80 ms·

Chrome 69: “www.” subdomain missing from URL

• microcolonel 8y ago
  Is this a Mac-only bug? I'm running Chrome OS and it looks just fine to me.
  • rkeene2 8y ago
    Chrome 69 has not be rolled out to ChromeOS yet, at-least on the stable channel.
    • microcolonel 8y ago
      I mean on the Beta channel.
• rhacker 8y ago
  The fix is to change your subdomain from "www" to "amp". You can read more about it at the IETF website located here: https://www.ampproject.org/ https://www.ampproject.org/ Please submit any complaints you have as a video on YouTube.
  • test6554 8y ago
    Please tell me this is a joke...
    • ihuman 8y ago
      The "Please submit any complaints you have as a video on YouTube." part really makes it look like a joke
      • progval 8y ago
        That line was added as an edit
    • tobyhinloopen 8y ago
      Obviously. It refers to Google’s aggressive focus to amp
    • mtgx 8y ago
      I had a strong gut feeling Google has one or multiple ulterior motives for doing this - motives that aren't very user-friendly (as they claim) but more Google-friendly. I thought it may be so that it can track every link you type in Chrome without 99.9% of the users being aware of it. Right now Google does that only for "searches" in the omnibox. I hadn't thought about the amp angle, but that could be another reason for pushing this, too. Perhaps there are more we won't know until it's too late to do anything about it (other than changing browsers, of course).
  • devoply 8y ago
    That's not a fix. That's a travesty.
  • deleted 8y ago
    [deleted]
  • buboard 8y ago
    Sorry i don't trust URLs from strangers, can you tell me the google search i need to do for this?
• xd1936 8y ago
  ...I'm okay with this, I think. Has www (http over tcp/ip) not become the default protocol for "the internet" in the average person's mind?
  • sagebird 8y ago
    www is a sub domain and orthogonal to protocol. Eg ftp://www.yo.com should be valid as well.
    • cesarb 8y ago
      And in the other direction too, for instance http://ftp.debian.org/ http://ftp.debian.org/
  • urda 8y ago
    And many including myself are not OK with this. Your browser shouldn't be obscuring any part of the URI.
    • deleted 8y ago
      [deleted]
  • QasimK 8y ago
    I think websites should just stop using "www." entirely and host directly on their domain rather than a subdomain.
    • CodesInChaos 8y ago
      That weakens the protection the same origin policy offers.
      • ancarda 8y ago
        It does? How so?
        • 8y ago
• euyyn 8y ago
  Isn't this on purpose?
• ihuman 8y ago
  Is this really a big deal? Don't many websites either redirect the www to the non-www, or the other way around?
  • theprotocol 8y ago
    It's about the principle. www is a valid subdomain. Browsers are supposed to be as unopinionated as possible since they are browsers, not mediators, and their job is to implement the standards of the web.
    • cjhopman 8y ago
      I didn't realize that the standards of the web specified anything about how an address bar should be displayed (or, for that matter, that it specified anything about an address bar even existing).
      • type0 8y ago
        > This document describes the syntax and semantics for a compact string representation for a resource available via the Internet. These strings are called "Uniform Resource Locators" (URLs). https://www.ietf.org/rfc/rfc1738.txt https://www.ietf.org/rfc/rfc1738.txt
    • lkbm 8y ago
      IE did this years ago too, as I recall. I don't know if Edge still does. Safari also won't show "www" until you click on the location bar, but it'll show once you click.
      • toast0 8y ago
        Safari doesn't show you the url at all until you click either; so the URL bar is just a domain indicator -- in that case, it seems less objectionable that it doesn't show the FQDN, but instead something different -- copying the url from a screenshot was bound for disappointment anyway.
    • 8y ago
• austincummings 8y ago
  Looks like this is intentional. To change it back go to chrome://flags/#omnibox-ui-hide-steady-state-url-scheme-and-subdomains and disable the setting.
  • keeganjw 8y ago
    Thanks! This worked great for me and it brought back the https:// https:// part as well.
    • pishpash 8y ago
      Until a few releases down the line and it is decided for you that the flag should be removed.
      • rocky1138 8y ago
        This is the problem. Better to just switch to Firefox now and be done with it. Hopefully it'll send a message.
        • mindcrime 8y ago
          Until Firefox leadership decide to make the same change "because that's what Chrome does". Sadly, over the history of Firefox (and before that, Mozilla/Seamonkey) the leadership there has always been WAY too obsessed with following IE and/or Chrome rather than just building the best browser and taking some chances. Seriously, trawl through Bugzilla sometime and look how many bugs are closed with the the justification being some variation of "That's how IE does it" or "IE doesn't support that", etc. And then substitute "Chrome" for "IE" later in history once Chrome took over the universe.
          • int_19h 8y ago
            Luckily we still have Vivaldi, Otter, Falkon etc.
  • chch 8y ago
• Klonoar 8y ago
  Yo, this is... going too far, c'mon now. While sure, www seems odd now, it's still a subdomain and we're inching into territory of obscuring things that matter for small gains in end-user perception that aren't _that_ impactful.
  • asimpletune 8y ago
    Yeah this is weird. Which users are bothered enough by the leading www enough to justify messing with semantics?
    • ggggtez 8y ago
      I'm guessing it's related to mobile. Limited real estate means removing www gives you 3 more characters on the end of the url.
      • jdeibele 8y ago
        Pendantic hat on: 4 www.
        • garmaine 8y ago
          Proportional fonts, so no the '.' doesn't get you a full character.
          • plopz 8y ago
            Are you saying each w is netting more than a full character?
            • ReverseCold 8y ago
              No, they're saying that `.` gets less than a full character.
            • deleted 8y ago
              [deleted]
• hughes 8y ago
  Anyone know if this checks for a DNS record that supports equivalency between the www/empty subdomains? It's possible for them to have different values.
  • fpoling 8y ago
    Even if DNS is the same, the host receives full host name in http and/or TLS headers and can trivially serve different content.
  • emeraldd 8y ago
    DNS equivalency is meaningless here. You'd have to have a way to check the with the webserver because of name based virtual hosting and SNI.
• c0nsumer 8y ago
  Have any of you with corporate-type proxies been seeing authentication issues? Since moving to Chrome 69 a number of our users are reporting repeated proxy auth prompts when this should normally be handled transparently by Kerberos.
  • noinsight 8y ago
    Yes, Chrome 69 has a bug with Kerberos: https://bugs.chromium.org/p/chromium/issues/detail?id=872665 https://bugs.chromium.org/p/chromium/issues/detail?id=872665
    • c0nsumer 8y ago
      Thank you very much. I'd been digging but hadn't found this yet.
    • c0nsumer 8y ago
      PS: This becomes REALLY fun if you use cnames to load balance proxies. Which use Kerberos. <sigh>
• deleted 8y ago
  [deleted]
• DamnInteresting 8y ago
  If the browser uses some technique to detect that www.domain.com is functionally identical to domain.com for a given domain, then I don't see a serious problem with this. But if they are short of that certainty, they're obscuring a critical part of the URL, and harming usability (e.g., if I want to jot down a site's URL for later use, I might get something unexpected).
  • saagarjha 8y ago
    > If the browser uses some technique to detect that www.domain.com is functionally identical to domain.com for a given domain, then I don't see a serious problem with this. Say, for example, if the canonical URL doesn't have a "www" in it?
  • teilo 8y ago
    That's not the case. I run a server that does not respond to "www." If I enter "www.myserver.com" into the address bar, I get a DNS lookup failure, but the address bar is now showing "myserver.com." That's damn confusing, and this is an idiotic default on Chrome's part.
    • lozenge 8y ago
      That seems like an edge case worth submitting a separate bug for.
      • crispyporkbites 8y ago
        It's not an edge case, it's a specific customization required to support Chrome browsers only.
      • king_phil 8y ago
        Think public suffixes! It is long, so definitely not an edge case. You can write a small script to look up all PSL domains and check if the www and APEX domain has the same dns records. Our implementation (we control 15 or so) does not, have a www-subdomain for the domains. Anybody can register the www-subdomains.
• Ajedi32 8y ago
  This isn't entirely without precedent. Firefox does something similar by greying out the `www` in the UI, Chrome just decided to take things a step further by hiding it entirely.
  • psetq 8y ago
    Huge difference IMO. I'd explain your example as firefox highlighting the domain part of the URI.
  • kenhwang 8y ago
    FF grays out everything that's not the domain name, not just `www` and more importantly, not because it's `www`.
  • larrik 8y ago
    FF greys out all the subdomains, not just www. Good for anti-phishing, I guess.
  • gsnedders 8y ago
    Firefox's behaviour is that is makes everything except the eTLD+1 grey, because that's what's normally useful for evaluating authenticity. There's no distinction made between `www` and any other subdomain.
    • tinus_hn 8y ago
      These are all in the same origin so they can read cookies and manipulate pages.
      • gsnedders 8y ago
        Subdomains are in different origins; cookies have their own weird notion of security.
      • Sohcahtoa82 8y ago
        This is not true unless the cookie is specifically marked to be domain-wide. There was a time when IE misbehaved. Not sure if this fixed in Edge: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-cookie-domains/ https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...
• ronilan 8y ago
  That took just 8 years.... http://blogoscoped.com/archive/2010-09-17-n17.html http://blogoscoped.com/archive/2010-09-17-n17.html
• jwr 8y ago
  This is idiotic and harmful. We already lost information about the protocol, because somebody believed it is "too complex" for users. Now we're losing other parts of the URL. It's making a joke of the SSL/TLS padlock, too — what exactly is the padlock supposed to tell me? It used to signify that a "known authority" certified that I'm connected to whatever I see in the URL bar. But now that browsers take liberties with modifying the URL bar as they see fit, it becomes increasingly meaningless.
  • devoply 8y ago
    Google wants to destroy the URL so the only way to find something will be via Google... They also want to tie your identity to each webpage that you author via a certificate so that all governments can clamp down on fake information or have the opportunity to in the future.
  • RadioactiveMan 8y ago
    The padlock was already meaningless.
    • hjfa0j 8y ago
      It started being meaningless thanks to Let's Encrypt. Before it meant you had to show your ID and banking info to a "reputable" corporation for them to make a cert for you. Yes I know I know, not always the case, but... LE means that the mantra "if it's https then it's a secure and reputable website" is now outdated.
      • detaro 8y ago
        > Before it meant you had to show your ID and banking info to a "reputable" corporation for them to make a cert for you. No it didn't. Let's Encrypt made free certificates easier to get, but Let's Encrypt doesn't do less verification than some other CAs/some of their products.
      • dragonwriter 8y ago
        > Before it meant you had to show your ID and banking info to a "reputable" corporation for them to make a cert for you. No, it didn't. DV certs never meant that (EV certs did and still do, but LE doesn't offer EV and EV isn't and never was necessary for the padlock.)
• ozfive 8y ago
  This and many other changes over a course of a short period of time have caused me to go to Firefox exclusively now. I heard Firefox is going to stop third party cookie tracking altogether. Why not give Google the big finger and use a different browser? Vote with your cold hard actions if you feel so strongly about something.
  • ben174 8y ago
    I would love to, but Firefox just feels more clunky. Not sure what it is, but the scrolling doesn't feel native to me (MacOS, Magic Trackpad and Logitech Mouse)
    • darkstar999 8y ago
      You can turn off that scroll behavior.
    • ValentineC 8y ago
      I wonder if it has anything to do with the HiDPI issue: https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=1404042 https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=... (there's a couple of hits when I search for 'scrolling' in that thread)
    • eclat 8y ago
      Faster than Chrome for me on MacOS
  • agentPrefect 8y ago
    Because the battery drainage with Firefox is unacceptable.
  • rckclmbr 8y ago
    I switched to firefox a year ago. Its a little slower, but im a lot happier. Ive been trying to degoogle as much as reasonable. I moved to fastmail as well. Still using an android, but would switch if a reasonable alternative that wasnt iphone came up. Im not paranoid or a privacy nut, just think google is too involved in my life.
• peterwwillis 8y ago
  Google attempted a more extreme version of this four years ago: https://www.extremetech.com/computing/181657-google-moves-to-kill-off-the-url-entirely-in-new-version-of-chrome https://www.extremetech.com/computing/181657-google-moves-to... So they're doing it again, just slower: https://www.extremetech.com/computing/276454-google-wants-to-kill-the-url https://www.extremetech.com/computing/276454-google-wants-to... I'm pretty sure the eventual plan is to force everyone to browse the web using a version of the App Store, which we all know is incredibly secure, and never difficult to use.
  • rkeene2 8y ago
    I don't think your conclusion is correct, but the assertion that they want to get rid of the URL was posted on Hacker News a couple of days ago: https://news.ycombinator.com/item?id=17911009 https://news.ycombinator.com/item?id=17911009
• shawn 8y ago
  Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number of people at the company with email access). This is one of those things that everyone says "Ha, I'm smart. I'd notice. You can't trick me." And maybe you are. But you're also distracted. And that's my greatest advantage against you. All I need is to sneak in an unexpected Github prompt that looks completely authentic, and now I have your Github password. Wanna bet you don't have 2FA turned on, even though you know you really ought to? And even if you do, it's getting easier to social engineer your way past AT&T's lovely customer support: https://www.youtube.com/watch?v=caVEiitI2vg https://www.youtube.com/watch?v=caVEiitI2vg Ok, what's the point? This: Every character in the URL bar unrelated to the apex name is a deadly distraction. Right now, how do you know you're actually on HN instead of some knockoff? "ycombinator.com". How many characters do you have to read unrelated to that? "https://news https://news. /item?id=17927972" The most vital part of a URL for vetting identity is also, usually, the hardest to see. Now, I don't know whether google made this change in order to assist with this. But it's one possible justification, and a step in a good direction. We may not like it, just like we didn't like when Google removed the clickable "cached" links from search results, but in this case consumer protection outweighs our urges as a power user.
  • mrguyorama 8y ago
    Firefox fixed this by highlighting the "ycombinator.com" portion of the URL. Zero need to hide the rest from the user
    • crispyporkbites 8y ago
      I was just looking at the URL bar in firefox and thinking yea, I know it's ycombinator.com because it's right there, and there's a big green lock on the left. Google can do what they want with Chrome, as far as I'm concerned it's the new IE.
  • 8y ago
• theandrewbailey 8y ago
  It begins. I saw this this morning, and thought it was something that was coming in the next few versions, not right now. https://www.wired.com/story/google-wants-to-kill-the-url/ https://www.wired.com/story/google-wants-to-kill-the-url/ WTF? People get angry when you just move their cheese without notice.
  • dbbk 8y ago
    What they're talking about in that article is more dramatic than this.
  • komali2 8y ago
    >People get angry when you just move their cheese without notice. Sorry, unrelated, but ahah, what is this saying? I love it and have never heard it before. I guess it's from some sort of book? https://hbswk.hbs.edu/item/cheese-moving-effecting-change-rather-than-accepting-it https://hbswk.hbs.edu/item/cheese-moving-effecting-change-ra...
    • theandrewbailey 8y ago
      It's an idiom. https://www.quora.com/What-exactly-does-who-moved-my-cheese-mean https://www.quora.com/What-exactly-does-who-moved-my-cheese-...
• teilo 8y ago
  To be clear, the "www" is only missing from the URL that is displayed in the address bar, while the browser is still attempting to resolve and fetch the URL with the "www." So instead of something that would completely break many websites, this is just something that is as confusing as hell for no good reason. When a website requires "www" to resolve and respond, who in their right mind would want it hidden in the displayed URL?
• soared 8y ago
  Why does this matter? Users don't care and its easier to remember/understand that all websites are just "x.com" rather than sometimes being "www.x.com". If you have some server/troubleshooting/network/dev problem with it, the missing info should be moved to developer tools. This is just removing data that is useless and confusing to 99.9% of users - whats the problem?
  • crispyporkbites 8y ago
    Because they are on www. and not *. What happens when you copy and paste that URL? Now every single website that wants to support Chrome needs to ensure that https://foo.com https://foo.com is always redirected to https://www.foo.com https://www.foo.com, or at least works as if it's www. It doesn't matter that most websites already do this, it's not standard, and represents Google breaking standards because they are big enough to do their own thing. It's just one of the 1000s of papercuts that google is inflicting to keep users from switching web browser.
    • eclipxe 8y ago
      When you copy and paste, it has the whole URL - just like when you copy and paste now it will include http(s)://
      • pishpash 8y ago
        What if you visually copy and paste? Parent is right.
        • kowdermeister 8y ago
          One more reason to set up a redirect from or to www.
          • lwansbrough 8y ago
            Many MANY legacy sites serve different information at those two domains.
• philo23 8y ago
  This is only visually what's displayed in the address bar, similar to how they started dropping http/https from the start of URLs a while back. While I'd personally disagree with these kind of changes, and I would always prefer it to show the http/https and the www dot, it doesn't actually break things like copy and pasting the URL from the address bar. You still go to www.google.com when you type in www.google.com, it's just trimming away the www dot displayed in the address bar. I think for the vast majority of non-technical people it's not really going to make even a little bit of difference. If anything it'll make it easier to spot what domain they're on, assuming they're even checking to begin with.
• tschellenbach 8y ago
  Just updated to see it in action. Seems like a nice improvement for end users. Don't think there is any reason not to do this, other than a nostalgic desire for things to stay the same. Most sites already have a www. to . redirect in place and if you don't its a trivial change.
  • uberman 8y ago
    Why not drop the .com then as well? Most sites are on .com domains after all.
    • CydeWeys 8y ago
      The obvious difference is that that's higher up in the hierarchy rather than lower in it. www.example.com and example.com are controlled by the same entity; example.com and example.foo may well not be.
  • Sohcahtoa82 8y ago
    > Don't think there is any reason not to do this [...] Most sites already have a www. to . redirect in place Most. Not all. The browser is doing something out-of-spec for really no reason at all and it has the chance to break some sites. www.domain.com and domain.com are never guaranteed to go to the same page. Yes, out of modern convention, they do now, but it's only a convention. Sites are free to break it, and some do, so to make this change is a bad idea.
• nbrempel 8y ago
  Safari has been doing this for some time. The "trivial subdomain" will show when you click the url bar, however.
  • firloop 8y ago
    I'm much more okay with Safari's implementation, because it's significantly more discoverable. Safari also makes it much simpler to disable this behavior altogether, with it earning a place in the settings ... rather than being behind some "flag" that may disappear in some future release.
  • jasonlotito 8y ago
    Chrome doesn't show on click. You have to double click. Safari also shows the URL when you use the Keyboard shortcut CMD+L, Chrome does not.
  • emeraldd 8y ago
    This is part of the reason I don't use safari for much of anything if I don't have to.
• download13 8y ago
  This seems fine. I'm assuming you can always click to expand and show the full URL. For a lot of people (devs especially) it would be nice to be able to change an option to see the whole URL at a glance, but for most people it's just a confusing mess they have to look through for the domain name.
• CoachRufus87 8y ago
  Thank you to whomever submitted this. My main annoyance is that when I want to go to a subdomain, I'll typically start typing foo.domain.com, but now the browser sets it to www.foo.domain.com. Annoying.
  • michaelmrose 8y ago
    What browser auto inserts www? It's neither firefox or chrome.
    • CoachRufus87 8y ago
      Let me clarify: since the subdomain is hidden, I now have to munge with the URL input field to just get the full url to show up so that I can then modify the subdomain.
• another-cuppa 8y ago
  Glad I don't use Chrome. Hope this doesn't happen too Firefox or that'll be another entry in my /etc/portage/patches
• ValentineC 8y ago
  I stumbled upon this bug too, and here's why this is not okay to me: For a couple of hours, I thought Citibank Singapore's website was down. If one tries accessing citibank.com.sg, there's no redirect to the www. subdomain. (That's still the case, if anyone wants to try.) If Chrome didn't hide the www., I would have been able to tell from Chrome's search/address bar that the various banking services that I've been accessing were all on the www. subdomain. While that is shoddy implementation on Citibank's part, hiding the www. most definitely didn't help with the troubleshooting process.
  • crispyporkbites 8y ago
    It's not a shoddy implementation on Citibank's part. Google are just fucking the web over so we all have to fit their structure. This is standard incumbent behaviour, they are drawing up the moat bridge, inch by inch.
    • lvs 8y ago
      I think the downvotes here are uncalled-for. This is correct. Google is leveraging a dominant market position to make seemingly frivolous changes that will ultimately benefit them commercially. Come on, you know where this is going: They are going to hide amp subdomain, so you don't know if you're looking at AMP or the actual destination. And then suddenly the whole world funnels through AMP.
      • _pmf_ 8y ago
        > Come on, you know where this is going: They are going to hide amp subdomain, so you don't know if you're looking at AMP or the actual destination. And then suddenly the whole world funnels through AMP. That's probably the reason for this utterly bizarre change.
        • kmlx 8y ago
          isn't it because urls are Number 1 for phishing thou? wouldn't removing urls altogether and move towards full identity checks be better for the web? and relying on citibank singapore to hire the right people to fix their website... never going to happen.
• deleted 8y ago
  [deleted]
• JTbane 8y ago
  This makes me glad I use Firefox and have dropped chrome entirely.
• drivingmenuts 8y ago
  Stupid crap like that is one of the reasons why Chrome isn't my primary browser.
• fireattack 8y ago
  I'm ok with hiding "www.", but it also hides "m." which is sometimes very confusing (I once opened a m.facebook.com link and was very puzzled why it uses the mobile site when the URl bar just shows "facebook.com").
  • ehsankia 8y ago
    Facebook aside, don't the majority of sites show you mobile version by looking at headers. Isn't that the whole reason the "Show desktop version" feature even exists in Chrome, to send the desktop header? Very few sites actually use www. vs m. Clearly, in those cases, people aren't "confused" by the fact that they are seeing a mobile version on www., so other than the fact that you're used to Facebook specifically working this way, wouldn't you just send the Desktop header whenever you get mobile and want desktop?
    • Nition 8y ago
      Just speaking for myself, but often people will link to mobile Wikipedia pages, or mobile versions of other sites, and I'll look at the URL first to see if I can change it to a desktop version.
      • ehsankia 8y ago
        The fact that you have to even do that shows that the m. pattern is bad. The same url should be shareable without having to worry about such things. It should show as mobile on mobile and desktop on desktop, unless you specifically tell it not to.
    • derefr 8y ago
      > Isn't that the whole reason the "Show desktop version" feature even exists in Chrome, to send the desktop header? This is indeed what it does; I wish it did more! Specifically, when visiting responsive pages on a phone where the mobile-viewport-size layout is just 100% broken, I’d love if “Request Desktop Site” actually set the viewport to be that of a desktop browser, and then set a low CSS/viewport zoom level to compensate. I want the dual of what happens when I set the “simulate a phone of X size” option in Chrome’s inspector!
• deleted 8y ago
  [deleted]
• parliament32 8y ago
  Considering a subdomain "trivial" is ridiculous... there's a difference between "www.example.com" and "example.com". Not only can they serve different sites, they can even have different DNS records! It seems that "m." is also considered a trivial subdomain. So when a user clicks a link to a "m.facebook.com" uri, they'll be confused why FB looks different when the browser reports it's on "facebook.com". I sincerely hope Firefox doesn't follow suit.
  • pishpash 8y ago
    Google knows best, DNS standards be damned. Practice makes standard. /s
    • Godel_unicode 8y ago
      What part of the DNS standard governs how URLs are displayed, exactly?
  • trocadero 8y ago
    >there's a difference between "www.example.com" and "example.com" Can you link to a site where these two are different?
    • deleted 8y ago
      [deleted]
    • geophertz 8y ago
      www.pool.ntp.org pool.ntp.org
    • ddebernardy 8y ago
      From one of the comments there: http://www.pool.ntp.org http://www.pool.ntp.org vs http://pool.ntp.org http://pool.ntp.org One takes you to the website about the project, the other goes to a random ntp server.
      • trocadero 8y ago
• megous 8y ago
  Presumably chromium doesn't do this. I can see www.
• pathartl 8y ago
  Instead, what they ought to do is go through the top 10,000 domains and test to make sure that: 1. www.* doesn't end up as a 404 or DNS resolution error 2. www.example.com matches the content from example.com 3. www.example.com -> example.com is a valid permanent redirect and then finally 4. Publicly shame them. Don't hide it from people because you run into all sorts of UX issues. I really hate www. for a multitude of reasons, but the biggest one is just thinking about the amount of time spent saying it out loud. Nothing aggrivates me more than turning on the radio and hearing "go to our website DOUBLE YEW DOUBLE YEW DOUBLE YEW DOT <some long name like nelsonfurnishingandrepair dot com>". That's like two seconds of air time they could recover.
• CGamesPlay 8y ago
  Lest anyone think that Chrome is being innovative here, this is Safari's default behavior for when the URL bar isn't focused. When you click on the URL bar, the subdomain, protocol, and path all appear.
  • nimrod0 8y ago
    A much saner behavior is to hide the URL entirely until focused, not to show a secretly mangled version.
    • cpeterso 8y ago
      Safari shows only the domain name (minus "www."), so Google News is shown as "news.google.com" until you click to see the full URL "https://news.google.com/?hl=en-US&gl=US&ceid=US:en" https://news.google.com/?hl=en-US&gl=US&ceid=US:en".
  • stronglikedan 8y ago
    Which drives me crazy, because my users send me screenshots in support requests. Now I have to spend even more time explaining to them how to click/copy/paste the URL. It was a terrible UX choice when Safari did it, and it's a terrible UX choice now that Chrome has done it.
    • qubitcoder 8y ago
      Fortunately, it's trivial to toggle this setting in the Safari preferences--and then the full URL will appear by default.
• phillipseamore 8y ago
  It's been like this on mobiles for a couple of years right?
• LeoNatan25 8y ago
  Chrome 69 has been a joke so far, in UX, design and bugs (on Mac). It's good, because it will push more people to Firefox.
• znpy 8y ago
  the amount of assumptions that browsers make nowadays is really getting out of hand. Chrome on my work laptop doesn't even bother resolving a name that certainly does not look like an url but exists in the network. Instead it will look it up on (guess what?) Google.
  • jazoom 8y ago
    There's a particular 8-letter, simple subdomain for my domain (.com) where Chrome treats it as a Google search. Doesn't do it for any other subdomains. It makes no sense.
• OnlyRepliesToBS 8y ago
  is this for real?
• ForHackernews 8y ago
  https://www.wired.com/story/google-wants-to-kill-the-url/ https://www.wired.com/story/google-wants-to-kill-the-url/
• adamgravitis 8y ago
  I would just point out that HN does this in the title of every link posted, and has been doing this for years.
  • skykooler 8y ago
    HN removes all subdomains, not just "trivial" ones. That's a separate issue.
• nkkollaw 8y ago
  For web developers it's a pain, but I can see how it might help everyone else (which is I assume the vast majority). At least they haven't been as idiotic as Apple and didn't remove everything but the domain name like Apple did, and they did it incrementally.
• vinceguidry 8y ago
  I am in favor of the change. I do not think hiding technical information from non-technical users is a bad thing. Making it impossible for technical users to work it out is the bad thing. If technical users want their own browser mode, where all these things are readily available, then I'd be all for that. Clicking on the browser location bar should reveal the full URL. But the noise of the protocol, the www. prefix, and the param string is all irrelevant to the experience of the casual user of web browsers and should indeed be hidden. We're already hiding a ton of stuff from them already, if you want to go see it, you can always "view source". One argument in the thread was that 'www.pool.ntp.org' and 'pool.ntp.org' go to a website and a nameserver respectively. Nontechnical users will never want to use a web browser to access a nameserver, so there's no UX benefit to distinguishing them. From a URL entry standpoint, it should go to the URL that was typed into the location bar. There isn't a conflict.
  • drb91 8y ago
    It’s not that technical, though, to people urls are just strings. Why would people care if they can see the www or not? If anything, this is likely to introduce more confusion.
  • baby 8y ago
    True. The www. subdomain has been irrelevant for a very long time now and a great source of confusion for both users and developers who never know how to set their domains.
  • shiado 8y ago
    It breaks how the web is supposed to function. There is no consensus on the utilization of subdomains and which ones are considered to be trivial. I could write an app which maps usernames to subdomains and Chrome would break this if a user had a username which was in the trivial list. I think Tumblr is a site which does this. It really isn't about technical or non-technical, it is about what subdomains can be used for. Edit: well I was right, this breaks in the new Chrome, http://m.tumblr.com/ http://m.tumblr.com/ , tumblr usernames on the 'trivial' list are broken.
    • 8y ago
• lvs 8y ago
  Does it hide AMP subdomain? If so, I think we all know what this is about, and it's dirty and should be stopped.
• blitmap 8y ago
  Not in favor of Google deciding yet again how I want to browse/view the web. I've been extricating myself from Google services slowly, and I think it's time for Firefox again. Kind of arrogant to decide something like this for more than a billion users, and a step backward for those of us in IT who have a hard time getting the user to understand a visual difference in the address bar.
• jklinger410 8y ago
  You know, as much as I'm all for considering www a trivial subdomain, this should have had much more public discussion before implementing it into the most used browser in the world.
• bguillet 8y ago
  This reminds me of Windows hiding file extensions by default. So annoying... now you don't know what your dealing with, it's harder to modify etc
• 1zael 8y ago
  Seriously? This is such a bad change, I hope they revert this patch in the next update. There's a world of difference between the two and this is going to cause an ecosystem nightmare.
• pdeuchler 8y ago
  I, for one, cannot wait until this is exploited somehow by phishers
• Already__Taken 8y ago
  The UX of moving what I'm looking at instantly under click is very unpleasant too, www. and http and even the "secure" "not secure" banners is like 200px shifts. Lots of google's UI is getting (or has) things shifting instantly under the pointer it's quite annoying. The new gmail design quick-tools are often in the way, unknown until you actually click. Hell calling on my phone shifts the speaker and keypad buttons over instantly when someone picks up. Often placing the person I just called on hold if they answer too fast. Wasn't this a pretty well covered UX rule to not move shit around on users. Up there with don't use modes and the like.
  • NathanCH 8y ago
    > The UX of moving what I'm looking at instantly under click is very unpleasant too, Could you expand on this? What are you referring to?
    • rhizome 8y ago
      I don't know if it's the same thing, but I'll bite: it's absolutely maddening to edit or select part of a URL. Click in the address bar and the entire address is selected, then you click on any part of it to either select a part or to place your cursor in order to add to it, after which Chrome appears to first shift the entire URL to the right in order to show the protocol, then it places the cursor within the shifted URL under your pointer. This causes (attempted) selections to be established from some other place in the URL than the user intended.
      • archon810 8y ago
        Yes, it's this, and it's an absolutely infuriating change.
      • cottsak 8y ago
        ugh!!!!! this is killing me
        • cottsak 8y ago
• russellbeattie 8y ago
  This is a classic example of techies, marketers and MBAs deciding what is "too confusing" for "normal" people to understand. This is why the History channel shows reality TV instead of programs about, you know, history. It was decided that "history" that doesn't involve celebrities, aliens or Nazis is just too boring for normal people. Google has decided that the 50% of population who are confused about the basics of URLs are more important than the rest of us who have been using them for over 25 years without problems. This will in theory allow Google to target a larger swath of the population. In practice, it simply takes something useful away from the rest of us. It's "digital ochlocracy": The targeting of the least common denominator to the detriment of those with greater knowledge or expertise.
  • type0 8y ago
    It's more sinister than that, they are devaluing the importance of URL so that you would have to search for it; the worst is yet to come.
• westoque 8y ago
  As a developer on multi-tenant applications that are mounted on different subdomains, considering `site.com` same with `www.site.com` should be outright illegal! There is nothing trivial about the domains above and are considered separate unless configured to be pointing to the same record.
• NathanCH 8y ago
  This is worse than the time Google ruined autocomplete and autofill: https://bugs.chromium.org/p/chromium/issues/detail?id=587466 https://bugs.chromium.org/p/chromium/issues/detail?id=587466
• xg15 8y ago
  Is this supposed to be the first step of this? : https://arstechnica.com/gadgets/2018/09/google-wants-to-get-rid-of-urls-but-doesnt-know-what-to-use-instead/ https://arstechnica.com/gadgets/2018/09/google-wants-to-get-...
• wolco 8y ago
  I hope people start moving from chrome to firefox. The standards they pushing are harming the web in ways.
  • fastball 8y ago
    If only Firefox's JS handling didn't melt my laptop.
    • ChristianBundy 8y ago
      Yeah, I switched from Firefox to Epiphany (also called GNOME Web[0]) and I have the best of both worlds: a WebKit browser that's more feature-complete than luakit/surf/etc., with Firefox sync integration and no Google. It's like an open source Safari clone and it works beautifully. [0]: https://wiki.gnome.org/Apps/Web https://wiki.gnome.org/Apps/Web
    • bbcbasic 8y ago
      Firefox is a proximate cause. Bloated websites are the root cause.
    • inetknght 8y ago
      Then turn it off.
      • fastball 8y ago
        I actually like to use websites that were made in the last decade, so instead of doing that I just use Chrome.
  • lmedinas 8y ago
    i use Firefox @ work and @home for serious stuff. The only reason i don't use Firefox 100% is due to the Android app which is a lag fest. Mozilla needs to put more resources on Android.
    • zanmat0 8y ago
• rawoke083600 8y ago
  Ja this is terrible idea !
• snissn 8y ago
  as a developer i can already forsee the pain of debugging an issue with cookies and realizing that it comes down to the subdomain
• SllX 8y ago
  So apparently when Google said they would like to "fix" URLs, what they actually meant was that they would like to break them, whine about how broken they are in the future, and then come up with something worse.
• adrianmonk 8y ago
  I can somewhat understand the urge to de-clutter the URL and emphasize which parts are most important. But I'd prefer they did it in another way which doesn't involve hiding anything. For example, render the most important parts of the URL in bold type, a color that contrasts more, or a slightly larger point size. That way, you still make it easier for the eye to pick up the parts that the browser believes probably matter most, but you don't make it impossible to see the parts that might also matter.
• manigandham 8y ago
  Most people don't notice or care, so this change makes no difference for them. For the few that do care, this change makes things worse. So basically a dumb design-by-committee change that just wasted effort for negative progress.
• sakisv 8y ago
  It's 2018 ffs and internet is everywhere. People should be expected to have better understanding of the internet and of what they see on their address bars. Maybe instead of masking users from the "complexity" we should be teaching them instead.
• dhruvrrp 8y ago
  It’s wierd how everyone seems to be so against to this change. hasn’t safari been doing this since forever?
• type0 8y ago
  I like how hugues.a. summarized it there: This is Google making subdomain usage decisions for other entities outside of Google. My domains and how subdomains are assigned and delegated are not Google's business to decide.
• ezequiel-garzon 8y ago
  Whether "we" like it or not, URLs are increasingly becoming a rare techy term. It is no wonder the average user has a problem with URLs with the advent of omnibars. I for one can't sometimes "force" Chrome to go to domain.com instead of searching that expression. Oh, and try to view the full URL you're accessing on your iPhone, particularly if you're GETting something other than /.
• crazygringo 8y ago
  Safari already hides "www.". In fact it hides everything except the root-level domain, e.g. "https://www.google.com/about/" https://www.google.com/about/" shows just "[lock] google.com". Firefox and Opera show the full domain but gray out everything in the entire URL except the root-level domain, so "www." is gray. Just saying, de-emphasizing and hiding parts of the URL is clearly a trend. This isn't just a Google thing.
  • parliament32 8y ago
    De-emphasizing is fine, hiding alltogether is not -- for both protocols and subdomains.
    • gempir 8y ago
      But Chrome does exactly that. If you put focus in the URL bar in Chrome 69 it shows the full domain including protocol so amazon.de is visible on focus it's https://www.amazon.de https://www.amazon.de
      • scarlac 8y ago
        I thought that's how it worked too but it is not. 1 click shows the entire url and selects it. Still without "www.". Another click will show "www.". Regardless of how you feel about the change, it does indeed hide 'www.' to the point where a power user could easily be fooled that it was the naked domain. Edit: Here's a demo of how it works: https://www.useloom.com/share/f7d71b95d75b4c4582bb38cdc8432654 https://www.useloom.com/share/f7d71b95d75b4c4582bb38cdc84326...
  • nichochar 8y ago
    this is actually the main reason I cannot use Safari. It always boggled my mind that they made this decision. For power users, they never look at the url unless they want information from it, in which case the `www` is valuable. For low tech users, it can lead to straight up incomprehensible issues, like sites not rendering properly (think of a `m.*`). The UI gains are so small, that part of the screen is never really looked at, but needs to be there, and typically has tons of horizontal room... I don't get it
• throwawaymath 8y ago
  I like the implementation bug mentioned that shortens subdomain.www.example.com to subdomain.example.com. That's just actively dangerous for users.
• tankenmate 8y ago
  Google has signed a contract with ICANN as it is a registry and a registrar. In that contract it has agreed to limit behaviour that affects the security and stability of the name system. This behaviour of chromium is in contravention of that contract.
• mvpu 8y ago
  Spirited discussion! I think for the average Joe, this change does not matter (i.e neither good, nor bad). Two better changes: a) highlight https / secure connections even more prominently, and b) detect and highlight misspelled domain names (a major cause of phishing attacks). Rationale is that for the average Joe, a clear warning that they are about to go to a bad site is more valuable than looking at the accurate domain name.
• bluejay2387 8y ago
  Is anyone else starting to see parallels between Google's attitude toward "progressing" Chrome and Microsoft's attitude towards IE in the 3-8 version days?
• jgowdy 8y ago
  If only we had something other than the subdomain to indicate what protocol we want to use to access the host in question. Like maybe some kind of... port number and/or protocol prefix. "www." is useless. Eliminating it wouldn't be a bad thing. "m." for mobile sites is extremely archaic. Sites should work on mobile without special subdomains. If you issue subdomains to strangers on your root domain, the URL bar showing the subdomain shouldn't be your "security model." The root domain is the root authority behind the site in question. Chrome showing users that information in a clear and concise way isn't "subverting the domain name system". Safari has been doing this for a long time, and Chrome/Chromium have settings/flags that allow you to turn this behavior off. The amount of crying over this change is ridiculous in my opinion. As long as they keep this configurable (in fact, they should add a UI config for it) I see no problem here.
  • furi 8y ago
    "www." is useless until you have multiple servers. Say you run a game server and a website on a web server for that game server as well. You need to give them separate domains so that they can resolve to separate IP addresses i.e. "www.example.com" might resolve to <web server IP> and "example.com" might resolve to <game server IP>. This is far more robust, faster and simpler (and how the system was intended to be used) than trying to set up some kind of proxying system on one of the servers to handle traffic really intended for the other one. In real world usage of course you'd probably put the game server at "game.example.com" and the web server at "example.com" but either way you end up with a subdomain, the arrangement with "www." as the subdomain instead of "game." is not really any more useless. I believe this can possibly be worked around with SRV records but then you have to rely on whatever your client might be handling SRV records. > If you issue subdomains to strangers on your root domain, the URL bar showing the subdomain shouldn't be your "security model." What do you propose instead? Azure gives me custom subdomains for my servers that are immensely useful, being much more regular and memorable than IP addresses. I only see two solutions here: stop doing that or let anybody with access to subdomain creation pretend to be "azure.com". One of them is comically dangerous and the other is throwing out a perfectly good feature to save a handful of characters in the URL bar.
• abalone 8y ago
  > This is a dumb change. No part of a domain should be considered "trivial". As an ISP, we often have to go to great lengths to teach users that "www.domain.com" and "domain.com" are two different domains... What ISPs teach their users anymore these days? Why the heck do we want to go back to that? Time for a modicum of historical perspective. If you care about usability this is clearly an improvement. This is part of a long-running industry trend -- Safari does this too -- to improve the usability of the Internet and technology in general. At EVERY STEP in that journey there has whining and griping from the more technically advanced folks (like all of us on this forum). They zero in on the negatives, the tradeoffs that come with simplification. They don't see the positives because they're technically advanced enough and don't benefit from simplification (or so they think). Then after the griping whines (sic) down and they realize the world didn't end and the downsides really weren't that bad and we move forward towards a better, simpler, more usable web. Like, who actually runs separate HTTP servers on example.com and www.example.com anyway? Everyone is hyperventilating over contrived "the principle of it all" examples. Bottom line, Apple & Google are putting usability above technical pedantry. That's the right priority for mass market technology products.
  • slenk 8y ago
    Two prominent examples noted in the bug: https://citibank.com.sg https://citibank.com.sg and https://www.citibank.com.sg https://www.citibank.com.sg are different, http://www.pool.ntp.org http://www.pool.ntp.org and http://pool.ntp.org http://pool.ntp.org are different. Like, big companies run separate servers on the two domains. That's besides the fact where if you have www.example.www.example.com, it rewrites to example.example.com.
    • DougBTX 8y ago
      The first citibank url doesn’t load for me, so it is site vs not site rather than two different sites, and both those ntp urls are redirecting me to https://www.ntppool.org/en/ https://www.ntppool.org/en/ - perhaps there’s less substance than meets the eye to those complaints.
      • 8y ago
• bopbop 8y ago
  This is the third story today about a Google's handling/intentions towards web addresses and general webpages. The theme is Google wants/may want to push a new set of Google orientated web standards. This seems the least likely of the three to be strategically related,however. The other two: Google may/may not be pushing the open web standard towards their own AMP pages, instead: https://news.ycombinator.com/item?id=17920720 https://news.ycombinator.com/item?id=17920720 Google wants to get rid of URLs but doesn't know what to replace it with: https://news.ycombinator.com/item?id=17925761 https://news.ycombinator.com/item?id=17925761
• tenebrisalietum 8y ago
  URLs can be complex and sometimes not intended for human consumption. So fine, don't display the URL. Define a full-on standard that lets a user agent show a "friendly but not unwieldy" name to the user. You have that funky Graph API or whatever Facebook started to allow URL posts in Facebook to expand to include site info. Why not just use that at the top of browse? Then design the browser to allow access and editing of the URL somehow if desired (an old browser called 'OB1' didn't display the URL unless you pressed Ctrl-W, for example), but don't display it by default. The truth is probably not many technical people directly enter URLs in browsers any more. Honestly maybe it wasn't a good idea to allow query strings in URLs. Perhaps deprecate them and keep URLs looking like hierarchical filenames. Which honestly, is still something difficult to understand for non-technical people. But this crap of hiding parts of it is dumb.
• nodesocket 8y ago
  Curious, why did www.foo.com become the standard instead of using the apex/root foo.com domain? Was this because of the DNS limitations of using CNAME records at the apex/root?
  • detaro 8y ago
    Because HTTP was one service among many, not the primary one, and failed to use a different DNS record than A to look up the target, unlike other protocols which manage this redirection to the "$protocol server" that way instead of through a subdomain name. (E.g. mail has MX records to find the mail server, many other protocols use SRV records to discover their specific targets)
• everydaypanos 8y ago
  Although a firm NO-WWW believer this is hilarious because it is not the same as hiding http(s):// this is technically speaking an alternation of the url. Still..with Google's horrible AMP efforts this seems nice :)
• tuxone 8y ago
  Who cares will switch the flag. Who doesn’t, just doesn’t.
• combatentropy 8y ago
  Dear Google, just do syntax highlighting. Make the subdomain gray. You can even color https: green and http: red. But don't hide them. I really think syntax highlighting will accomplish the same thing for less technical users.
  • theyinwhy 8y ago
    Grey is usually understood as greyed out: not selectable, non-functional and therefore counter-intuitive as well.
• deleted 8y ago
  [deleted]
• CmdrKrool 8y ago
  Lots of people saying this is for the benefit of non-technical users. For me, this is a minor inconvenience, precisely because I'm technically capable/interested enough to handle the inconsistency. But this kind of stuff (and I am speaking somewhat generally here) tends to frustrate me, precisely when I'm trying to educate or deal with a non-technical user in some capacity where it happens to matter. I can't just tell them, "that is the address of the page, and that will always lead to the exact same place if you type it fully and correctly, and that's that". Instead I have to get my head around what if they're using browser X or operating system Y, I have to ask on the phone first, "hang on, tell me what you see on your screen", I have to say to the lady who's eagerly sat in front of me with pen hovered above paper waiting for me to dictate how to do a thing in straightforward steps, "well it depends, first you have to check this thing, and if it's like this then you can do this but it might also be like that in which case it's a bit different, let me explain" - and this is usually the point at which the non-technical user gets tired and throws the book at me. In short, I think consistency of information and process is usually much more understandable and useful to users of any level, than the dumb 'simplification' of this half-baked information-hiding.
  • GuB-42 8y ago
    Yeah, I think that consistency is greatly undervalued. Grandma has no problem with technical details being shown, she just ignores them, she just knows that clicking on the button on the top left will go the the webmail and that she needs to click the big red button in order to write a new email. Change anything and she will get lost, click everywhere, and usually find the solution, but sometimes make a mess. There are also security implications. I told her to be aware of any change, because it may imply a phishing attempt, or some malware. But how is it going to work if legitimate software always change. You are basically training them to stop thinking about what happens, which is terrible since thinking is the only thing that can protect them since they don't have the technical intuition most of us have.
  • euske 8y ago
    I wholeheartedly agree with this. There are two sides of the debate now. One side says that the machines should be clever enough to guess the user's intention and go around of their mistakes, while the other side says that the machines should stay as dumb and square. The question is about who is handling the complexity of this world, and in my opinion it should be often left to the human, not to the machines.
• amenghra 8y ago
  Lol at "subdomain.www.domain.com" displays as "subdomain.domain.com".
• nofunsir 8y ago
  I'm going to assume there will be no convincing The Team of people whose Wonderful Idea this was. https://www.wired.com/2016/11/googles-chrome-hackers-flip-webs-security-model/ https://www.wired.com/2016/11/googles-chrome-hackers-flip-we... No more red purses? Give me a break.
• darth_mastah 8y ago
  To be honest, I want to see the actual domain I'm on in the location bar, and not some obscured version of it. In what universe is hiding part of the domain an usability improvement? What does it improve? Confusion? Misinformation? Lack of trust in the location showed by the browser? It's so stupid I had to check the calendar to make sure it's not the 1st of April today. I didn't check it in Chrome though, for fear that some days might have been hidden away as they have been considered trivial.
• jancsika 8y ago
  This is AWESOME! Thank you Chrome! On a completely unrelated topic, there is a bug I'm noticing: ICANN doesn't allow emojis in TLDs. What? That's ridiculous-- I can put them in the main part of the domain name along with an enormous number of cute homoglyphs. So why not smileys and homoglyphs in TLDs? If users can deal with smileys in the main domain that tells where the site is, surely they can deal with them in the little extra part that comes at the end. Everything's just .com underneath anyway so what would problem be? Google has done the work to remove the unsafe part of domains. Now our domains can really shine. So give us more bling to put in there, ICANN! C'mon. Also-- why not www as tld? I love "biz" and "pizza" as much as anyone, but excuse me they got nuthin on the world wide web. C'mon ICANN give us "www" in the Trailing Little Domain! We're ready for it now! :) Best, Your Userbase
  • deleted 8y ago
    [deleted]
• joeyyang 8y ago
  Nice
• Multicomp 8y ago
  So now they've added "Restrict-AddIssueComment-EditIssue" to the bug. [Edit: This means that only users with EditIssue permissions may comment on it] Apparently we've complained too loudly for their liking.
• sureaboutthis 8y ago
  I would guess this makes Chrome and non-standards compliant browser.
• cwkoss 8y ago
  Wow, if this actually gets released, might be the final straw to get me to switch off Chrome.
• lwansbrough 8y ago
  Surely Google of all companies has the resources to see exactly how much disruption this will actually cause. And I don't believe they get to make the decision based on that, but they should share the numbers. Any domain that returns different content between "m." and "www." vs. the apex domain are affected.
• trjordan 8y ago
  It's technically correct that www.example.com and example.com are different domains and can serve different stuff. So are https://example.com https://example.com and http://example.com http://example.com. If you serve materially different content based on small differences, that's user-hostile, and common tools have no obligation to support you. Chrome shouldn't cater to sites that change behavior based on a www prefix, because the vast majority of users expect those sites to be the same. Hiding the prefix won't change their mind.
  • baby 8y ago
    This should be the top comment. Users (including technical users) all behave weirdly by writing "www." depending on their mood or previous experiences. Developers setting up webpages do the same and often manage to screw up a CNAME on the www subdomain or to have two valid certificates for the www. And the non-www. Also, once you rotate cert you now have two to rotate. It's a mess and chrome's change is aiming at normalizing this. The complaints make zero sense.
  • simsla 8y ago
    I agree, but Google doesn't just get rid of prefixes. news.ycombinator.www.com would get normalized to news.ycombinator.com (not sure what would happen when using the www tld) That's an extreme example, but there's an obvious security risk. This is a half assed change with buggy behaviour, regardless of whether you think www.domain.tld is materially different from domain.tld or not.
  • muraiki 8y ago
    Small differences? A subdomain or an entire protocol is a small difference? And what about any web site that uses a "m." subdomain that doesn't intend it for mobile? I don't think that calling these things "small differences" is reasonable. And really, it makes perfect sense to not serve the same content over an insecure connection than over a secure one, but thankfully that change hasn't happened!
• alasdair_ 8y ago
  The worst case of this that I've seen is with Safari on mac. The domain gets completely hidden if it's an HTTPS site that is "verified" (i.e. the entity shows up in Dunn and Broadstreet) Visit "www.apple.com" in Safari and you will get "Apple, Inc" in the URL bar after a moment. This seems like a potentially reasonable choice until you realize that someone could register, say "Apple, Inc" in another state and get a HTTPS cert to match it. One phishing email later and the Safari user is convinced they are logging in to the correct domain. I can see lots of new phishing attacks made possible because of this. :(
• ezoe 8y ago
  I switched to the Firefox some time ago when Chromium always eat precious whole one CPU core time for stupid field trials. Now I know Chromium is developed by bunch of idiots who don't understand the practical consequence of omitting the part of domain name.
• sigzero 8y ago
  Just leave it alone Google. Sheesh.
• DewWisp 8y ago
  "trivial", yeah okay sure...
• frazras 8y ago
  Look at this http://www.this.www.is.www.not.www.really.www.google.com http://www.this.www.is.www.not.www.really.www.google.com :-D
• acid303 8y ago
  Pressing alt+d selects the address in the address bar but does not expand it, the expanded one is copied when you press ctrl+c. Hilarious.
• sodosopa 8y ago
  What a stupid bug and yes it's a purposely developed bug. Will cause a lot of problems as noted.
• noypi 8y ago
  http://www3.www.audi.ch/ http://www3.www.audi.ch/
• deleted 8y ago
  [deleted]
• mmilano 8y ago
  Firefox is my primary browser, so it doesn't affect me, however this has already caused confusion within the web agency world I work in, both with technical staff and clients.
• JoshMnem 8y ago
  Looking at everything that Google is doing at the moment, it looks like a shameful power grab for the entire WWW. I suspect that Google wants to gradually get rid of URLs, because if users can't identify websites by their addresses, they will be more dependent on Google Search. Landing on search pages means that users will click on more of their well-concealed ads. I think it's also the reason why Google Chrome's URL bar has such terrible auto-completion functionality. It appears designed to send users to Google Search to click on ads instead of taking them directly to their destinations. Firefox's old address bar didn't do that. (The newer address bar in Firefox appears to be following Chrome's time-wasting functionality, and its auto-completion no longer works well.) Without URLs, users won't know whether they are really on your site, viewing your content on google.com (via AMP), or in some kind of app or PWA. To get to an item of content, most people will end up clicking on an ad in Google Search or land on an AMP page that eliminates most monetization options that don't involve passing the money through Google's systems. URLs shouldn't be trimmed at all. When you're on the URL, http://example.com/ http://example.com/, (note the trailing slash), Chrome will only display "http://example.com" http://example.com", even if you copy it onto the clipboard. (It's still possible to fix it in Firefox with about:config.) Technology shouldn't be made more restrictive and stupid -- users should be taught how to use technology correctly, and they will adjust. I've even met professional programmers who don't really understand URLs because their browsers mask the real URLs. The WWW isn't only about consumption -- it's about creating as well. People need to know how it works in order to create things.
• nogbit 8y ago
  Same response as yesterday, stop using Chrome, now, there are alternatives.
• ajfabb 8y ago
  epic bikeshed
• Exuma 8y ago
  Holy mother of god
• ryenus 8y ago
  The issue has only 46 comments at this moment because they have restricted the permission to comment, very nice. I thought there would be hundreds of, otherwise. BTW, it sucks that existing comments cannot be voted or reacted with emojis, they should know this: https://bugs.chromium.org/p/monorail/issues/detail?id=4248 https://bugs.chromium.org/p/monorail/issues/detail?id=4248
• makecheck 8y ago
  I don’t understand the war on URLs. I can’t even edit the link a bookmark uses in some browsers now, which is infuriating for SharePoint or other sites where “currently displayed URL” is not a clean and canonical URL (even though one exists). And when the terrible random URL jumble currently in the address bar won’t even reproduce the page correctly later, this ceases to be a bookmark. URLs may be weird but they are not so complex that we need these games.
• stevewilhelm 8y ago
  If I was designing the user experience for accessing content from a global information, entertainment, and commerce network that would be used by a large, global, non-technical user base, I would not use the current URL format. I would wager the twelve character prefix "https://www."would https://www."would make no sense to 99.9% of the users and should be the default for over 99.9% of requests they would be making any given day. I am guessing Google has evidence that this is the case.
• damm 8y ago
  Doesn't this make it easier to phish? Seems like it to me.
• userbinator 8y ago
  Those who are saying this change is to make things "easier" for certain non-literate users may be correct, but they should consider whether such a justification is desirable at all from a moral perspective. No doubt all of us have at some point been forced to learn things that we did not find particularly useful or pleasant to learn at the time, but then later experienced a great "satisfaction of knowledge" when faced with a situation in which that knowledge became advantageous or even essential, and then proceeded to use it to better ourselves. Imagine a world in which none of that learning took place; one in which you never have to think, everything you see and do automatically satisifies you and keeps you in a blissful state of ignorance. Who makes the decisions in that world; or rather, who can make those decisions? Who is in charge of your life? Not you. Gradually reducing the motivation to learn, by making things "easy" and hiding/obfuscating anything that could be used as a starting point for more learning, makes for a population that won't think, won't learn, won't question or rebel. It makes them docile and easy to control. Making statements like "ordinary users will never learn" is one thing, but explicitly making decisions to ensure that status quo is a horrible trend. It's quite a genius plan, and certainly used by organisations other than Google, but thoroughly disturbing. I've said a few times before in the past: "knowledge is power --- they don't want you to have too much."
  • inetknght 8y ago
    Onward to Idiocracy we go! /s
  • pdkl95 8y ago
    Some of my comments from 4 years ago when Chrome hiding URLs was just an "experiment": https://news.ycombinator.com/item?id=7694919 https://news.ycombinator.com/item?id=7694919
• infinity0 8y ago
  This is about as ridiculous as javascript making == not homomorphic for the reason of "making it easy for newcomers". Please, predictability and consistency is what helps newcomers, not pandering to prejudiced intuitions.
• chris_wot 8y ago
  Has anyone tried www.www.com? what's the bet that domain will display oddly... And what if I setup a domain with a subdomain of the www? I'm sure also someone clever could find a way of using this for phishing.
• miguelmota 8y ago
  Surprised to see not a single mention of Brave [1] in this large thread of comments as an alternative browser. It's not the best for development, but for casual browsing it's great. Brave blocks all ads and trackers. [1] https://brave.com https://brave.com
• vincentmarle 8y ago
  Next up: “.com” is trivial too, let’s remove that too.
• deleted 8y ago
  [deleted]
• HyperTalk2 8y ago
  Once you get as big as Google or Apple, you're too big to fail and there is no longer any pressure to make good decisions because there are no actual consequences for making moronic decisions.
• cyberpanther 8y ago
  I would love to get rid of www but this going to confuse the heck out of people. We could get rid of www if more DNS providers supported ANAME. And Google Domains does not. How bout start there.
• iveqy 8y ago
  Many not tech-savvy users I know, never use URL's. They use the address bar for doing a google search and then they click on the correct site in the search results. URL's is already dead.
• tigrezno 8y ago
  Fellow HN's, why the hell are you still using chrome?
• gondo 8y ago
  From the chrome flags [1] page: "On Mac, this enables MacViews, which uses toolkit-views for native browser dialogs." What is MacViews and how do I check if it is enabled? [1] chrome://flags/#omnibox-ui-hide-steady-state-url-scheme-and-subdomains
• Venipa 8y ago
  chrome://flags/#omnibox-ui-hide-steady-state-url-scheme-and-subdomains disables this new "feature"
• therealmarv 8y ago
  Cool, the internet is changing is to my personal preference. Don't like www.
• akerro 8y ago
  We allowed this to happen, we allowed Google to claim Internet and web, they make rules now, give up to and embrace hiding www. and to AMP before it's too late and you're out of the loop.
• homero 8y ago
  Subdomains are very important, stop hiding where I am.
• sam_goody 8y ago
  Most comments assume that this is for solving user confusion, or security, or building a better URL scheme, et al. It's not, that is all smokescreen. As ivs wrote[1] They are going to hide amp subdomain, so you don't know if you're looking at AMP or the actual destination. And then suddenly the whole world funnels through AMP. And for that reason, it won't be reversed until people call them for what they are actually trying to do. [1]: https://news.ycombinator.com/item?id=17928939 https://news.ycombinator.com/item?id=17928939
  • fouc 8y ago
    That makes sense. And not just AMP but they want to train users to NOT pay attention to domain/subdomains, leading to more room for other exploits.
  • untog 8y ago
    AMP pages are served through google.com, though? It's one of the big problems with them.
    • Seirdy 8y ago
      Not always. Sometimes Google results have taken me to websites like "amp.reddit.com" on mobile.
  • krn 8y ago
    This should be the top comment. After this change, we are just one step away from using the browser's address bar only as a Google search box, and Google as the entire internet's gatekeeper. Google doesn't make money when you type the URL into your browser's address bar – it makes when you don't.
  • Ajedi32 8y ago
    Yeah... no. That's just baseless FUD. They _are_ indeed planning to get rid of AMP cache URLs, but they'll be doing it through open W3C standards anyone can use, not through special-casing their own domains: https://amphtml.wordpress.com/2018/05/08/a-first-look-at-using-web-packaging-to-improve-amp-urls/ https://amphtml.wordpress.com/2018/05/08/a-first-look-at-usi...
• yAnonymous 8y ago
  A bunch of monkeys would have caught most of these bugs during testing - and have done a better job with the coding in the first place. >http://www.example.www.example.com http://www.example.www.example.com -> example.example.com What the fuck. I don't even.
• SquareWheel 8y ago
  How immature to submit this as a bug. It was obviously an intended feature.
  • ng-user 8y ago
    However it was intended by the developers is irrelevant to the average user using the product. To many many people this is a glaring bug.
    • SquareWheel 8y ago
      Bugtrackers are not an appropriate place to post feedback on products. They are for listing bugs.
• madisfun 8y ago
  Embrace, extend, and extinguish. The story of Google and the Web. Don't AMPlify the issue.
• Groxx 8y ago
  >Why is www hidden twice if the domain is "www.www.2ld.tld"? plus >"subdomain.www.domain.com" displays as "subdomain.domain.com". and >http://m.tumblr.com/ http://m.tumblr.com/ [1] Hoo boy. Can we officially call this a "shit-storm"? It seems extremely poorly thought through.[2] [1] seriously, visit that right now. utterly brilliant username, I wish them all the best. [2] unless you want to sell invisible AMP URLs. but then I want you to lose your job.
• Yizahi 8y ago
  The point of this change is not to mess with www. or m. any other subdomain. The real reason for this change is obviously from latest google moves is to hide one and only one subdomain from users - amp. They really don't want you to know when you are not on independent website but actually inside google silo, playing by google rules.
• deleted 8y ago
  [deleted]
• pluma 8y ago
  Isn't this the same logic that still results in Windows users running malware because someone sent them sexy_nudes.jpeg.exe?
• Domesist 8y ago
  Google shouldn't be the authority to decide whether one Domains' part or another is "trivial".
• lucideer 8y ago
  Even if you believe this is in theory a good idea, in practice it's clear that Chrome has implemented this extremely badly. As Comment 5 on that issue points out: > This does appear to be inconsistent/improperly implemented. Why is www hidden twice if the domain is "www.www.2ld.tld"? [...] If the root zone is a 301 to the "www" version, removing "www" from the omnibox would be acceptable since the server indicated the root zone isn't intended for use. This isn't the behavior, though. > If example.com returns a 403 status, and www.example.com returns a 404 status, the www version is still hidden from the user. The www and the root are very obviously different pages and serve different purposes, so I believe the should be some logic regarding whether or not www should be hidden. It's not very difficult to come up with a simple algorithm that checks HTTP standard responses and implements this in a sensible way: it seems Chrome's developers haven't even stopped to think about how this should be done properly though. This is not so much a new policy issue as a buggy implementation issue.
  • snsr 8y ago
    Even dumber, from another comment- > Another case I ran into: > "subdomain.www.domain.com" displays as "subdomain.domain.com".
    • Avamander 8y ago
      And people like github.com/m can now host something and it'll look as `github.io` hosted it.
• keymone 8y ago
  it's true that this change is going to break some stuff for some people, but i welcome it. www has to go. it provides no meaning (as opposed to john.example.com) and it serves no purpose, we have schema in URLs to figure out the protocol and port.
• normo12 8y ago
  Suddenly "www.com"'s value has skyrocketed in the eyes of scammers. How about: * login.<target_site>.www.com -> login.<target_site>.com * members.<target_site>.www.com -> members.<target_site>.com Even some carefully chosen <target_site>.www.com's will now be valuable: * login.www.<target_site>.www.com -> login.<target_site>.com What a stupid idea...
  • Ajedi32 8y ago
    That's just a bug which I'm sure will be fixed in the next release. For this to actually help scammers (after the bug is fixed) they'd need to own www.example.com but not example.com, which is unlikely to say the least.
    • normo12 8y ago
      Yes, it is a bug, but until it's fixed it's a potential attack vector.
• Svoka 8y ago
  Chrome is a new IE.
• brod 8y ago
  relevant quotes from a recent Wired article "Google Wants to Kill the URL" > "People have a really hard time understanding URLs" - Adrienne Porter Felt, Chrome's engineering manager. > "But I do know that whatever we propose is going to be controversial." - Parisa Tabriz, director of engineering at Chrome. https://www.wired.com/story/google-wants-to-kill-the-url/ https://www.wired.com/story/google-wants-to-kill-the-url/
• nyxtom 8y ago
  Between this and other recent changes they sure have been making some pretty terrible decisions lately. Hopefully this change is reverted.
• tripzilch 8y ago
  This is such bullshit. They call it a "trade off", but a trade off between what exactly? On the one side there's a non-trivial number of negative consequences to this change, and on the other hand, the maintainer person literally is unable to give any other reason besides, "this isn't information that most users need to concern themselves with in most cases". No other reason given besides that very vague assumption about .. I'm not even sure, say if most users need not concern themselves with information that isn't there, does that mean they would otherwise be concerned about it? And what does that mean? And how is it bad? And why don't you just say so? I'm calling bullshit. If there is a reason why they decided this, it is not that. My bet it's something political.
• sathackr 8y ago
  Goodbye Chrome. I dumped Microsoft when they tried to shove Windows 10 down my throat. I use them only when I have to now. It's now Firefox for me.
• cc-d 8y ago
  Between this and AMP it looks like google's abusing their market dominance to seize control over the open internet. We were able to somewhat break up microsoft's attempt at something similar in the 90s through anti-trust legislation, perhaps it's time to look at google? On a side note, it seems like the openness of the internet has come under attack more and more often in the past few years, from a combination of corporate and government entities. It's absolutely essential that we keep the internet open, transparent, and free.
• sjs382 8y ago
  Where's the list for which subdomains Google considers "trivial"?
• tripzilch 8y ago
  Google doesn't want you to use URLSs. It must be this. They haven't given a single positive reason, except "users need not concern them with this information", which is so vague it's not even a reason. Google is still (partly) a search engine, and people interacting with the address bar is pretty much the opposite of using a search engine. So Google wants to discourage that. They will never teach users how URLs work, how to read them and definitely not how to construct them, because it makes people less dependent on their search engine. Think about it. Even the security part. Google wants to be the arbiter of what is secure and what is trustworthy. Anything that lets users figure this out for themselves, or that can be mediated without Google coming in between, takes away from this power. They don't show http/https any more, just a coloured lock icon. The meaning of that lock icon is for Google to decide, unlike the meaning of http/https. Now they take away information from the address bar, claiming it is irrelevant and none of our concern. They just want you to click on the links in their search engine, or some app or assistant thing. One thing it is NOT about though, is distraction. If anyone knows that users can tune out irrelevant information perfectly fine, it's Google. They are an advertising network, after all.
• webXL 8y ago
  This should have been an opt-in feature. And if enough people opted in, only then do you make it the default, and when you do that, alert all users to that change. Hiding the protocol was understandable. For web pages it was 99% http or https, and they could convey which with an icon. (iOS Chrome still shows it for some strange reason). Then mobile Safari dropped everything but the domain name and everyone freaked out. But you can get everything back in Safari by clicking on it, but not on Chrome. Such a simple thing to implement. If anything they could have just hid the query string, unless it's fairly simple like HN comments pages (item?id=17927972). But with pushstate, you could just hide the ugly bits (tracking, language, etc.) from the user. Take this Chrome promo URL: https://www.google.com/chrome/whatsnew/?hl=en&brand=CHZQ&utm_source=google.com&utm_medium=homepagepromo&utm_campaign=m69-whatsnew Using JavaScript, before anything is displayed, simplify it to: www.google.com/chrome/whatsnew And if you don't like www., don't host at or link to that subdomain!
• ourcat 8y ago
  Crikey. Looking at the various tests done by people on that thread highlights some pretty amateur string logic by whoever implemented it.
• jrnichols 8y ago
  When people say they're sick of Google deciding what's good for the whole internet and leveraging their massive marketshare.. it's stuff like this they're talking about. Other little things too like their own non-standard implementation of IMAP/POP stuff. Invisible to most average users, who continue to merrily click away on Google $EVERYTHING and Gmail.
• PinselPanther 8y ago
  This is kind of what happened to the KeeFox addon for Firefox. The developer one day decided to have a new default for URL matching. Instead of matching the hostname, i.e. old.reddit.com, it would then match the 'domain' i.e *reddit.com. Back then it was as stupid as this is now...
• ourcat 8y ago
  Just noticed: When clicking the main 'home' logo on facebook in Chrome 68, it's taking me to https://www.facebook.com https://www.facebook.com I'm sure it never used to do this. Did it?
• slr722 8y ago
  Seriously Google are getting some stupid "PRODUCT MANAGERS" who know fuck all about anything
• bradezone 8y ago
  Man, I hate authoritarians.