Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where Am I? NYTimes or Google?

theinternetbytes.com

Post reply on HN
Print view View original

51–60 of 381 posts

Re: Where Am I? NYTimes or Google?

#51

Post by ocdtrekkie »

bobbydroptables wrote: post #49

AMP seems like a solution in search of a problem. Are people really having trouble with loading speed in 2020? I travel to remote areas in third world countries regularly for work and still don't really have problems loading pages with mobile data. Even if it didn't have all of the problems associated with it I just don't get the point. I don't need Google to repackage a website with less useability. It's frequently…

AMP solves a problem, it just doesn't solve a problem for users. It's an anticompetitive play and it's helping exactly who it is supposed to help.

Re: Where Am I? NYTimes or Google?

#52

Post by foepys »

realusername wrote: post #50
jhhh wrote: post #47

Earlier quoted context omitted.

The point wasn't that this technology would uniquely enable XSS attacks, but rather that it could allow malicious actors to persist particular attacks for the duration of the validity of the signed content. Any brief vulnerability in a website now becomes serializable. They considered this already. Look in the draft "6.3. Downgrades": "Signing a bad response can affect more users than simply serving a bad response, s…

I see indeed, I don't think they are going with the right approach here, there should be an automatic way to upgrade signed content / check for updates, short signatures just destroys the benefits of the feature.

It's the only way to do it. TLS has shown that OCSP and the likes are not adding significant security and short certificate expiration is the only way to go.

The serving nodes are not necessarily under control of a well intended party that complies with upgrade requests.

Re: Where Am I? NYTimes or Google?

#53

Post by fizwhiz »

IgorPartola wrote: post #12

I truly hope whoever keeps pushing AMP such as it is has to birth a hedgehog backwards. I mean, at least add some way to opt out of this shit. This is why I don’t use Google as my mobile search engine. I honestly still would if my browser allowed me to disable or bypass it, but nope. No extensions for me because Apple won’t allow for anything like that. /rant

> has to birth a hedgehog backwards

You have every right to be indignant, but I could have really done without that imagery.

Re: Where Am I? NYTimes or Google?

#54

Post by TheSpiceIsLife »

earthboundkid wrote: post #48
twhitmore wrote: post #15

The whole AMP thing seems anti-competitive and hostile to the open web. It's a really bad look on Google's part to be pushing this.

There has been no regulatory action since Microsoft (which happened as Google was being born), so the tech giants have forgotten fear and no longer self-regulate out of simple self-interest.

Another way of looking at it is: they absolutely are self-regulating.

And it appears to be a problem.

Another problem is, there's effectively no distinction between regulator and regulatee.

Re: Where Am I? NYTimes or Google?

#55

Post by CGamesPlay »

8organicbits wrote: post #45
CGamesPlay wrote: post #20

Earlier quoted context omitted.

What? The signing allows the content to be mirrored in other locations with guarantees about consistency. It doesn't imply anything more about the content than SSL does.

If Google AMP is acts like a cache of content, then cache poisoning attacks are a concern. How those cached items expire will determine how long an attacker who poisons the cache can serve malicious content.

Why does Archive.org get a pass on this one? Signed responses mean that there's a very clear way to leverage the browser's domain blacklisting technology to stop the spread of malware, which isn't presently possible for any content mirrors on the web.

Re: Where Am I? NYTimes or Google?

#56

Post by untog »

jacob019 wrote: post #43

New York Times and all the other publishers don't have to participate in this crap. It's shameful that they cede authority over their content so easily in exchange for a vuage promise of more visibility. There are so many better ways.

It’s not a vague promise, it’s an extremely explicit one. Search results for news contain a “top carousel”, a horizontally scrolling box that shows cards for different articles. On most phones it takes up most of the screen. If you want to be in the carousel (i.e. if you want your site to be visible near the top of search results) you must use AMP. No ifs and buts about it.

If NYTimes and every other news organisation refused to participate then yes, Google would be in trouble. But they can rely on good old divide and conquer: these news organisations all compete with each other. All it would take is for one to starting producing AMP content again and they’d vacuum up all the search traffic, and all the other sites would follow them immediately.

Re: Where Am I? NYTimes or Google?

#57

Post by entire-name »

8organicbits wrote: post #45
CGamesPlay wrote: post #20

Earlier quoted context omitted.

What? The signing allows the content to be mirrored in other locations with guarantees about consistency. It doesn't imply anything more about the content than SSL does.

If Google AMP is acts like a cache of content, then cache poisoning attacks are a concern. How those cached items expire will determine how long an attacker who poisons the cache can serve malicious content.

At that point, wouldn't the approach be to defend from the client side? Namely, we can instruct the client to not trust any content sign by such-and-such keys. This can be done by pushing out a certificate revocation, etc.

Re: Where Am I? NYTimes or Google?

#58

Post by skybrian »

domenicd wrote: post #42
Spivak wrote: post #5

Earlier quoted context omitted.

I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.

+1. The way I think about it is that signed exchanges are basically a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. Instead you just allow distribution of a single resource (perhaps a bundle), in a crytographically verifiable way. Stated another way, with a typical CDN setup the user has to trust their browser, the CDN, and the source. With signed exchange…

It seems like there is a risk that an old version of a bundle will get served instead of a new one by an arbitrary host? Maybe the bundle should have a list of trusted mirrors?

Re: Where Am I? NYTimes or Google?

#59

Post by tyingq »

Spivak wrote: post #5
superasn wrote: post #2

Yes this has been a big issue for a very long time now. Google wants to push a release where it will display the hostname of the amp site even if the content is being served from google.com[1]. Mozilla (and Apple) are strictly against it and thank god for Mozilla. If Google had a bigger market share this would already be something we would have been living with. I'm sure there are better sources for this, but here is…

I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.

The AMP spec REQUIRES you include a Google controlled JavaScript URL with the AMP runtime. So technically the whole signing bit is a little moot, given that the JS could do whatever it wanted.

Re: Where Am I? NYTimes or Google?

#60

Post by dannyw »

Spivak wrote: post #5
superasn wrote: post #2

Yes this has been a big issue for a very long time now. Google wants to push a release where it will display the hostname of the amp site even if the content is being served from google.com[1]. Mozilla (and Apple) are strictly against it and thank god for Mozilla. If Google had a bigger market share this would already be something we would have been living with. I'm sure there are better sources for this, but here is…

I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.

The plan is bad because google currently tracks all of your activities inside AMP hosted pages site in their support article.

Google controls the AMP project and the AMP library. They can start rewriting all links in AMP containers to Google’s AMP cache and track you across the entire internet, even when you are 50 clicks away from google.com.

Post reply on HN