4 ms·

Usually I try to be constructive, but I just need to get this out: fuck AMP. I don't care downvote me to oblivion I'm a little buzzed but FFS who actually wants

by dcow 9y ago

Usually I try to be constructive, but I just need to get this out: fuck AMP. I don't care downvote me to oblivion I'm a little buzzed but FFS who actually wants AMP and why is it even a thing? Why can't Chrome just prefetch shit from the actual servers and let ISPs handle the caching? Why does mother Google need to serve me all the content from its overly suckled teat? I know everyone working on AMP means well but why why why does Google insist on destroying the internet and entirely undermining TLS in the process? Sorry. That was therapeutic. Bonus Quiz: 1. When I encounter an AMP link I... a) Click it. b) Don't click it. c) I don't see AMP links using FireFox. 2. When my friends send me an AMP link... a) I click it. b) I don't click it. c) Friends don't send friends AMP links. 3. Reasons I've switched to FireFox... a) I love RUst. b) I care about privacy. c) I hate AMP. 4. My ISP is... a) Google b) Chrome c) None of the above. The answer is 'c'.

DyslexicAtheist 9y ago
same thoughts. it's hard to contain myself when smart people seriously discuss it's merits instead of burning it with fire.
ec109685 9y ago
An ISP can’t see https content to cache. Having google prefetch normal html pages would thoroughly break most website’s analytics, be potentially a violation of privacy and do a hundred other horrendous things if they tried to instantly load cached normal html pages within the google search result page.
- dcow 9y ago
  But if Google does it on effectively their own network it's okay? Nothing changes there except analytics and bandwidth usage. Too much for the internet but not to fear Google is here with a web scale solution: build a new internet a googlenet where services only get info Google blesses them with......
  - ec109685 9y ago
    Google is caching pages specifically designed to be cached, including supporting ads and analytics for the publisher. You isp caching solution can’t do that.
pfooti 9y ago
Imagine the side channel attack enabled by having your browser prefetch content that is on a search result but that you didn't click, in a fashion that is not clearanced by a single server but instead can be tied directly to you. Like "hey advertisers, here's a whole lot more information!"
- dcow 9y ago
  Are we discovering anew just how much information google has and perhaps now the real intention behind AMP: complete control of search. Easy solution, opt in and explain the danger to users...or better yet stuff all the privacy violation shit behind an EULA and call it a day. Thinking about it more, why is it even a problem if the pizza shop across the street knows I searched for pizza and wants to try and offer me a better deal before I pick up the phone and call someone else? If I buy into having my privacy violated by allowing sites and ad networks to track me anyway, wouldn't the better user experience there be to have services competing over me (my business) as soon as I start looking rather than once I've entered their store? Kinda playing devils advocate but now I'm actually curious.
Zarel 9y ago
> who actually wants AMP and why is it even a thing? AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA. Here in this thread are people talking about how much they like AMP from a user's perspective. > Why can't Chrome just prefetch shit from the actual servers The linked article answers this: for privacy reasons. > and let ISPs handle the caching? HTTPS does not allow ISP-level caching. This is generally a good thing; I trust ISPs significantly less than I trust Google. > Why does mother Google need to serve me all the content from...? Performance, presumably. > I know everyone working on AMP means well but why why why does Google insist on destroying the internet and entirely undermining TLS in the process? I don't think they're doing that.
- lifthrasiir 9y ago
  I know AMP has some good purposes, but the correct response should have been to discourage site owners doing stupid things. Google has sufficient power to force them, having done a similar thing for HTTPS (not to say that it's necessarily appropriate, but frankly not so much different from AMP in terms of the amount of abusing).
- pjmlp 9y ago
  > AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA. It is called HTML/CSS with zero JavaScript. Quite fast in dial up modems.
- grey-area 9y ago
  AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA. That's not all it does. No-one would object to it if that was all it does. The more important part is that it hijacks content and serves it from other servers, and requires including a js file from a large corp in every page. That's a massive vulnerability waiting to happen, but it also gives complete control of the web to whoever controls that js. They need to ditch the requirement for js, and ditch the requirement for framing with Google junk around pages. The web is an open ecosystem, that's its strength. Also, google should not be using their influence in search to push changes which are profitable for them - that's abusing their monopoly position.
gressquel 9y ago
I have been thinking about creating a reference group in Europe to lobby against googles abuse of monopoly. EU has shown time after time that it cares more about its citizens than about how much money countries can make. If anyone is interested PM me.
teh_klev 9y ago
I largely agree. Every time I bump into yet another AMP link I discard it. I also try to encourage friends to not post these blasted things. They're a poison just as bad as that link.is crap that floated around for a while.
Ajedi32 9y ago
> Why can't Chrome just prefetch shit from the actual servers The linked article explains this. Do you really want third party sites to know what you're searching for without you actively deciding to click on their page? > and let ISPs handle the caching ISPs can't cache the contents of HTTPS pages.
- dcow 9y ago
  > Do you really want third party sites knowing what you searched for...? My user agent /is/ me. If I want to prefetch results, I unerstand it means people know I'm looking at those results. I don't think it's really the privacy issue they are trying to make it out to be. And the counter consideration is that you are implicitly saying you trust Google with that info more than the actual service providers so it's not "do you want people" it's "who do you want" knowing. Easy solution: off by default and inform users of the implication when turned on. As a user I don't actually want the internet prefetched for me mostly because it's a stupid idea catering to a subset of people who are so impatient it's baffling. If your site performs poorly on mobile let users complain to the creators so they can make better sites. Does Google really get the schtick when a mobile site has a poor UX? No. So why are they even investing effort into this?... > ISPs can't cache the content of HTTPS pages. Indeed. That's the point of HTTPS. As a user I don't expect that contract undermined even by a claimed benevolent Google just trying to altruistically get you content better with signed bundles that masquerade around as the original service. A few points, too. Often the static CDN content is served HTTP because it's not sensitive or it employes other means of restricting access such as GUID/signed urls etc., all of which can be cached. But even if that's a bad idea (I think people are moving away from that model, and http2) that just shifts the responsibility to the ISP and CDN providers to make sure that they have good fast connections between their networks. That's something that is in both their business models and it works just fine today. ISPs want to provide the best user experience on their network compared to others and CDNs sell their highly available global network to customers so a better CDN closer to more users means happier customers.
  - Ajedi32 9y ago
    > If I want to prefetch results, I unerstand it means people know I'm looking at those results. Why do that though when you can have your cake and eat it? Google's proposed solution allows you to prefetch results _and_ not allow the third-party to know you're looking at those results. > the counter consideration is that your implicitly saying you trust Google with that info more than the actual service providers If I'm using Google search, then yes, obviously I'm fine with Google knowing what I searched for. If I wasn't okay with that, I most certainly would not be using Google search. In contrast, I'm less likely to be okay with a random site in the search results page that I haven't clicked on knowing that I saw a link to their site in a search results page. Note that if I were using DuckDuckGo instead and DuckDuckGo supported AMP, then my browser would prefetch from DuckDuckGo's AMP cache, not Google's. No additional information is being shared with any party who doesn't already possess that information. (DuckDuckGo already knows what I searched for. Me loading an AMP page from them related to that query reveals no additional information.) > Indeed. That's the point of HTTPS. As a user I don't expect that contract undermined even by a claimed benevolent Google Could you explain how Google's proposed solution here undermines HTTPS? Note that the OP talks about using the upcoming [Web Package standard][1] to distribute AMP pages. This standard would allow the integrity guarantees of HTTPS to be preserved even when the page in question is being served by Google's AMP cache rather than the original server. [1]: https://github.com/WICG/webpackage https://github.com/WICG/webpackage
forgottenpass 9y ago
Why can't Chrome just prefetch shit from the actual servers and let ISPs handle the caching? Why does mother Google need to serve me all the content from its overly suckled teat? Ooooh, <raises hand aggressively> I know. Google is fighting to minimize ISP incidental access to your internet actions, while aggressively expanding the amount of incidental access Google has to your internet actions. Apparently they've "earned" their surveillance because their core functionality can't be divorced from their ability to conduct surveillance as easily as they can be separated in the case of ISPs.

by dcow 9y ago

DyslexicAtheist 9y ago

same thoughts. it's hard to contain myself when smart people seriously discuss it's merits instead of burning it with fire.

ec109685 9y ago

An ISP can’t see https content to cache. Having google prefetch normal html pages would thoroughly break most website’s analytics, be potentially a violation of privacy and do a hundred other horrendous things if they tried to instantly load cached normal html pages within the google search result page.

dcow 9y ago
But if Google does it on effectively their own network it's okay? Nothing changes there except analytics and bandwidth usage. Too much for the internet but not to fear Google is here with a web scale solution: build a new internet a googlenet where services only get info Google blesses them with......
- ec109685 9y ago
  Google is caching pages specifically designed to be cached, including supporting ads and analytics for the publisher. You isp caching solution can’t do that.

pfooti 9y ago

Imagine the side channel attack enabled by having your browser prefetch content that is on a search result but that you didn't click, in a fashion that is not clearanced by a single server but instead can be tied directly to you. Like "hey advertisers, here's a whole lot more information!"

dcow 9y ago
Are we discovering anew just how much information google has and perhaps now the real intention behind AMP: complete control of search. Easy solution, opt in and explain the danger to users...or better yet stuff all the privacy violation shit behind an EULA and call it a day. Thinking about it more, why is it even a problem if the pizza shop across the street knows I searched for pizza and wants to try and offer me a better deal before I pick up the phone and call someone else? If I buy into having my privacy violated by allowing sites and ad networks to track me anyway, wouldn't the better user experience there be to have services competing over me (my business) as soon as I start looking rather than once I've entered their store? Kinda playing devils advocate but now I'm actually curious.

Zarel 9y ago

> who actually wants AMP and why is it even a thing? AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA. Here in this thread are people talking about how much they like AMP from a user's perspective. > Why can't Chrome just prefetch shit from the actual servers The linked article answers this: for privacy reasons. > and let ISPs handle the caching? HTTPS does not allow ISP-level caching. This is generally a good thing; I trust ISPs significantly less than I trust Google. > Why does mother Google need to serve me all the content from...? Performance, presumably. > I know everyone working on AMP means well but why why why does Google insist on destroying the internet and entirely undermining TLS in the process? I don't think they're doing that.

lifthrasiir 9y ago
I know AMP has some good purposes, but the correct response should have been to discourage site owners doing stupid things. Google has sufficient power to force them, having done a similar thing for HTTPS (not to say that it's necessarily appropriate, but frankly not so much different from AMP in terms of the amount of abusing).
pjmlp 9y ago
> AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA. It is called HTML/CSS with zero JavaScript. Quite fast in dial up modems.
grey-area 9y ago
AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA. That's not all it does. No-one would object to it if that was all it does. The more important part is that it hijacks content and serves it from other servers, and requires including a js file from a large corp in every page. That's a massive vulnerability waiting to happen, but it also gives complete control of the web to whoever controls that js. They need to ditch the requirement for js, and ditch the requirement for framing with Google junk around pages. The web is an open ecosystem, that's its strength. Also, google should not be using their influence in search to push changes which are profitable for them - that's abusing their monopoly position.

gressquel 9y ago

I have been thinking about creating a reference group in Europe to lobby against googles abuse of monopoly. EU has shown time after time that it cares more about its citizens than about how much money countries can make. If anyone is interested PM me.

teh_klev 9y ago

I largely agree. Every time I bump into yet another AMP link I discard it. I also try to encourage friends to not post these blasted things. They're a poison just as bad as that link.is crap that floated around for a while.

Ajedi32 9y ago

> Why can't Chrome just prefetch shit from the actual servers The linked article explains this. Do you really want third party sites to know what you're searching for without you actively deciding to click on their page? > and let ISPs handle the caching ISPs can't cache the contents of HTTPS pages.

dcow 9y ago
> Do you really want third party sites knowing what you searched for...? My user agent /is/ me. If I want to prefetch results, I unerstand it means people know I'm looking at those results. I don't think it's really the privacy issue they are trying to make it out to be. And the counter consideration is that you are implicitly saying you trust Google with that info more than the actual service providers so it's not "do you want people" it's "who do you want" knowing. Easy solution: off by default and inform users of the implication when turned on. As a user I don't actually want the internet prefetched for me mostly because it's a stupid idea catering to a subset of people who are so impatient it's baffling. If your site performs poorly on mobile let users complain to the creators so they can make better sites. Does Google really get the schtick when a mobile site has a poor UX? No. So why are they even investing effort into this?... > ISPs can't cache the content of HTTPS pages. Indeed. That's the point of HTTPS. As a user I don't expect that contract undermined even by a claimed benevolent Google just trying to altruistically get you content better with signed bundles that masquerade around as the original service. A few points, too. Often the static CDN content is served HTTP because it's not sensitive or it employes other means of restricting access such as GUID/signed urls etc., all of which can be cached. But even if that's a bad idea (I think people are moving away from that model, and http2) that just shifts the responsibility to the ISP and CDN providers to make sure that they have good fast connections between their networks. That's something that is in both their business models and it works just fine today. ISPs want to provide the best user experience on their network compared to others and CDNs sell their highly available global network to customers so a better CDN closer to more users means happier customers.
- Ajedi32 9y ago
  > If I want to prefetch results, I unerstand it means people know I'm looking at those results. Why do that though when you can have your cake and eat it? Google's proposed solution allows you to prefetch results _and_ not allow the third-party to know you're looking at those results. > the counter consideration is that your implicitly saying you trust Google with that info more than the actual service providers If I'm using Google search, then yes, obviously I'm fine with Google knowing what I searched for. If I wasn't okay with that, I most certainly would not be using Google search. In contrast, I'm less likely to be okay with a random site in the search results page that I haven't clicked on knowing that I saw a link to their site in a search results page. Note that if I were using DuckDuckGo instead and DuckDuckGo supported AMP, then my browser would prefetch from DuckDuckGo's AMP cache, not Google's. No additional information is being shared with any party who doesn't already possess that information. (DuckDuckGo already knows what I searched for. Me loading an AMP page from them related to that query reveals no additional information.) > Indeed. That's the point of HTTPS. As a user I don't expect that contract undermined even by a claimed benevolent Google Could you explain how Google's proposed solution here undermines HTTPS? Note that the OP talks about using the upcoming [Web Package standard][1] to distribute AMP pages. This standard would allow the integrity guarantees of HTTPS to be preserved even when the page in question is being served by Google's AMP cache rather than the original server. [1]: https://github.com/WICG/webpackage https://github.com/WICG/webpackage

forgottenpass 9y ago

Why can't Chrome just prefetch shit from the actual servers and let ISPs handle the caching? Why does mother Google need to serve me all the content from its overly suckled teat? Ooooh, <raises hand aggressively> I know. Google is fighting to minimize ISP incidental access to your internet actions, while aggressively expanding the amount of incidental access Google has to your internet actions. Apparently they've "earned" their surveillance because their core functionality can't be divorced from their ability to conduct surveillance as easily as they can be separated in the case of ISPs.