151–160 of 166 posts
If using linux or mac, just FUSE mount with rclone. If you need more privacy,load the mount with encryption so google has no idea about the files you are working with.
That’s not limited to Linux or macOS at all, works perfectly under Windows too
Earlier quoted context omitted.
I don't fully understand why they need to use a separate domain for this at all. There is infinite URL space available on drive.google.com, even if Google just used a proxy behind the scenes to route those requests to whatever load balancer normally services googleusercontent.com, and that would solve the issue with third party cookies entirely... as well as several other issues, like potentially confusing users with…
Using a separate domain for user generated content is usually done for security reasons. For example, if a user-generated chunk of JavaScript was executed from drive.google.com, then it could potentially gain access to your drive.google.com, or maybe even *.google.com, authentication cookies. Scripts running on an unrelated domain have no such access. This usually isn't the only thing protecting against this, and is…
Perhaps not, but I still think it's quite worthwhile to defend against CSP-related browser bugs, or even a botched infra change on Google's side that accidentally drops the CSP header.
Earlier quoted context omitted.
Have you ever used a service in life where there is no competition? Straight up lack of competition examples are the easiest: DMV, airport food court, buying beer at a sports stadium etc. If you work in tech then you’ve probably had to use software over whose purchase you had no control: Jira, PeopleHR, Taleo, Concur. There’s no competition there because you, the end user, don’t have the option to choose from a free…
> Without competition, software rots and/or never gets better. [...] systemd since it was locked in as the only properly supported Debian/Ubuntu init To be fair, systemd was rotten to the core from day one (literally - namely, the core concept of shoving as much crap into pid 1 as possible to abuse the special semantics that are supposed to only allow for reaping of orphan processes), so you can't really blame that o…
Earlier quoted context omitted.
What is the definition of what is "really" "my" domain? If I put a custom domain on an S3/cloudfront that's part of my system, so it appears as `storage.mysystem.com`, is there something nefarious going on? Who decides what is allowable declaration of a domain to be mine? And who enforces this with fines? Is there currently any way to fine someone on the internet for violating a rule? What would you imagine this look…
> Who decides what is allowable declaration of a domain to be mine? Basically, there is a list included in all browsers: https://wiki.mozilla.org/Public_Suffix_List . That's why you.github.io can't read other github.io cookies, but if you make your own domain, you can share cookies between a.example.com and b.example.com. (Also why example.com can't read .com cookies.) > Is there currently any way to fine someone on…
I understood that the conversation was about attesting that, for instance, googleusercontent.com was owned by the same entity as google.com so could share cookies.
A) I don't see any way that the list included in browsers of public suffixes makes it possible to decide that google.com really owns googleusercontent.com. If it did, we would already be there and woudln't be discussing this.
B) Who do you think makes the public suffix list in the first place, where do you think it comes from exactly?
Earlier quoted context omitted.
Using a separate domain for user generated content is usually done for security reasons. For example, if a user-generated chunk of JavaScript was executed from drive.google.com, then it could potentially gain access to your drive.google.com, or maybe even *.google.com, authentication cookies. Scripts running on an unrelated domain have no such access. This usually isn't the only thing protecting against this, and is…
> I believe Google's use of this practice also predates widespread support of Content Security Policy, which isn't to say that this is a useless practice, but perhaps it isn't as important as it used to be. Perhaps not, but I still think it's quite worthwhile to defend against CSP-related browser bugs, or even a botched infra change on Google's side that accidentally drops the CSP header.
This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)
This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)
I'm not sure if blocking third party cookies is the cause, but I have had difficulty downloading files under Firefox. Disabling third party cookies is one of the first settings I enable after installing Firefox. I would not be surprised if Apple makes an exception for Google.
Earlier quoted context omitted.
Honestly anyone concerned about a Chrome / WebKit browser monopoly needs to use Firefox now if you already are not.
I don't see any problems with a monoculture of rendering engine. Browser (and features, especially privacy ones), absolutely. Renderer, not so much.