AMP pages displaying your own domain

Post by [deleted] » Wed, Apr 17, 2019, 6:07 AM UTC

48309248302 wrote: post #69

gregable wrote: post #64

Earlier quoted context omitted.

The linker (google in this case) could rewrite the link to use a redirector if they choose. If Javascript is off, AMP and thus Signed Exchanges are disabled on Google search results anyway. You misunderstand the 8 second CSS animation in the AMP boilerplate. Here's the code (simplified): body { animation:-amp-start 8s steps(1,end) 0s 1 normal both} @keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}…

There are legitimate (privacy/speed) reasons to not load AMP's JavaScript while still not turning of JavaScript entirely. Google does have the capability to know when you're on an AMP page, because the JS loads from ampproject.org, which is registered by Google. An 8-second delay seems like an intentional "bug" to coerce users to turn on JavaScript (and advertising).

Post by 48309248302 » Wed, Apr 17, 2019, 6:10 AM UTC

gregable wrote: post #72

48309248302 wrote: post #69

Earlier quoted context omitted.

There are legitimate (privacy/speed) reasons to not load AMP's JavaScript while still not turning of JavaScript entirely. Google does have the capability to know when you're on an AMP page, because the JS loads from ampproject.org, which is registered by Google. An 8-second delay seems like an intentional "bug" to coerce users to turn on JavaScript (and advertising).

The javascript is heavily cached, so will not give a request on every page load. That is not the intention. If javascript is disabled entirely, Google Search won't even load AMP pages. The scenario you describe of a user loading an AMP page directly without javascript enabled is somewhat rare.

Post by jedberg » Wed, Apr 17, 2019, 6:31 AM UTC

luckylion wrote: post #60

jedberg wrote: post #52

Earlier quoted context omitted.

> Showing the name of the "signer" in the address bar, instead of the server where the content is actually hosted goes against decades of browser UI design Does it though? If you use Cloudflare or Akamai or Cloudfront or Netlify or etc. etc. then what shows up in the URL bar is not the server where the content is actually hosted. Well, it is the server where it is hosted, it's just one of the many domains hosted by t…

That has never been different. Cloudflare & co are reverse proxies, for all intents and purposes from a user agent view, they are where the content is coming from. They are the ones pointed to in DNS, and they have valid SSL certs.

Post by gregable » Wed, Apr 17, 2019, 6:39 AM UTC

andy_ppp wrote: post #74

Who is going to be in charge of the signing process? Can I sign the content myself? Will Google eventually only sign content it deems appropriate? Can we trust Google to always do the right thing?

Post by rando444 » Wed, Apr 17, 2019, 6:42 AM UTC

gregable wrote: post #36

48309248302 wrote: post #11

This sounds terrible. Does it mean that browsers will begin lying to users and say that the users are visiting the website's server when they are really visiting a restricted version of the website that is hosted in Google's cache? I don't want my content restricted or hosted in Google's cache. AMP doesn't load in a privacy sensitive way. It's on Google's servers and it takes many seconds to load if you have JavaScri…

The browser displays the URL from the origin that digitally signed the unmodified content. A browser already doesn't show you what server delivered the content. That would be your wifi AP, cell phone tower, or ISP node. The internet has already long established that we can trust content without trusting intermediaries. There are two elements that are important: integrity and privacy. The content integrity is protecte…