Where Am I? NYTimes or Google?

Post by jefftk » Sat, Jul 04, 2020, 4:37 PM UTC

grawprog wrote: post #289

realusername wrote: post #6

Earlier quoted context omitted.

Being completely against AMP for obvious reasons, I'm personally not against signed exchanges itself, this feature could spawn a whole new class of decentralised and harder to censor web hosting, that sounds like a great addition.

What you describe sounds a lot like URL spoofing, which is already pretty much used entirely to trick and scam unsuspecting users into clicking malicious links. Signed exchanges would just be an even harder to detect version of this.

Post by jefftk » Sat, Jul 04, 2020, 4:44 PM UTC

jml7c5 wrote: post #319

domenicd wrote: post #42

Earlier quoted context omitted.

+1. The way I think about it is that signed exchanges are basically a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. Instead you just allow distribution of a single resource (perhaps a bundle), in a crytographically verifiable way. Stated another way, with a typical CDN setup the user has to trust their browser, the CDN, and the source. With signed exchange…

I could see some sort of alternative URL bar (" https://nyt.com/somearticle/ | served by https://somecdn.example.org/blah" ), but complete replacement is far too dangerous and confusing in that it is completely hidden.

Post by fauigerzigerk » Sat, Jul 04, 2020, 4:45 PM UTC

ehsankia wrote: post #296

fauigerzigerk wrote: post #263

Earlier quoted context omitted.

I think this would require an entirely new user interface to make it abundantly clear that publisher and distributor are seperate roles and can be seperate entities. I don't think this should be shoehorned into the URL bar or into some meta info that no one ever reads hidden behind some obscure icon.

Isn't it already the case though with CloudFlare and other CDNs serving most of the content? Very few people really get their content from the actual source server anymore.

Post by jefftk » Sat, Jul 04, 2020, 4:50 PM UTC

simias wrote: post #299

wmf wrote: post #83

Earlier quoted context omitted.

Users don't see DNS records. In the old world they click on a nytimes.com link and get something served from a Fastly server, but in the future AMP world they click on nytimes.com and get it served from a Google server. It isn't different.

I agree with you, if I understand the signed exchange proposal correctly the trust model is effectively similar (NYT explicitly opts to let Fastly pretend to be them through their DNS config in the same way that a signed exchange would let them explicitly opt into letting Google pretend to be them). I'm still opposed to the change, I see this centralization of the web through CDNs as a bad thing, I don't want to make…

Post by tyingq » Sat, Jul 04, 2020, 5:14 PM UTC

esafwan wrote: post #35

superasn wrote: post #2

Yes this has been a big issue for a very long time now. Google wants to push a release where it will display the hostname of the amp site even if the content is being served from google.com[1]. Mozilla (and Apple) are strictly against it and thank god for Mozilla. If Google had a bigger market share this would already be something we would have been living with. I'm sure there are better sources for this, but here is…

Have a look at this: https://blog.cloudflare.com/announcing-amp-real-url/ Cloudflare allow using of same domain to use AMP. In this case, content is served from Cloudflare CDN.