Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google no longer providing original URL in AMP for image search results

twitter.com

Post reply on HN
Print view View original

301–310 of 566 posts

Re: Google no longer providing original URL in AMP for image search results

#301

Post by wizzwizz4 »

Kalium wrote: post #286
throwaway2048 wrote: post #285

Earlier quoted context omitted.

If you want an honest discussion try toning down the smarmy bullshit.

I was trying to be nice. I'll stop now. Got any material to back up your rather substantial claims? Right now you're coming across as wildly paranoid and offering absolutely nothing in support but more of the same. Someone else's personal incredulity is, IMO, not a great form of evidence.

Your priors are terrible. Extrapolation from past experience is a perfectly valid form of reasoning: it's called “induction”, and most people consider it a valid form of reasoning.

https://en.wikipedia.org/wiki/Inductive_reasoning

Or, to mirror your tone:

Being paranoid does sound like an issue! However, just because other people's personal incredulity hasn't been a great form of evidence in the past, that doesn't mean it isn't a good form of evidence at the moment. Got any reason to believe it isn't?

Re: Google no longer providing original URL in AMP for image search results

#302

Post by runawaybottle »

snazz wrote: post #160
runawaybottle wrote: post #111

Earlier quoted context omitted.

Can you give us details on what phone you are using?

It's an iPhone 8. Safari with content blockers.

Then I mostly don’t believe you. Benchmarks please, I doubt you are unable to load a JavaScript heavy site.

Re: Google no longer providing original URL in AMP for image search results

#303

Post by Jayschwa »

ralmidani wrote: post #127

I got a new computer (Mac Mini) last week and, as the ritual usually goes, I opened Safari and was about to type “google.com/chrome”, then stopped myself and went to “getfirefox.com” instead. It’s been a while since I gave FF a serious look, and so far I haven’t felt like I’m missing anything. Next up, I need to change my default search engine to DDG. What’s a good privacy-oriented, web-based email service? I’ve hear…

I migrated from Gmail to Fastmail a couple years ago and I have been happy with it. Migrating existing emails from Gmail into Fastmail was easy, as was setting up forwarding from Gmail to Fastmail for all future emails. The hardest part was just updating accounts across the web to use the new email. Since I'm using a custom domain with Fastmail, I can change account emails to things like foo.com@mydomain.com or bar.net@mydomain.com.

Re: Google no longer providing original URL in AMP for image search results

#304

Post by chipperyman573 »

nojito wrote: post #52
tyingq wrote: post #43

Earlier quoted context omitted.

AMP keeps people on Google owned properties longer[1], so it's a revenue driver. [1] Via things like taking over swipe motions and the back button on carousel launched pages, for example.

It also allows for very easy tracking across the internet which is the real long term play. They will also be able to release "unblockable" advertising to amp pages eventually.

Why would Amp allow the ads to be less blockable? Extensions still run

Re: Google no longer providing original URL in AMP for image search results

#305

Post by u801e »

Arnavion wrote: post #228
u801e wrote: post #199

Earlier quoted context omitted.

~~It wouldn't work because the phishing site would lack the private key needed to validate your client-side certificate and the TLS connection would not be established. This is assuming that the legitimate website itself signed your certificate signing request (CSR) to create the client-side certificate.~~ Edit: What I posted above is not correct. What I should have said was that the server would validate the client…

>It wouldn't work because the phishing site would lack the private key needed to validate your client-side certificate and the TLS connection would not be established. That is not how TLS works. A server can trust a client based on the certificate the client presents. A client can't distrust a server based on the certificate the client presents. "The phishing site would lack the private key needed to validate your cl…

> That is not how TLS works. A server can trust a client based on the certificate the client presents. A client can't distrust a server based on the certificate the client presents.

You're correct; I posted inaccurate information.

> validating a cert does not involve the private key in any way.

What I should have said was that the server would validate the client cert by checking whether the certificate is valid according to the authority that signed it (which could be the server serving as a CA itself or a third party CA).

As for the original question, I guess it's possible for a phishing website to not bother validating the client certificate presented at all and allow the TLS negotiation to succeed.

If there was something that could instruct a browser to only send a given client certificate if it only receives a certain server certificate, then it would be much harder for a phishing website to work, because the browser would not send the client certificate to the wrong server.

Re: Google no longer providing original URL in AMP for image search results

#306

Post by pbhjpbhj »

snazz wrote: post #104
iagovar wrote: post #93

Earlier quoted context omitted.

Yeah, but then you have another vendor lock in, not to mention that apple products are expensive for me, I don't have an US salary.

I just had a discussion with someone on Lobsters about the actual cost of a lower-end iPhone versus a similarly-priced Android phone and the iPhone appeared cheaper: > The Pixel 4 is $799 and the Pixel 3a is $399 (although it may be on sale right now depending on your region). The iPhone 11 is $699 and the iPhone SE (2nd generation) is $399. Both provide additional discounts if you trade in your current phone (and si…

Usually with tech the $ price is the £ price. Android phones are about £100 (sim-less) for a good lower-end model. £800 is very high end.

Example, https://www.tescomobile.com/shop/pay-as-you-go/motorola/moto... £90.

Low end is c.£50.

Re: Google no longer providing original URL in AMP for image search results

#307

Post by Kalium »

wizzwizz4 wrote: post #301
Kalium wrote: post #286

Earlier quoted context omitted.

I was trying to be nice. I'll stop now. Got any material to back up your rather substantial claims? Right now you're coming across as wildly paranoid and offering absolutely nothing in support but more of the same. Someone else's personal incredulity is, IMO, not a great form of evidence.

Your priors are terrible. Extrapolation from past experience is a perfectly valid form of reasoning: it's called “induction”, and most people consider it a valid form of reasoning. https://en.wikipedia.org/wiki/Inductive_reasoning Or, to mirror your tone: Being paranoid does sound like an issue! However, just because other people's personal incredulity hasn't been a great form of evidence in the past , that doesn't m…

I understand that a lot of people genuinely do not trust Google. It's been their experience, and thus their priors, that Google is attempting to assert control over all aspects of the web.

Perhaps someone can find some evidence that allows for deductive reasoning on this subject. I would really like it. Otherwise, all we've got is competing lines of perfectly valid incompatible inductive reasoning. Then people choose the one they like or fear the most.

That's a scenario that my priors suggest is not likely to be useful for producing valuable models of the future. Instead, it's a scenario where the primary outcome I expect is for confirmation biases to rule the day.

Re: Google no longer providing original URL in AMP for image search results

#308

Post by u801e »

ralph84 wrote: post #240
u801e wrote: post #199

Earlier quoted context omitted.

~~It wouldn't work because the phishing site would lack the private key needed to validate your client-side certificate and the TLS connection would not be established. This is assuming that the legitimate website itself signed your certificate signing request (CSR) to create the client-side certificate.~~ Edit: What I posted above is not correct. What I should have said was that the server would validate the client…

A private key is not required to validate certs (private keys are for generating certs). A cert chain back to a trusted root cert is required for validation. A phishing site would just trust all certs.

I realize that now. One way to mitigate it would be to have the browser somehow tie a given client certificate with a particular website. That is, the client cert for news.ycombinator.com, would only be presented if I try to connect with that server and nothing else.

That way, if I go to a phishing website that pretended to be Hacker News, my client certificate would not be sent and my browser could warn me by saying that the connection is not using a client certificate. Right now, if we only rely on server side certificates, there's nothing stopping a phishing website from using Let's Encrypt to show the secure connection icon in the URL bar and tricking me into thinking it's a legitimate server.

Re: Google no longer providing original URL in AMP for image search results

#309

Post by mdavidn »

Jayschwa wrote: post #303
ralmidani wrote: post #127

I got a new computer (Mac Mini) last week and, as the ritual usually goes, I opened Safari and was about to type “google.com/chrome”, then stopped myself and went to “getfirefox.com” instead. It’s been a while since I gave FF a serious look, and so far I haven’t felt like I’m missing anything. Next up, I need to change my default search engine to DDG. What’s a good privacy-oriented, web-based email service? I’ve hear…

I migrated from Gmail to Fastmail a couple years ago and I have been happy with it. Migrating existing emails from Gmail into Fastmail was easy, as was setting up forwarding from Gmail to Fastmail for all future emails. The hardest part was just updating accounts across the web to use the new email. Since I'm using a custom domain with Fastmail, I can change account emails to things like foo.com@mydomain.com or bar.n…

It's also easy to configure a Fastmail account to fetch messages from a Gmail inbox and even send messages via Gmail, for a seamless transition while updating accounts.

Re: Google no longer providing original URL in AMP for image search results

#310

Post by pbhjpbhj »

coldpie wrote: post #88
ojosilva wrote: post #73

Earlier quoted context omitted.

OMG! Why would Mozilla kill extensions on mobile (android)? It would make mobile unusable for me. In fact that's the reason I barely browse the internet on my iPad: Firefox never had add ons on iOS due to Apple restrictions. I hope that's just FUD!

They're pushing out the upgrade to everyone soon, and it only supports certain, whitelisted extensions. https://blog.mozilla.org/firefox/firefox-android-new-feature...

Sorry, but wtf???

"3. Extension-ready

This update will initially include support for one of the most popular extensions on Android, uBlock Origin. Additional extensions will be supported in subsequent releases so you can customize and expand your mobile browsing experience even more."

Why has Moz turned in to this almost fascist company all of a sudden. Like, what? Kill all but whitelisted extensions, which users asked for that?

Let me guess, there'll be an accidental reset of people's config to enable them to be auto-updated and then there extensions will stop working ... I wouldn't put it passed then to then have already secured control over uBlock and we'll have unlockable ads before you know it.

Hope I'm wrong.

Post reply on HN