Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

W3C slaps down Google's proposal to treat multiple domains as same origin

theregister.com

Post reply on HN
Print view View original

101–110 of 128 posts

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#101

Post by parliament32 »

mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

>you can have a number of sites that use separate domains but are owned by the same entity

Why is this even a thing? There's nothing wrong with storeA.shopify.com, storeB.shopify.com... The only valid use case is if you're somehow trying to hide the shared ownership/platform, in which case it's up to you to deal with the downsides.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#102

Post by will4274 »

timw4mail wrote: post #43
p2t2p wrote: post #36

On one hand, W3C doesn't matter anymore. Google is the internet. On other hand there's Apple with their Safari and I have high hopes that even if Chrome implements that, Safari won't so Google will have to play by Apple's rules in the end of the day. Weird power play we are to observe.

That's not how it works. W3C has generally been the codifer of standards with member agreement, W3C generally has not made a standard ahead of an implementation. Granted, XHTML was probably an example, an exception that proves the rule.

No. The browser vendors left the W3C. When the final browser vendor (Microsoft) left and joined the other vendors in WHATWG, the vendors collectively sent a letter to W3C asking W3C to please stop copying and introducing errors into the standards WHATWG wrote. See e.g. https://www.zdnet.com/article/browser-vendors-win-war-with-w...

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#103

Post by mdoms »

mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

Nothing's stopping you from using the one domain as it was initially intended.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#104

Post by junon »

0xy wrote: post #25
gscott wrote: post #17

Earlier quoted context omitted.

FireFox just follows in the steps of Chrome now. Whatever Google decides Firefox will just go along with it.

Hence why Firefox fully implemented the privacy disaster known as the AudioContext API, which leaks sensitive information about your audio peripherals without your consent or notification, even on sites with no audio whatsoever. It's abused almost exclusively by ad networks, including Google's DoubleClick on major sites like StackOverflow. These new APIs are used almost entirely for fingerprinting, and this was imple…

This is the first I've heard of this - why is it being downvoted? I'd like to know more.

Do you have any more info about this?

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#105

Post by foepys »

titzer wrote: post #80
29athrowaway wrote: post #16

Earlier quoted context omitted.

Chromium is open source, not Google Chrome. And much of the documentation about Chromium and V8 is not public.

Former V8er. We moved the vast majority of V8 documentation to public sites. What is non-public is mostly design docs, proposals, strategy, experiments, etc, i.e. the inner workings of the team mechanics. The technical details of V8 are not secret in any way. They may be radically complex, but not secret.

Keeping proposals and design documents private is essentially the same as making a project "source available". It prevents people from participating in the extension of functionality and limits them to being bug fixers.

What Microsoft is doing with .NET is true open source where all proposals are being discussed in public with volunteers improving proposals and suggesting new ones.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#106

Post by Ashanmaril »

p2t2p wrote: post #36

On one hand, W3C doesn't matter anymore. Google is the internet. On other hand there's Apple with their Safari and I have high hopes that even if Chrome implements that, Safari won't so Google will have to play by Apple's rules in the end of the day. Weird power play we are to observe.

I don't know how much pull Safari has. Seems like a lot of web devs don't test on Safari.

I know this isn't damning evidence or anything, but I noticed recently that the header image on front page of Thunderbird's homepage[1] has an image of the app (in a Mac window, funnily enough) that doesn't size properly on Safari[2]. It squishes horizontally, I assume due to some weird CSS implementation difference.

[1] https://www.thunderbird.net/en-CA/

[2] https://i.postimg.cc/rwWmDynk/image.png

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#107

Post by mtrovo »

1shooner wrote: post #72
mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

>in a way that we shouldn't assume any ownership only based on the domain itself. I probably have a naive understanding of this, but why not? In your Shopify example, users should certainly be taught that Shopify does have ownership of mystore.shopify.com (in at least the 'security' and 'privacy' areas of concern from the write-up). Likewise, entities proxying resources controlled by others through their own domains…

mystore.shopify.com is definitely hosted by Shopify but it's content is a totally isolated entity. You can trust laptops.shopify.com but this trust should not automatically transfer to fakestore.shopify.com. In the same way if you have a valid account on laptops.shopify.com, the browser shouldn't allow fakestore.shopify.com to emit a request and buy something on laptops.shopify.com with your valid session on your behalf, even though they're on the base domain.

You have also the parallel problem of how do you transfer the trust you have on google.co.uk to youtube.co.jp only based on the domain info you have.

This all to say that using only domain names to resolve ownership is a hard problem, since ages browsers use a crowdsourced list [1] to get around this issue but recently it proved not to scale very well, specially after Apple's move to use this list as part of their "Limit Ad Tracking" solution.

[1] https://publicsuffix.org/

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#108

Post by mtrovo »

parliament32 wrote: post #101
mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

>you can have a number of sites that use separate domains but are owned by the same entity Why is this even a thing? There's nothing wrong with storeA.shopify.com, storeB.shopify.com... The only valid use case is if you're somehow trying to hide the shared ownership/platform, in which case it's up to you to deal with the downsides.

AFAIK there are big security risks on hosting user generated content on the same domain of your parent website. That was the main reason github.com migrated individual repo pages to github.io [1]. Also shopify doesn't serve their shops on the domain of their main website, they use *.myshopify.com, I suppose for the same reason.

[1] https://github.blog/2013-04-05-new-github-pages-domain-githu...

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#109

Post by riantogo »

I have a reverse problem. My platform has multiple forums represented as domain/forumname, each owned by different users. Now because most integrations go off domain, it is impossible for individual forum owners to plug-in 3rd party services (analytics, ad networks etc.) for themselves.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#110

Post by om2 »

cromwellian wrote: post #13
hnbad wrote: post #10

Earlier quoted context omitted.

Just look at Project Fugu. Google is putting the implementation first, the spec to "standards wash" their implementation comes later. And if WHAT WG doesn't want to play along (and why wouldn't they? most browser vendors are now downstream from Chromium so they get the implementation by default) they can just leave it in as "experimental" with a "draft" spec. W3C doesn't really get a say in this.

This isn't any different than most of the internet standard development. "Rough consensus and running code". Most of the internet-drafts and RFCs start out life as prototype implementations, instead of writing specs first, experimental prototypes are developed, and the spec is extracted out of the winners. People are acting like internet and web specs start life as a standards doc, it's iterated on until finalized, a…

Chrome has running code, but generally skips the "rough consensus" step.
Post reply on HN