Where Am I? NYTimes or Google? • Hacker News Board

Re: Where Am I? NYTimes or Google?

#191

Post by londons_explore » Sat, Jul 04, 2020, 9:19 AM UTC

vinay_ys wrote: post #96

CGamesPlay wrote: post #20

Earlier quoted context omitted.

What? The signing allows the content to be mirrored in other locations with guarantees about consistency. It doesn't imply anything more about the content than SSL does.

Along with signing, we need explicit content cache busting and explicit allowed mirrors list (which can be revoked instantly). Then it would be at par with TLS + current cache busting mechanisms on top of TLS.

As long as javascript on the page has some way to inspect the signatures and where it was delivered from, you can implement cache busting, allowed mirrors, and invalidation yourself however you please.

Re: Where Am I? NYTimes or Google?

#192

Post by icebraining » Sat, Jul 04, 2020, 9:22 AM UTC

ignoramous wrote: post #101

domenicd wrote: post #42

Earlier quoted context omitted.

+1. The way I think about it is that signed exchanges are basically a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. Instead you just allow distribution of a single resource (perhaps a bundle), in a crytographically verifiable way. Stated another way, with a typical CDN setup the user has to trust their browser, the CDN, and the source. With signed exchange…

> a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec... is a thing now.

The session key, which is given carte blanche by the TLS cert to sign whatever it wants under the domain, is still controlled by Cloudflare.

To put it simply, Cloudflare still controls the content. The proposal here would avoid that, by allowing Cloudflare to transmit only pre-signed content.

Re: Where Am I? NYTimes or Google?

#193

Post by remus » Sat, Jul 04, 2020, 9:26 AM UTC

reaperducer wrote: post #142

People have been railing against Google's Amp on HN for years, and I think I finally figured out what it's for. It's Google way of combatting phone apps. If all of the world's information — especially current news and similar information — moves from the open web into apps, then Google can no longer crawl, index, or scrape that information for its own use. The rise of the mobile phone app is a threat to Google on so…

I think this is a fairly cynical take, as having news on the web is also pretty great for users.

Imagine if instead of having all news stories a quick search away you instead had to install apps from X different news sources (and inevitably grant them permission to access your location, contacts list, name of first born child etc.). It'd create lots of little silos of news with very little ability to go outside those silos.

Put another way, the web is a great platform for news. It does benefit Google, but it also benefits the billions of people who can freely access a huge range of sources.

Re: Where Am I? NYTimes or Google?

#194

Post by Kevin605 » Sat, Jul 04, 2020, 9:27 AM UTC

saagarjha wrote: post #183

Kevin605 wrote: post #164

Earlier quoted context omitted.

This has already happened in China, where Baidu (The Chinese equivalent of Google) can’t crawl any articles from WeChat (The Chinese equivalent of Medium), as a result, the usefulness of its search result has deteriorated significantly. Recently, Baidu has been trying to start its own publishing platform with little success.

> WeChat (The Chinese equivalent of Medium) TIL

Well, it’s more like WhatsApp, Medium, Venmo, and Facebook all combined into one giant app.

Re: Where Am I? NYTimes or Google?

#195

Post by gorgoiler » Sat, Jul 04, 2020, 9:36 AM UTC

With the utmost respect to you and the other commenters here, when I see positivity about the abstract, hypothetical technical merits of something with a long history of, in practice, being part of an extremely controversial power play it reminds me a lot of the comments I see promoting a widely installed piece of process management software — one which a lot of people don’t really want, whose subtle changes to layers of abstraction introduce new and unexpected bugs that can only be fixed by further coupling, and which can also be reasonably described as a single entity politically maneuvering itself to bring order to the chaos at the expense of living in, for want of a better term, a dictatorship.

Well at least under Google AMP, the pages loaded on time.

Re: Where Am I? NYTimes or Google?

#196

Post by rpastuszak » Sat, Jul 04, 2020, 9:37 AM UTC

superasn wrote: post #2

Yes this has been a big issue for a very long time now. Google wants to push a release where it will display the hostname of the amp site even if the content is being served from google.com[1]. Mozilla (and Apple) are strictly against it and thank god for Mozilla. If Google had a bigger market share this would already be something we would have been living with. I'm sure there are better sources for this, but here is…

Remember when Google was telling us that third-party cookies are there to protect us, and Safari/Firefox/Edge are just reckless and pose a risk to users by blocking them?

Re: Where Am I? NYTimes or Google?

#197

Post by Clausinho » Sat, Jul 04, 2020, 9:41 AM UTC

gorgoiler wrote: post #195

With the utmost respect to you and the other commenters here, when I see positivity about the abstract, hypothetical technical merits of something with a long history of, in practice, being part of an extremely controversial power play it reminds me a lot of the comments I see promoting a widely installed piece of process management software — one which a lot of people don’t really want, whose subtle changes to layer…

I'm out of the loop, care to elaborate which PM software you are referring to?

Re: Where Am I? NYTimes or Google?

#198

Post by Jabbles » Sat, Jul 04, 2020, 9:41 AM UTC

rpastuszak wrote: post #196

superasn wrote: post #2

Yes this has been a big issue for a very long time now. Google wants to push a release where it will display the hostname of the amp site even if the content is being served from google.com[1]. Mozilla (and Apple) are strictly against it and thank god for Mozilla. If Google had a bigger market share this would already be something we would have been living with. I'm sure there are better sources for this, but here is…

Remember when Google was telling us that third-party cookies are there to protect us, and Safari/Firefox/Edge are just reckless and pose a risk to users by blocking them?

Please provide a link, I could only find this, which suggests Google has reversed course:

https://www.techradar.com/uk/news/google-is-phasing-out-thir...

Re: Where Am I? NYTimes or Google?

#199

Post by icebraining » Sat, Jul 04, 2020, 9:41 AM UTC

izacus wrote: post #152

rtsil wrote: post #74

Earlier quoted context omitted.

The pattern is dangerous because it trains the user to dissociate URL and legitimate content, and the best tool at our disposal against phishing is still the ability to use the URL to ascertain the legitimacy of a content.

URLs haven't been associated with legitimate content for a long time now, since most of the things come from giant CDN companies like CloudFlare anyway. What you're seeing in URL bar has very little to do with where the JS code executed on your computer is coming from.

Does it matter if it comes from a CDN rented by the NYT or a computer owned by DigitalOcean but rented by the NYT?

What matters is that the domain points to where the NYT considers is the correct source of their content.

Re: Where Am I? NYTimes or Google?

#200

Post by gorgoiler » Sat, Jul 04, 2020, 9:43 AM UTC

Clausinho wrote: post #197

gorgoiler wrote: post #195

With the utmost respect to you and the other commenters here, when I see positivity about the abstract, hypothetical technical merits of something with a long history of, in practice, being part of an extremely controversial power play it reminds me a lot of the comments I see promoting a widely installed piece of process management software — one which a lot of people don’t really want, whose subtle changes to layer…

I'm out of the loop, care to elaborate which PM software you are referring to?

Edit: it’s too controversial I think to introduce it by name. Googling “RedHat’s replacement for Linux init” would be a good start.