Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where Am I? NYTimes or Google?

theinternetbytes.com

Post reply on HN
Print view View original

261–270 of 381 posts

Re: Where Am I? NYTimes or Google?

#261

Post by 8organicbits »

CGamesPlay wrote: post #125
8organicbits wrote: post #84

Earlier quoted context omitted.

Archive.org makes it clear you are on archive.org. The URL shows archive.org. The page content shows archive.org at the top. [1] Google AMP doesn't show Google on the page. Google is pushing for the URL to show the origin site's URL instead of Google[2]. If an attacker poisons a nytimes.com article served by Google AMP, how does a browser's domain blacklisting help? Block google? Block nytimes.com? Neither makes sens…

I believe you might be misunderstanding the idea behind signed exchanges. To be clear, Signed Exchanges are how AMP should have worked all along. example.com generates a content bundle and signs it. Google.com downloads the bundle and decides to mirror it from their domain. Your browser downloads the bundle from google.com, and verifies that the signature comes from example.com. Your browser is now confident that the…

I'm following.

Imagine that example.com builds the bundle by pulling data from a database. If an attacker can find a way to store malicious content in that database (stored XSS) and that content ends up in a signed bundle that Google AMP serves (similar to cache poisoning) then users will see malicious content. When the stored XSS is removed from the database, Google AMP may continue to serve the malicous signed bundle. So an extra step may be needed to clear the malicious content from Google AMP.

How exactly the attacker influences the bundle is going to be implementation dependent, so some sites may be safe while others are exploitable.

Re: Where Am I? NYTimes or Google?

#262

Post by 0898 »

gorgoiler wrote: post #195

With the utmost respect to you and the other commenters here, when I see positivity about the abstract, hypothetical technical merits of something with a long history of, in practice, being part of an extremely controversial power play it reminds me a lot of the comments I see promoting a widely installed piece of process management software — one which a lot of people don’t really want, whose subtle changes to layer…

Is this some kind of human buffer overflow?

Re: Where Am I? NYTimes or Google?

#263

Post by fauigerzigerk »

capableweb wrote: post #181
mulmen wrote: post #141

Earlier quoted context omitted.

How does centralizing content on Google from multiple sources improve decentralization? The web is already decentralized. That's why it is a web. AMP is a scourge. It's a bad idea being pushed by bad actors.

The current implementation of the AMP cache servers obviously doesn't help the decentralization. I think what Spivak is saying though is right. If we could move from location addressing (dns+ip) to content-addressing , but not via the AMP cache servers, in general, anyone could serve any content on the web. Add in signing of the content addressing, and now you can also verify that content is coming from NYTimes for e…

I think this would require an entirely new user interface to make it abundantly clear that publisher and distributor are seperate roles and can be seperate entities.

I don't think this should be shoehorned into the URL bar or into some meta info that no one ever reads hidden behind some obscure icon.

Re: Where Am I? NYTimes or Google?

#264

Post by catalogia »

gorgoiler wrote: post #195

With the utmost respect to you and the other commenters here, when I see positivity about the abstract, hypothetical technical merits of something with a long history of, in practice, being part of an extremely controversial power play it reminds me a lot of the comments I see promoting a widely installed piece of process management software — one which a lot of people don’t really want, whose subtle changes to layer…

I enjoyed reading this comment. The way you write is fun.

Re: Where Am I? NYTimes or Google?

#265

Post by [deleted] »

gorgoiler wrote: post #249
gsich wrote: post #244

Earlier quoted context omitted.

>Well at least under Google AMP, the pages loaded on time. Yeah, because Google is cheating.

By the way, I was referring to a common English aphorism about punctuality on 20th century Italian railways: https://www.economist.com/science-and-technology/2018/11/03/...

[deleted]

Re: Where Am I? NYTimes or Google?

#266

Post by robin_reala »

gowld wrote: post #259
robin_reala wrote: post #116

Earlier quoted context omitted.

As a user I can choose to block GA, either through URL blocking or through legally mandated cookie choices in some regions (e.g. France). When served from Google I have no choice in the matter.

If you can block GA at the client, you can block google.com at the client, no?

Not if I want AMP pages. (I mean, I don’t, but there are presumably people who do.)

Re: Where Am I? NYTimes or Google?

#267

Post by crazygringo »

bobbydroptables wrote: post #49

AMP seems like a solution in search of a problem. Are people really having trouble with loading speed in 2020? I travel to remote areas in third world countries regularly for work and still don't really have problems loading pages with mobile data. Even if it didn't have all of the problems associated with it I just don't get the point. I don't need Google to repackage a website with less useability. It's frequently…

> Are people really having trouble with loading speed in 2020?

Huh? Yes. Hugely. I'm on my fast home internet using a new iPhone I bought two months ago, and loading a NYTimes article just took 8 seconds. God only knows if it's bounded by network or CPU or both, if the problem is frameworks or ads or what. And it isn't even "stuck" on anything -- I watch the blue loading bar in Safari move pretty smoothly across the top.

I did a search for a NYT article on Google, clicked it, and it appeared instantaneously.

That's an insane difference. I know everyone hates AMP here, but when I've got my user hat on rather than my developer hat... it's unbelievably more performant.

Re: Where Am I? NYTimes or Google?

#268

Post by Ericson2314 »

dependenttypes wrote: post #228
realusername wrote: post #6

Earlier quoted context omitted.

Being completely against AMP for obvious reasons, I'm personally not against signed exchanges itself, this feature could spawn a whole new class of decentralised and harder to censor web hosting, that sounds like a great addition.

> this feature could spawn a whole new class of decentralised and harder to censor web hosting How so?

https://docs.ipfs.io/concepts/dnslink/ this is how it should be

Re: Where Am I? NYTimes or Google?

#269

Post by yesenadam »

gorgoiler wrote: post #249
gsich wrote: post #244

Earlier quoted context omitted.

>Well at least under Google AMP, the pages loaded on time. Yeah, because Google is cheating.

By the way, I was referring to a common English aphorism about punctuality on 20th century Italian railways: https://www.economist.com/science-and-technology/2018/11/03/...

It seems I have to "register" with the Economist to read that.

Re: Where Am I? NYTimes or Google?

#270

Post by [deleted] »

crazygringo wrote: post #267
bobbydroptables wrote: post #49

AMP seems like a solution in search of a problem. Are people really having trouble with loading speed in 2020? I travel to remote areas in third world countries regularly for work and still don't really have problems loading pages with mobile data. Even if it didn't have all of the problems associated with it I just don't get the point. I don't need Google to repackage a website with less useability. It's frequently…

> Are people really having trouble with loading speed in 2020? Huh? Yes. Hugely. I'm on my fast home internet using a new iPhone I bought two months ago, and loading a NYTimes article just took 8 seconds . God only knows if it's bounded by network or CPU or both, if the problem is frameworks or ads or what. And it isn't even "stuck" on anything -- I watch the blue loading bar in Safari move pretty smoothly across the…

[deleted]
Post reply on HN