Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where Am I? NYTimes or Google?

theinternetbytes.com

Post reply on HN
Print view View original

351–360 of 381 posts

Re: Where Am I? NYTimes or Google?

#351

Post by dang »

gorgoiler wrote: post #195

With the utmost respect to you and the other commenters here, when I see positivity about the abstract, hypothetical technical merits of something with a long history of, in practice, being part of an extremely controversial power play it reminds me a lot of the comments I see promoting a widely installed piece of process management software — one which a lot of people don’t really want, whose subtle changes to layer…

We detached this subthread from https://news.ycombinator.com/item?id=23729479.

Re: Where Am I? NYTimes or Google?

#352

Post by eeZah7Ux »

eeZah7Ux wrote: post #226
snowwrestler wrote: post #98

Earlier quoted context omitted.

Can we please stop trying to pretend AMP is some sort of community-driven open source project? AMP was created by Google, for the benefit of Google. We are not obligated to play along every time a company says “open source.”

> We are not obligated to play along every time a company says “open source.” This is the point. People easily confuse "open source" with "free software" and "community driven". A lot of corporate-driven open source greenwashed the dark patterns of closed source: centralized development, user lock-in, walled gardens, poor backward compatibility, forced software and hardware upgrades.

Funny how I get bunches of downvotes on this account but never on other accounts. Time to switch.

Re: Where Am I? NYTimes or Google?

#353

Post by gregable »

simion314 wrote: post #115
gregable wrote: post #71

Earlier quoted context omitted.

While that's theoretically possible, the library can be inspected and does not do these things.

Could Google give specific persons different versions or is technically impossible?

Technically yes, but not very practically. The domain is cookieless, so it would be difficult to even identify a specific user, other than by IP. Also, the JavaScript resource is delivered from the cache with a 1 year expiry, which means most times it's loaded it will be served from browser cache rather than the web.

Re: Where Am I? NYTimes or Google?

#354

Post by gregable »

donaltroddyn wrote: post #99
gregable wrote: post #81

Earlier quoted context omitted.

The same could be said of any CDN hosted javascript library. For example: jquery. There is an open intent to implement support for publishers self-hosting the AMP library as well.

For most JS served by CDN, you can (and should) use Subresource Integrity to verify the content. At least the last time I was involved in an AMP project, Google considered AMP to be an "evergreen" project and did not allow publishers to lock in to a specific version.

Long term versions are now supported, so publishers can lock in a specific version.

Publisher hosted copies are in the pipeline, as I referenced in the parent comment. My choice of verbiage was a bit confusing it appears.

Re: Where Am I? NYTimes or Google?

#355

Post by gregable »

tyingq wrote: post #337
gregable wrote: post #336

Earlier quoted context omitted.

https://github.com/ampproject/amphtml/issues/25873

Note "open", i.e., unresolved. Perhaps in a less positive light, "how to enabled signed exchanges/AMP without controlling it" .

Correct. Open as in not resolved yet, but intended to be resolved in the future.

Re: Where Am I? NYTimes or Google?

#356

Post by gregable »

xg15 wrote: post #208
Spivak wrote: post #5

Earlier quoted context omitted.

I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.

I agree, if we finally got a way to have working bundles on the web, that would be extremely useful. (And would also restore some of the capabilities of browsers to work without internet connection). It seems to me, a lot of the security concerns come from the requirements to make pages served live and pages served from bundles indistinguishable to a user - a requirement that really only makes sense if you're Google…

I believe the issue with this is that users already largely don't understand decorations in the URL. For example, the difference between a lock and an extended verification certificate bubble. Educating a user on what a bundle URL means technically may be exceedingly challenging.

Re: Where Am I? NYTimes or Google?

#357

Post by gregable »

olingern wrote: post #330
Spivak wrote: post #5

Earlier quoted context omitted.

I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.

The problem is ownership. Google is “stealing” or caching content for what they consider a better web. I don’t support ads but I also don’t support Google serving a version of the page that steals money from content creators. So, therein lies the problem: choice. I can imagine a future where amp is ubiquitous and Google begins serving ads on amp content. Luckily, companies have to make money and amp is not in most pe…

Signed exchanges guarantee that the content cannot be modified by the cache, such as ad injection.

Google has never injected ads into any cache served AMP document (technically if the publisher uses AdSense, this is false, but that's not the point you are making).

It's difficult to follow what definition of theft is being suggested. The cache does not modify the document rendering, it's essentially a proxy. In a semantic sense, this is no different than your ISP delivering the page or your WiFi router.

Re: Where Am I? NYTimes or Google?

#358

Post by gregable »

tyingq wrote: post #317
tgv wrote: post #149

Earlier quoted context omitted.

AMP is of course not P2P.

I think the point is that signed exchanges ( https://developers.google.com/web/updates/2018/11/signed-exc... ) could potentially be useful, if separated from AMP, and made an actually secure thing. Like, for example, the spec doesn't require specific Google controlled js URLS to be in the content.

Signed exchanges is actually separate spec from AMP. The browser implements it independently. There is no requirement for AMP pages to use signed exchanges nor for signed exchanges to be AMP.

Re: Where Am I? NYTimes or Google?

#359

Post by gregable »

colordrops wrote: post #85
Spivak wrote: post #5

Earlier quoted context omitted.

I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.

Why do they need a special extension though? What's wrong with DNS?

Signed exchanges are an extension to digital certificates, such as used for TLS. This is independent of DNS.

Re: Where Am I? NYTimes or Google?

#360

Post by joshuamorton »

8organicbits wrote: post #261
CGamesPlay wrote: post #125

Earlier quoted context omitted.

I believe you might be misunderstanding the idea behind signed exchanges. To be clear, Signed Exchanges are how AMP should have worked all along. example.com generates a content bundle and signs it. Google.com downloads the bundle and decides to mirror it from their domain. Your browser downloads the bundle from google.com, and verifies that the signature comes from example.com. Your browser is now confident that the…

I'm following. Imagine that example.com builds the bundle by pulling data from a database. If an attacker can find a way to store malicious content in that database (stored XSS) and that content ends up in a signed bundle that Google AMP serves (similar to cache poisoning) then users will see malicious content. When the stored XSS is removed from the database, Google AMP may continue to serve the malicous signed bund…

Signed exchanges can only serve static content, so it's not clear what you could do maliciously.
Post reply on HN