Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 69: “www.” subdomain missing from URL

bugs.chromium.org

Post reply on HN
Print view View original

611–620 of 919 posts

Re: Chrome 69: “www.” subdomain missing from URL

#611

Post by pvorb »

chiefalchemist wrote: post #591
pests wrote: post #563

Earlier quoted context omitted.

You seem shocked at this with word usage like "actual users", "real url's" and "actually no idea" But how are we to expect users to know any better until general technology literacy improves? Many people can't tell you the difference between a modem, router, OS, browser, or website. I remember years ago sitting down with my elderly grandmother trying to show her how to use a desktop... We are too close to our work so…

> "Many people can't tell you the difference between a modem, router, OS, browser, or website." They don't care, nor should they. How many people know how many spark plugs are in their car? You're correct. We, the more tech-literate, take too much for granted; and most experiences and learning curves are too far over the head of the "average" user. It's not them. It's us.

I think the comparison to spark plugs is misleading when we talk about URLs and security.

It's more like looking in the mirror before changing lanes. It's something you need to check in order to stay safe.

Mirrors, like URLs, are just an implementation detail. But since currently driving works with mirrors, you have to learn how to use them.

Re: Chrome 69: “www.” subdomain missing from URL

#612

Post by tazard »

baby wrote: post #576
lwansbrough wrote: post #408

Earlier quoted context omitted.

Many MANY legacy sites serve different information at those two domains.

And this is wrong.

Maybe you have a niche target and not looking for mass adoption. It's not "wrong" it's just not normally the way things are done.

Re: Chrome 69: “www.” subdomain missing from URL

#613

Post by Klathmon »

idbehold wrote: post #265
fireattack wrote: post #99

I'm ok with hiding "www.", but it also hides "m." which is sometimes very confusing (I once opened a m.facebook.com link and was very puzzled why it uses the mobile site when the URl bar just shows "facebook.com").

What you may be surprised to learn is that Chrome isn't just stripping "www." from the beginning of the subdomain. "subdomain.www.domain.com" displays as "subdomain.domain.com"

I just downloaded canary and tried it and you are absolutely right.

about.www.github.io shows as about.github.io

I'm on board with this change in general, but this is absolutely something that needs to be fixed.

Not only is that just annoying and wrong, but it could be dangerous in some situations.

Also, it doesn't just stop at one removal.

    http://www.www.about.www.www.stuff.www.www.example.com
shows as

    about.stuff.example.com
Interestingly though it doesn't remove it if it's the TLD, or the actual domain (so stuff.www.whatever shows as stuff.www.whatever).

Re: Chrome 69: “www.” subdomain missing from URL

#614

Post by simsla »

trjordan wrote: post #548

It's technically correct that www.example.com and example.com are different domains and can serve different stuff. So are https://example.com and http://example.com . If you serve materially different content based on small differences, that's user-hostile, and common tools have no obligation to support you. Chrome shouldn't cater to sites that change behavior based on a www prefix, because the vast majority of users…

I agree, but Google doesn't just get rid of prefixes.

news.ycombinator.www.com would get normalized to news.ycombinator.com (not sure what would happen when using the www tld)

That's an extreme example, but there's an obvious security risk. This is a half assed change with buggy behaviour, regardless of whether you think www.domain.tld is materially different from domain.tld or not.

Re: Chrome 69: “www.” subdomain missing from URL

#615

Post by pvorb »

masswerk wrote: post #608
mrec wrote: post #582

Earlier quoted context omitted.

Not sure if serious, but no. Anyone can copy a favicon; the point of an identicon is that it's generated from the domain name, so subverting it would require an attacker to find a hash collision with a visually similar domain.

Sorry, I mistook "that is rendered from the domain" for "rendered from a resource from the domain". However, teach users to read domain names! If users do not grasp the general concept, e.g., if the supposed identity is just "example" (possibly with some decoration considered insignificant) and not "example.com", how are they supposed to survive? Domains have been around for more than a quarter of a century, the Inte…

Yes, it would be nice if every child would learn these basics in school.

Re: Chrome 69: “www.” subdomain missing from URL

#616

Post by lvs »

sofaofthedamned wrote: post #497
parliament32 wrote: post #118

Considering a subdomain "trivial" is ridiculous... there's a difference between "www.example.com" and "example.com". Not only can they serve different sites, they can even have different DNS records! It seems that "m." is also considered a trivial subdomain. So when a user clicks a link to a "m.facebook.com" uri, they'll be confused why FB looks different when the browser reports it's on "facebook.com". I sincerely h…

Oh come on. "www." was used as a way of delineating what was a web address. Hence the fashion of putting that there so people knew you had to do it in the browser. Before then people used to also put the " http://" on there, and the combination of the two on vehicles/signs was ridiculous. We're now in a web world. People know what a URL is. "domain.com" isn't ambiguous, it's obvious to man, beast or child that you ty…

What about amp. prefix? You know that's the whole point of this, right? They're going to hide the fact that you're viewing the entire web through amp.

Re: Chrome 69: “www.” subdomain missing from URL

#617

Post by wwweston »

abalone wrote: post #509
parliament32 wrote: post #431

Earlier quoted context omitted.

What exactly is the usability improvement from hiding part of the domain name? Maybe we should be hiding ".com" because that's trivial too? Better yet, why show "google" at all if from the page it's clear you're on Google? Might as well just fullscreen the content pane and be done with it.

> What exactly is the usability improvement from hiding part of the domain name? Quite simply the www subdomain is confusing and unnecessary. See comment from the ISP admin I cited re: user training. > Maybe we should be hiding ".com" because that's trivial too? Better yet, why show "google" at all if from the page it's clear you're on Google? Those aren't really serious counterexamples. ".com" is obviously not trivi…

> Quite simply the www subdomain is confusing and unnecessary.

Sometimes it's unnecessary. How is it confusing? Millions of non-sophisticated users became sophisticated users typing it, millions more type it every day. It doesn't seem prima facie more confusing than a pronoun or other oft-repeated article. Consider the beginning of my last sentence in this paragraph -- would you consider the "It" confusing, even though it's not strictly necessary?

> Again your reaction is just sort of knee-jerk exaggerated resistance to change

Perhaps your reaction is knee-jerk teleology of change as progress?

As a suggestion: maybe spend less time characterizing the approach of people that you disagree with on this topic, and more time articulating actual arguments ("the www subdomain is confusing and unnecessary" counts, even though it's arguably not particularly strong), unless you'd eventually prefer it when people make the discussion partly about the shortcomings of your approach, which are far more glaring than you've clearly spent time considering.

Re: Chrome 69: “www.” subdomain missing from URL

#618

Post by masswerk »

lalaithion wrote: post #585
UncleMeat wrote: post #430

Earlier quoted context omitted.

> Arguably, the most sincere problems arise from mixed alphabets with Unicode domains and look-alike characters/glyphs. No way. The most sincere problem is that hostnames do not enforce any binding to a real world identity that users can understand (nobody inspects certs) and that the most trustworthy component of a hostname is the second to the last section (right before ".com"). Humans tend to look at the front of…

The best security change we could make, imo, is rewriting domains so that they look like com.evil.bank.www/now/urls/go/from/most/specific/to/least

I'm not so convinced. There would be still "uk.co.bbc" and "com.bbc" pointing to the same body behind it and any kind of confusion arising from this, like, "is 'ug.co.bbc' the same?" The most important part is teaching users that the identity isn't just "bbc" with some extra decoration. Also, we have the reverse example in software packaging (com/example/disruptiveLibrary) and it isn't fool-proof either (especially, if you only know of "disruptiveLibrary" and not about its origin).

Re: Chrome 69: “www.” subdomain missing from URL

#619

Post by uberman »

wpietri wrote: post #438
uberman wrote: post #169

Earlier quoted context omitted.

I realize it is an important distinction, I'm glad you do as well. Just as ftp.mysite.com is not mysite.com and mysite.com in not mysite.io and http://mysite.com is not https://mysite.com . You get the point. They are all different and important in my opinion. Any argument that hiding the "www." part makes it easier for the user is equally applicable (and wrong) to ".com"

You can keep repeating your point, but if you want to convince me, you'll have to actually address my demonstration that the two are in fact not equal in practice.

From the bug report that started this thread:

http://www.ntppool.org is not http://pool.ntp.org

and

https://citibank.com.sg is not https://www.citibank.com.sg

and

https://m.tumblr.com/ is not https://www.tumblr.com/

Yet Google makes them all appear to be the same.

There are lots of other odd filtering behaviors in the issue if you want to check out the comments

For example, should:

www.www.www.subdomain.www.www.www.domain.com show as subdomain.domain.com

How is that right?

How does making those two destinations appear to be the same thing make the user "safer" under any stretch of the imagination?

Re: Chrome 69: “www.” subdomain missing from URL

#620

Post by xfer »

justadudeama wrote: post #522
jake_the_third wrote: post #505

Earlier quoted context omitted.

1. Org hosts physical web server at www.example.org. 2. Google directs user to www.example.org. 3. User sees url as example.org and notes it down. 4. User needs to visit example.org again, but for some reason it doesn't work. 5. User goes to coworker who shows him that example.org does in fact work (hidden www). 6. Endless confusion ensues. This is bad UX decision on Google part (on top of it breaking published stand…

This is going to be a problem weather or not Chrome changes www.example.org to example.org. There is a _very_ non-trivial chance the person was going to write down example.org anyways.

My parents write the exact url for many bill paying sites. I would bet a lot people do the same.
Post reply on HN