adding paid options later. If the w3c somehow forced users to jump through hoops to allow google to advertise to them so they could access their youtube and their Gmail, they would jump through those hoops rather than lose…
Why would users need to jump through any hoops to make advertising works? Users will do literally nothing.
You are under false impression that not implementing FPS will somehow prevent advertising from working. No, it won't.
> Because we are having some definitional issues around the basics of how gmail and youtube function in terms of revenue models and user engagement
No idea what you mean by this statement.
The only reason Google wants FPS is to have an easier way to continue tracking users across its properties. It already does that now without FPS, and, surprising no one except you, it doesn't hurt its advertising business in the least. They brought in 147 billion dollars in revenue from ads in 2020. That's 80% of Google's total revenue.
Google and Google's free services will be just fine without FPS.
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#127Earlier quoted context omitted.
This is the first I've heard of this - why is it being downvoted? I'd like to know more. Do you have any more info about this?
Sure do. StackOverflow's Google ad partner explicitly allows the abuse of AudioContext and other audio APIs for tracking purposes, ruining user security. [1] These APIs leak sensitive information about your peripherals without your consent or notification [2], and is used rampantly on Google's ad network. Try it yourself and see. Simply open up the browser console and type: (new AudioContext()) Google Chrome develope…
Re: W3C slaps down Google's proposal to treat multiple domains as same origin
#128Earlier quoted context omitted.
Unfortunately Opera is also Chromium-based now, as are a growing number of browsers (edge was the nail in the coffin)
It's also owned by a Chinese company so no guarantee about backdoors for the CCP since it's not fully open source.