Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 69: “www.” subdomain missing from URL

bugs.chromium.org

Post reply on HN
Print view View original

191–200 of 919 posts

Re: Chrome 69: “www.” subdomain missing from URL

#191

Post by [deleted] »

soared wrote: post #60
jwr wrote: post #30

This is idiotic and harmful. We already lost information about the protocol, because somebody believed it is "too complex" for users. Now we're losing other parts of the URL. It's making a joke of the SSL/TLS padlock, too — what exactly is the padlock supposed to tell me? It used to signify that a "known authority" certified that I'm connected to whatever I see in the URL bar. But now that browsers take liberties wit…

99.9% of users have no idea what any of the words you just said mean. The change was made for them, not for you (the .1%)

[deleted]

Re: Chrome 69: “www.” subdomain missing from URL

#192

Post by geophertz »

trocadero wrote: post #173
parliament32 wrote: post #118

Considering a subdomain "trivial" is ridiculous... there's a difference between "www.example.com" and "example.com". Not only can they serve different sites, they can even have different DNS records! It seems that "m." is also considered a trivial subdomain. So when a user clicks a link to a "m.facebook.com" uri, they'll be confused why FB looks different when the browser reports it's on "facebook.com". I sincerely h…

>there's a difference between "www.example.com" and "example.com" Can you link to a site where these two are different?

www.pool.ntp.org pool.ntp.org

Re: Chrome 69: “www.” subdomain missing from URL

#193

Post by Sohcahtoa82 »

tschellenbach wrote: post #62

Just updated to see it in action. Seems like a nice improvement for end users. Don't think there is any reason not to do this, other than a nostalgic desire for things to stay the same. Most sites already have a www. to . redirect in place and if you don't its a trivial change.

> Don't think there is any reason not to do this [...] Most sites already have a www. to . redirect in place

Most. Not all.

The browser is doing something out-of-spec for really no reason at all and it has the chance to break some sites.

www.domain.com and domain.com are never guaranteed to go to the same page. Yes, out of modern convention, they do now, but it's only a convention. Sites are free to break it, and some do, so to make this change is a bad idea.

Re: Chrome 69: “www.” subdomain missing from URL

#195

Post by agentPrefect »

ozfive wrote: post #43

This and many other changes over a course of a short period of time have caused me to go to Firefox exclusively now. I heard Firefox is going to stop third party cookie tracking altogether. Why not give Google the big finger and use a different browser? Vote with your cold hard actions if you feel so strongly about something.

Because the battery drainage with Firefox is unacceptable.

Re: Chrome 69: “www.” subdomain missing from URL

#196

Post by protomyth »

download13 wrote: post #143
jwr wrote: post #30

This is idiotic and harmful. We already lost information about the protocol, because somebody believed it is "too complex" for users. Now we're losing other parts of the URL. It's making a joke of the SSL/TLS padlock, too — what exactly is the padlock supposed to tell me? It used to signify that a "known authority" certified that I'm connected to whatever I see in the URL bar. But now that browsers take liberties wit…

You can still click and see the whole URL. This is just making it easier for the average user to see the most important thing to them, which is the domain name. It's not like they're just changing stuff randomly. The TLS padlock change has been going on for a while now, and not without reason. As we get to a point where almost everything is served over TLS it doesn't make sense to tell the user every time. It makes m…

> You can still click and see the whole URL. This is just making it easier for the average user to see the most important thing to them, which is the domain name.

Thanks for adding a step when that user's most important thing is telling us folks supporting them what the actual URL they went to. From other folks in this thread[1], it isn't as simple as just a click.

1) https://news.ycombinator.com/item?id=17928598

Re: Chrome 69: “www.” subdomain missing from URL

#197

Post by ddebernardy »

trocadero wrote: post #173
parliament32 wrote: post #118

Considering a subdomain "trivial" is ridiculous... there's a difference between "www.example.com" and "example.com". Not only can they serve different sites, they can even have different DNS records! It seems that "m." is also considered a trivial subdomain. So when a user clicks a link to a "m.facebook.com" uri, they'll be confused why FB looks different when the browser reports it's on "facebook.com". I sincerely h…

>there's a difference between "www.example.com" and "example.com" Can you link to a site where these two are different?

From one of the comments there:

http://www.pool.ntp.org vs http://pool.ntp.org

One takes you to the website about the project, the other goes to a random ntp server.

Re: Chrome 69: “www.” subdomain missing from URL

#198

Post by ehsankia »

macspoofing wrote: post #78
soared wrote: post #60

Earlier quoted context omitted.

99.9% of users have no idea what any of the words you just said mean. The change was made for them, not for you (the .1%)

>The change was made for them, not for you Except, those same users also don't care about things in the address bar. So the change hurts the group of users that actually do care.

They didn't care so far because it was so confusing. The hope is that by showing something that's user-relevant (the name of the website name and the security level), it will become more useful for the average user.

Why should a user see: https://www.wikipedia.org/wiki/Canada?utm=asdioasd&arg=j210d... when all they care about is "Wikipedia.org/wiki/Canada"?

Re: Chrome 69: “www.” subdomain missing from URL

#199

Post by Sohcahtoa82 »

ancarda wrote: post #103
CodesInChaos wrote: post #40

Earlier quoted context omitted.

That weakens the protection the same origin policy offers.

It does? How so?

According to this blog post[0], IE misbehaves with cookies and allows breaking SOP.

The spec says that a cookie flagged with the domain "domain.com" is supposed to only be valid for requests to "domain.com" and not "subdomain.domain.com". A cookie that is intended to be valid for all subdomains is supposed to have a preceding dot, like ".domain.com".

Older versions of IE (That may still be in use) will treat "domain.com" cookies like ".domain.com" cookies, allowing malicious.subdomain.domain.com to access cookies only intended for "domain.com".

[0] https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...

Re: Chrome 69: “www.” subdomain missing from URL

#200

Post by slg »

subway wrote: post #160
wpietri wrote: post #139

Earlier quoted context omitted.

It's not the same issue at all, in that domains with different suffixes are controlled by different people while foo.com and www.foo.com are controlled by the same people. If you have an example of somebody who needs to serve different web content for foo.com and www.foo.com, I look forward to seeing it. But I've never seen one, and when I've seen it happen accidentally it's due to idiocy.

> while foo.com and www.foo.com are controlled by the same people Sometimes. Far from always. In some environments, `www` may be under an entirely different administrative domain, with lesser authority than the top level domain which is delegating web services to the `www` group by way of creating a dns record and/or adding an http(s) redirect to the parent domain. Having some string values arbitrarily considered tri…

Isn't that simply due to internal politics? Whoever owns foo.com might delegate www.foo.com to someone else, but they ultimately control both.
Post reply on HN