22 ms·

AMP pages displaying your own domain

200 points by dfabulich 8y ago

fiatjaf 8y ago
Does AMP run on Firefox? I've been using Firefox since the Quantum launch and haven't seen any AMP lately. I had completely forgotten this nightmare once existed.
throwaway66666 8y ago
I 've stopped using google because of AMP. Only google can sabotage google at this point, and I think this is how it will happen if they keep going this way.
craftinator 8y ago
Can any Google engineers comment on the the large amount of negativity towards AMP found in these HN comments (and pretty much every other HN forum discussing AMP)? I can't imagine working on a project and seeing so many people (especially given the average education level on HN) who can't stand it. I want to hear from you guys about this!
OnlyRepliesToBS 8y ago
anti-competitive class action lawsuit against google is required now
iandanforth 8y ago
I feel like Google is pushing AMP and components too hard. I've started to balk at the idea of using them even for explorations.
- ganeshkrishnan 8y ago
  AMP is like Brussels Sprouts. If it's forced on you when you are young, you will grow up hating it.
  - 48309248302 8y ago
    Brussels sprouts are good for you. AMP is more like medical experiments performed on you during an alien abduction.
    - ehnto 8y ago
      It's solely the search engine boost you get from AMP that bothers me. Because of the money involved many sites have no choice but to implement AMP and stay competitive. If it weren't for that, it would just be another technology and the fact that it only works in few circumstances would probably make many sites not bother with it. The UX downsides would probably see many sites actively avoid it. The fact that it has seen such adoption is testament to Google's ability to influence with it's rankings alone.
      - luckylion 8y ago
        Have you noticed ranking improvements? We've done AMP on some sites and not others and we saw no difference in ranking. Sure, having a very quickly opened page is nice, but on the other hand, features are limited. That might or might not work well, depending on what kind of content you have, what engagement you're looking for.
    - Kiro 8y ago
      What's up with this extreme hatred for AMP? I personally love AMP.
      - Moru 8y ago
        Most people do not like to be forced to do things a certain way. Especially if they have a working site already and now have to remake it from the ground up just because some other actor decided it isn't good enough to get visitors. Just you wait until you notice you can't go to town in your car any more. Only teslas are allowed into city.
        Kiro 8y ago
skilled 8y ago
I wonder if Google is self-aware to the fact that majority of webmasters don't give a shit about AMP.
- RHSeeger 8y ago
  The other half actively despise it.
  - ganeshkrishnan 8y ago
    "Your website has been banned for illegal activity and all content has been deleted. The suspension is immediate and indefinite. Please consider using another Internet" Also, their algorithms mistook live streaming of Notre Dame fires as 9/11 incident. How can live stream be a past incident? https://abcnews.go.com/Business/youtube-mistakenly-flags-notre-dame-fire-videos-911/story?id=62419884 https://abcnews.go.com/Business/youtube-mistakenly-flags-not...
    - Lammy 8y ago
      You are confusing the term “live stream” to mean something actually happening at that moment in the real world. All a “live” stream actually is to Youtube or FB or any other streaming service is just incoming RTMP packets. Youtube matches incoming streams against their ContentID database just as they do for normal uploads. I would bet that the same thing would have happened if the same footage were uploaded normally after the fact. People will use unlisted streams to broadcast pirated content otherwise. I faced a similarly false claim once where me playing Super Mario World on a real life SNES was falsely matched to some major label song, and since it was my third strike (all false) my account got banned from being able to use Youtube Live entirely. In the end I’m kind of glad that happened because it led to me developing my own minimal self-hosted stream site for small friends-only streams, including things Youtube would give legit claims for. My tiny VPS wouldn’t stand up to thousands or probably even dozens of simultaneous viewers like Youtube or the other big names can, but that doesn’t matter at all for me.
      - 8y ago
chrisfinazzo 8y ago
I'll just say this: Cache-Control: no-transform
- cramforce 8y ago
  Signed Exchanges are basically that but with cryptographic guarantee of no transform by caches. See https://github.com/WICG/webpackage/blob/master/explainer.md https://github.com/WICG/webpackage/blob/master/explainer.md [Working on AMP at Google]
albertgoeswoof 8y ago
Let’s hope AMP, like most google products, is shut down within the next 2-3 years
- ganeshkrishnan 8y ago
  Amen!
- sieabahlpark 8y ago
  Nah I see AMP staying around long enough to capture a significant portion of web share that they mine data from. Essentially is just a way to insert themselves as "the internet"
- zavi 8y ago
  Users love it so unlikely.
- dreamcompiler 8y ago
  Google products that suck the most tend to last a long time. See Google+.
- Kiro 8y ago
  Why is that? I think AMP is great.
- mrweasel 8y ago
  What's wrong with it exactly... beside being weird. I'm not a fan of manipulating the URL the way they do with this change, but couldn't you just opt to not use AMP if you don't like it? Ideally people would develop fast sites on their own, but apparently they need the help of Google.
  - nerdjon 8y ago
    The issue is that you can't, or you risk your site being basically blacklisted from google. Especially if your a news site. Users have no control outside of not using google. If google were to provide a setting for the user to never see AMP, I would have less issue with this. But they don't Instead, they basically force publishers to use this because if they don't the news carousel will not show their article. It just gives Google more control over the web for minimal at best benefits
48309248302 8y ago
This sounds terrible. Does it mean that browsers will begin lying to users and say that the users are visiting the website's server when they are really visiting a restricted version of the website that is hosted in Google's cache? I don't want my content restricted or hosted in Google's cache. AMP doesn't load in a privacy sensitive way. It's on Google's servers and it takes many seconds to load if you have JavaScript disabled. Also, the feature only works on Google Chrome and possibly Edge, which gives another point to the article below. https://www.zdnet.com/article/former-mozilla-exec-google-has-sabotaged-firefox-for-years/ https://www.zdnet.com/article/former-mozilla-exec-google-has... AMP is a fundamentally bad idea that needs to disappear. Edit: Mozilla has marked Signed HTTP Exchanges as harmful. https://mozilla.github.io/standards-positions/ https://mozilla.github.io/standards-positions/
- chii 8y ago
  > I don't want my content restricted or hosted in Google's cache. how is this different than using your own domain, but pointing it to a github.io page? Or using medium, but with your own domain (but still being served from medium's servers)? Is it just google you're adverse to, or the entire idea of someone else hosting your content?
  - 48309248302 8y ago
    1) I want full control over my servers and to not be penalized in search engines for not hosting my sites on Google. Where are the server-side logs? 2) I want full control over how I publish my sites with real web standards. AMP is not a web standard, it's a Google format that they are strong-arming people into using. 3) Mozilla considers Signed HTTP Exchanges harmful. This technology is as bad as what Microsoft was doing with IE in the old days. 4) I don't publish on Github pages, but if I did, I would still have a choice over which servers I put the sites on. 5) There shouldn't be a single company (or few companies) that dictates how we publish online. 6) Shame on the people who are splitting the web with this fake-opensource technology. There's even a Google engineer over here referring to the Web like it's a Google product. https://news.ycombinator.com/item?id=19631136 https://news.ycombinator.com/item?id=19631136
zjs 8y ago
I found Cloudflare's post on this topic to be more useful: https://news.ycombinator.com/item?id=19678693 https://news.ycombinator.com/item?id=19678693
0x54D5 8y ago
If you use AMP I will be blocking your domain from all my computers. End of story.
p1mrx 8y ago
Seems like a reasonable idea. The content server says "here, you hold this for me", and the address bar only shows who originally signed it. One could imagine replacing the serving layer with something like BitTorrent or IPFS.
- AgentME 8y ago
  Yeah, I think this feature and the signed exchanges standard both sound great. It allows CDN-like servers to host content without having to be trusted to not modify the content. That sounds like an improvement over the current CDN situation. Also, sites that link to other sites can preload the linked site's content into the user's browser, without leaking the user's IP to the linked site, so if the user doesn't follow the link, nothing about the user is revealed to the linked site. That sounds like a performance and privacy improvement wrapped up into one. I'm finding the rest of this discussion thread extremely disappointing as it seems like most of the posts here are just "amp=bad and amp people like this so it's also bad".
  - dane-pgp 8y ago
    Signed Exchanges could also remove some of the concerns around JavaScript crypto, because there is a (potentially offline) key that signs the web app you're running, so you're not vulnerable to hacks of the hosting environment itself. What's really needed is a way for the browser to lock a given web app/package to a specific version (and hash), so that even if the signing key becomes compromised, the app can't auto-update to a newer version containing malicious code. Combining this with something like Certificate/Binary Transparency would allow browsers to check that they are not being uniquely targeted with a specially altered version, and you could set a policy saying "Only auto-update to a newer version of this web app if its hash has been published in a log for more than a month (and/or endorsed by signatures from N out of M other organisations I trust)".
rob-olmos 8y ago
Semi-related, I think Web Packages and Signed Exchanges could have some usefulness outside of Google's caches. One of their spec examples was for verifiable web page archives. Another idea it could be used for a wifi "drop box" (drop station?) when there's no internet connection around. That isn't uncommon at some popular spots up river into the woods in the US. The idea is that as people enter the area, they can update the drop station automatically for things like news or public posts with whatever they've cached recently. I'm pretty sure I read about this idea before the spec was drafted but I couldn't find or remember the site, something like vehicle-transported data.
- gregable 8y ago
  You may be thinking of this use cases section here: https://wicg.github.io/webpackage/draft-yasskin-webpackage-use-cases.html https://wicg.github.io/webpackage/draft-yasskin-webpackage-u...
  - rob-olmos 8y ago
    Thanks. IIRC the site I saw was from a few years ago, before the spec was drafted. (I updated my post to be more clear). Pretty sure there was a few photographs on the page out in the flat grasslands.
- gregable 8y ago
  In general, this sounds like an interesting use case. One thing to note is that the specification currently limits the lifetime of a signed exchange to 7 days. It's possible that by exploring some of these use cases, especially offline, the spec could be improved with respect to some of these constraints.
- pornel 8y ago
  Unfortunately, signed packages won't work for archival or any significant offline use. The signed exchanges are forced to be short lived (in days) to limit the damage that can be done when someone steals a TLS private key. It's a very narrow spec designed just for AMP, basically.
nessup 8y ago
Does nothing for publishers' needs for deeper control and analytics. Just a "feel good" gesture that results in additional complexity for everyone involved. Google is not the only company in the world that knows how to load a page efficiently.
- gregable 8y ago
  The publisher's cookie-based analytics will operate on the origin in the URL bar in this case. The document (though not the delivery server) will have access to publisher origin cookies. Conceptually, you can think of a signed exchange as a 301 redirect to a new URL which has already been cached by the browser (so there is no 2nd network event). The cache was populated by the contents of the signed exchange, assuming the signature validates.
- zavi 8y ago
  AMP URLs are ugly, so cleaning them up is good for users.
Sephr 8y ago
With the peerweb.com platform I will be providing a free-for-non-commercial-use polyfill for Signed HTTP Exchanges which can be used for distributed p2p content offloading. Peerweb helps sites automatically offload all resources (including streaming ugc video) to a decentralized p2p network. ETA: ~1yr
millstone 8y ago
The headline is an outright lie: these AMP pages are loaded from Google and not your domain. The new feature is that Google's browser displays your domain, obscuring the fact that Google is doing the serving. The change is what is displayed, not the server.
- mthoms 8y ago
  Indeed. If a web page is being served or loaded "from your own domain" that implies something very specific. What Google actually means here is "We make AMP pages _appear_ to come from your own domain". That's something entirely different. This whole thing is just more doublespeak.
  - sametmax 8y ago
    It's even worse than that. When I had a website with embed videos from other sites, I had user contacting me because the other sites had some problems. They couldn't tell the difference between megavideo/youtube/dailymotion content and my site, so they came to me and blamed me. So what this means is that not only Google bullies you into putting your traffic under their control, but now, any problem on their part will be blamed on you by the user.
    - AlexandrB 8y ago
      > So what this means is that not only Google bullies you into putting your traffic under their control, but now, any problem on their part will be blamed on you by the user. I hadn't even considered that. Add to this Google's notoriously absent customer support department and you have a recipe for a lot of frustration.
  - deleted 8y ago
    [deleted]
- josteink 8y ago
  WTF. Lost for words. So Google’s browser now directly lie to the user about what’s being loaded? I bet the SSL mark is still there though? How can anyone trust this Googlan horse? This is why you don’t make a browser and control major web-assets at the same time. These lines should not be muddied.
kuschku 8y ago
So, when will Google roll out signed exchanges for plain HTML content? That's much more interesting, and if combined with e.g. a restriction such as a Lighthouse speed score of > 60, it'd be in all measurable ways better than AMP. Faster than AMP, more open than AMP, and all the benefits of AMP.
strictnein 8y ago
Remember the talk about how the Chrome team was going to "rethink" the navbar, and what domain and site identity really mean? And people were a little worried about this? Turns out people were right to be suspicious. This is hot garbage. You can no longer ask a user "What URL does your navbar say you're at?". It is no longer a source of truth. They will actively be lied to.
- notatoad 8y ago
  there was no need to be suspicious. google wasn't being sneaky about it, they have been actively talking about, promoting, and openly developing this feature for at least a year.
- Agebor 8y ago
  But what does it mean that you are on a particular URL? For a long time already it's not being connecter to a particular physical server. Now it's the next step - to be completely decoupled from the server and just mean content instead.
  - propogandist 8y ago
    This is meant to offload tracking from just Google Analytics and SERP clicks, which is used to track user behavior (but can be blocked) into services that cannot be blocked beyond Google domains. If Google hosts the website and is masking the resulting url, they're able to have more visibility than Google analytics. They'll likely give this AMP some SEO boost temporarily and that will get web admins to adopt the technology. It's just like reCaptcha, which is used to track users across the web (requires google.com + gstatic.com urls to load, which drops its own cookies or scans existing ones), blocking recaptcha will break core web functionality... and recaptcha v3 is even worse.
  - 48309248302 8y ago
    Web publishers don't necessarily want their content decoupled from their own servers, but they don't have a choice now if they depend on traffic from Google.
  - 8y ago
jedberg 8y ago
This feels like it solves the biggest user complaint with AMP, which was the ugly URLs and having to click an extra time to get the "real URL" for sharing. It also at least helps slightly address one of the complaints of publishers, which is that cookies and some analytics will work now. But it still doesn't address the biggest complaints of publishers. I'm guessing Google cares a lot more about the user experience than the publisher experience, since users make up most of the traffic and all of the ad consumption, so this is certainly good for them!
dreamcompiler 8y ago
Probably time for a congressional and/or DOJ inquiry into whether AMP is an example of Google abusing its monopoly power in the search engine space.
deleted 8y ago
[deleted]
andy_ppp 8y ago
Who is going to be in charge of the signing process? Can I sign the content myself? Will Google eventually only sign content it deems appropriate? Can we trust Google to always do the right thing?
- gregable 8y ago
  Good question. The signing is done by the publisher, using the same digital signature infrastructure that is used for TLS (https). So, the publisher alone has the signing key, and any browser can verify the signature by comparing to the public certificate, signed by a certificate authority.
devoply 8y ago
Ah okay so Google is the new Facebook walled garden.
- 908087 8y ago
  Google is trying to turn the entire internet into their own walled garden.
zaarn 8y ago
I found the Cloudflare announcement to be more useful: https://blog.cloudflare.com/announcing-amp-real-url/ https://blog.cloudflare.com/announcing-amp-real-url/ I'm not entirely a fan of this, though it could have uses in other places; Debian for example, could use this to enable HTTPS-like security without requiring mirrors to upgrade their security to the late 2000's.
thx-i-hate-it 8y ago
Thanks, I hate it.
noncoml 8y ago
Alternative title: why you shouldn’t be using Chrome. Split Alphabet already.
- lovehashbrowns 8y ago
  Yep, I'm off to the Firefox world. I hate amp with a passion. Straight garbage.
jonplackett 8y ago
I hate AMP. Not just for google thinking they own the internet. They never seem to load right on my phone and crash a lot too.
stupidthrottle 8y ago
For people who don’t like AMP, avoiding it is really easy: Don’t use Google search. That’s all. That’s really all there is to it. You should give it a try!
- dbbk 8y ago
  Or Bing... or Twitter...
- OrgNet 8y ago
  I've also seen HN users share AMP links ... One example: https://news.ycombinator.com/item?id=19679136 https://news.ycombinator.com/item?id=19679136 , luckily someone also provided the non-amp equivalent...
coldtea 8y ago
This calls for several billions EU fine...
Illniyar 8y ago
We need to decouple two things that are mashed together in this post: Web packaging and Signed exchanges seems benign and beneficial, you can sign a particular page inside a package (let's say a zipped folder of some kind) and now anyone can cache that data and show it, while both the browser and the user knows that it's safe to display it. Since the AMP format is similar, it seems quite beneficial to now have all your AMP content support this feature. And anyone who made some of their pages AMP can use that same process to support other Signed Exchanges (such as p2p networks or CDNs) . This is great since it makes distributed caching much easier. The bad part is that google search uses this signed exchange format not to show the actual URL but rather put it in an iframe inside chrome (and only chrome). The real question is whether we will be able to use this functionality outside search, if I have my own site and show a large iframe with signed exchange page, will I also be able to change the browser url bar? mmph, probably not.
- gregable 8y ago
  There is a little confusion here, understandable. Google search will not show these signed exchanges in an iframe, the pages are full frame. Try it for yourself. Using Chrome 73 or later (you probably already have this), and a mobile browser (either a phone or mobile emulation), try the query [amp dev success stories]. It will only use signed exchanges in Chrome because currently only Chrome supports signed exchanges. The search engine explicitly looks for the browser to state that it supports signed exchanges in an Accept header, like any other new technology. Yes, any page can use this. So, for example if you went and fetched a signed exchange from https://amppackageexample.com/ https://amppackageexample.com/ (or any other site that supports one, this is just an example), you could then serve that from your own server, more or less just like any other file (the less is that you need to set the right Content-Type header, but it otherwise works just like serving an image or a zip file). Then, if a user visited the URL on your site https://yoursite.com/cached-copy-of-amppackageexample.com/ https://yoursite.com/cached-copy-of-amppackageexample.com/ then the browser would display https://amppackageexample.com/ https://amppackageexample.com/ in the URL bar, as though that URL had 301 redirected, but without the extra network fetch. Google search does exactly this, just loading a cached copy of the Signed Exchange, and any other cache (or even any website) can do the same.
dbbk 8y ago
So now there's literally no way to 'break out' of the AMP version and get the real webpage. Great.
Illniyar 8y ago
Here's the real question - how is this implemented in chrome? are signed exchange website that are clicked in google search page and whose url is switched is still running the google search page's code? If this is so, and it only works for google search's page and not some generic web strategy, this is a massive breach of browser/web-content separation, bigger then even the auto-sign-in to google from chrome.
- gregable 8y ago
  Good question. Conceptually, you can think of a signed exchange as a 301 redirect to a new URL which has already been cached by the browser (so there is no 2nd network event). The cache was populated by the contents of the signed exchange, assuming the signature validates. There is no "reaching into the document" from the previous click or anything weird like that.
  - Vinnl 8y ago
    I just wanted to say a quick thank you for going out of your way to answer to many questions here. Despite the obviously hostile environment (I have some reservations about AMP myself), your answers have been very clear, informative and level-headed, so thanks for that.
    - gregable 8y ago
      I appreciate the comment. My goal here is simply to correct some of the misunderstandings about the format, rather than express opinions.
tannhaeuser 8y ago
Wtf? I guess it's time to blacklist Google and their web of worthlessness. I mean, using Google Search is literally "give me advertisement in disguise" these days, and I don't understand what people expect from using it. An effective remedy also seems to block all script; serves as a useful filter for actual content rather than ad-infested clickbait, and the script-ladden pages you can't view aren't worth your time and bandwidth anyway.
jsnell 8y ago
This is such a strange reaction from HN. The AMP cache URLs have been a top 3 complaint about AMP here. "I can't copy-paste URLs, it's hard for users to understand which site they are on, it looks like the content is provided by Google rather than the real provider", etc. Now there's a solution that preserves the preloading and validation benefits of AMP caches but maintains the original URLs, in a way that's cryptographically sound, in the process of being standardized, and controlled by the publisher. This gets launched much faster than one would have expected. And suddenly everyone pretends that the AMP cache URLs were never a problem and this is some kind of a power-grab.
- andy_ppp 8y ago
  Fair enough but there is now zero need to load them from the AMP cache at all - this security model could allow News Carousel to load them from the originating site and still have access to the pre-rendering instant load magic/lies that AMP provides. It feels a little dodgy to me this standard and a bit embrace extend but I'll see how it plays out and reserve judgement until we see this happening in the wild and how well it works. Personally I'd like to be informed in the browser chrome that it was being served via this mechanism rather than me visiting the original site. Can you maybe see that people feel the browser is now lying to them about where the content is coming from?
  - jsnell 8y ago
    If you're loading the content from the originating site, surely there's no benefit at all to signing. If you're loading the content directly from the site, the browser just needs TLS to verify the integrity of the content. And you're also back to the situation where you can't preload the content in a controlled manner or privacy-preserving manner, nor have the page-speed guarantees since the version being served to the user is not the version that Google crawled. It's kind of the opposite. The cache is where the actual benefits come from. That's not the part you want to get rid of. The AMP spec was just a vehicle for making the caching possible in a secure manner. This model would theoretically allow the validation, caching and prefetching to be done for all (signed, so opt-in by the publisher) HTML pages. Which is another one of the historical top complaints about AMP: why can't light, fast-loading, mobile-friendly HTML get the same treatment in search results. > Can you maybe see that people feel the browser is now lying to them about where the content is coming from? I can see that they are feeling like that, I just don't understand how they arrived there. How is this different from a e.g. company X's website being behind Cloudflare? The browser didn't contact the actual server that company X hosted the content on. Instead the browser contacted a server run by Cloudflare that could prove cryptographically (via TLS) that it was authorized to serve content on behalf of the actual site.
deleted 8y ago
[deleted]
Illniyar 8y ago
After reading all of the comments here, this seems like a good thing. This fixes the main UI issues with how AMP is currently used in google search - mainly the url not properly showing where the content is. If secure exchange is treated the same as AMP pages in google search, I.E. SXG content will be preloaded whether or not it's AMP, it would get rid of the second complaint of AMP - that google's preloading of the content is an unfair playing ground and that the only reason it's fast is because it's preloaded. If SXG is treated the same as AMP in the carousal then that would fix the last and most serious complaint about AMP. As far as I can tell, google do seem to be moving in that route, so this should be applauded not derided (the original fiasco that is AMP non-withstanding)
cannedslime 8y ago
There is just something about AMP that reeks of soylent drinking hipsters. Everything from thinking requireing devs to use some abitrary CDN and tons of obfuscated scripts for the most mundane things (like forms?) to the emoji in the <html> tag... Eh no thanks. I get that exchangeable signed website packages might be a good idea for various purposes. But no thanks I don't measure my life in seconds.
rum3 8y ago
So now you can spoof a domain as long as you have the private part of the certificate even though you don't have control over the domain? If I understand this right then this seems to open up some doors for some new email phishing scams.
- gregable 8y ago
  This is true with TLS as well, though it also requires man-in-the-middling (MITM) the connection. MITM is usually rather easy compared to stealing a private key.
  - rum3 8y ago
    Yes but it is much harder to MITM if the users are in different parts of the world. Someone can buy a lookalike domain name using similar-looking UTF characters, send out a bunch of email spam with an URI that looks like the original, and once the user visits the webpage it instantly loads the AMP and suddently the URL is authentic. There will only be a very quick url change from the punycode url to the original that I doubt many will notice.
bbcfake 8y ago
Amp sandbox limited functionality who would not want this ? Let's push Google forward and make them big. They are not evil after all.
zulgan 8y ago
what is happening?!!
- andrerm 8y ago
  We lost Google but it's hard to let go
Yuval_Halevi 8y ago
one of the biggest issues i had with AMP is the URL (Which cause some of the users in our site a confusion) Implementing AMP while keeping my website URL is great. Glad to hear that Cloudflare is already supporting this. Will implement it now in my sites.
Tepix 8y ago
Using the signed exchange mechanism means you allow anyone to serve your content. You will no longer know when it has been served and by whom. Instead, Google will know more about what your users are consuming on your website than you - despite HTTPS! Also, there is no mechanism to limit who is allowed to serve your content for you. I see no technical reason why the content has to be prefetched from Google instead of your own server. It's also confusing for users and administrators. Want to block access to a website in your network? Guess what: Your block will not be effective because Google will proxy the data unbeknownst to the firewall.
- jimktrains2 8y ago
  Amp does allow Google analytics and other analytics services. Unfortunately, most places don't use server logs for much :(
  - Tepix 8y ago
    Chances are if you don't want Google to serve your content to protect the privacy of your users, you don't want to use Google Analytics either. Btw your account seems rather active for an account with the description "Inactive. Deletion Requested." :-)
    - atoav 8y ago
      Or if you want that stuff to work e.g. in China.
  - tracker1 8y ago
    A bit more on this... there are a LOT of secondary bots out there, either searching for security holes to exploit or otherwise slurping content for reasons other than search. JS based analytics (google or otherwise) is generally a better option for detecting actual usage. Yeah, you lose maybe 2% of actual users. You also lose 99% of the various bots. You still have to filter google's and bing's bots that execute JS though.
- hknd 8y ago
bluetidepro 8y ago
I would _pay_ google to be able to disable AMP permanently on mobile web results. The experience is the absolute worst. I'm fine with them wanting to ruin mobile web (that's their choice), but PLEASE let the users be able to disable this terrible "feature."
- mad182 8y ago
  This, x1000. I just can't believe there is no setting to turn it off.
IgorPartola 8y ago
I can’t believe there is no way to opt out of AMP as the end user. The UX is so terrible. Often times I will search for something and have a Reddit result come back. When I tap the link, I get the AMP page which: * does not show all comments, often ones I am actually looking for * does not let me collapse comment sections * uses the default white background theme which burns my retinas if I am looking at my phone in a dark environment * shows overlay ads for the Reddit app that cover about 40% of the screen for no goddamn reason * requires 2-3 separate actions to get to the original page Yet I cannot find a browser extension or setting to tell AMP to fuck off. Honestly AMP might be what finally gets me to switch search engines after many years of using Google.
- frostbyte3 7y ago
  It's not really google's fault Reddit's amp sucks. AMP sucks, IK, I'm working on my company's AMP pages right now and they are a PAIN. But with enough tweaking, they can be gotten right. So I wouldn't blame Google for Reddit's devs.
- smilliken 8y ago
  You won't see AMP if you switch search engines.
  - jdgoesmarching 8y ago
    Just this morning I got pissed off by an AMP page and was considering a search engine switch. Maybe this is my sign.
    - maxwell 8y ago
      AMP was what made me abandon Google Search in January 2018 for DuckDuckGo. Surprising how little I've noticed the change, after using Google Search for over 15 years. I try queries on google.com maybe once or twice a week if I don't find what I'm looking for on DDG. If it's anything media or product related, I feel like I'm on an old, crowded MySpace page. DDG feels more like the old Google.
sascha_sl 8y ago
I want Google to die already. It's so obvious why AMP is on the main google.com domain. They're collecting your shit. They're doing the same thing with ReCaptcha, also on the main google.com domain. Break this shitty company apart.
deevolution 8y ago
AMP pages take forever to load, I hate seeing a white screen > 1 second. with amp that's all I see on mobile. A white screen burning my eyeballs, seemingly forever. And then I snap out of it and hit back to escape from AMPs empty void.
- jefftk 8y ago
  It sounds like you're probably running something that blocks 3rd-party JS and also doesn't execute <noscript> blocks. See: https://news.ycombinator.com/item?id=19680033 https://news.ycombinator.com/item?id=19680033
- deleted 8y ago
  [deleted]
- Cthulhu_ 8y ago
  I read in probably another HN thread that using an adblocker will actually slow down an AMP page - there's a hardcoded 3 second CSS delay which is cancelled if (via JS) it's detected the page is loaded.
codedokode 8y ago
It's ridiculous. Google wants to keep users at its domain so much that it invents a whole technology to substitute address bar contents. This shows how harmful it is when a company has a significant market share in several different areas (browsers and search engines). I hope at least Mozilla doesn't adopt this technology and will show the true URL. This technology is complicated. Browser vendors have to implement all of this only to please Google.
- Ajedi32 8y ago
  This is the exact opposite of "keeping users at its domain". That was the situation _before_ they implemented this standard. Now users will get sent to the publisher's domain instead (via a prefetched page load).
  - proaralyst 8y ago
    But it's served from Google, so they still control all the analytics
    - Ajedi32 8y ago
      No they don't. The page contents are controlled by the publisher and cryptographically signed so Google can't alter it. Another improvement over the previous situation.
      - josteink 8y ago
        Since it’s not fetched from the publisher they will have to use Google analytics or have nothing. Guess what they’re going to choose.
        Ajedi32 8y ago
        Google Analytics isn't the only analytics solution out there. Publishers can use literally _any_ method of gathering analytics that's not server logs.
NelsonMinar 8y ago
If you're going to break the way the web works, you might as well break it hard. At least that seems to be Google's philosophy with this unasked-for inserting itself between people and publishers.
deleted 8y ago
[deleted]
j0057 8y ago
Seems dangerous for the web to mess with the URL bar, I get why Google wants to do this.

200 points by dfabulich 8y ago

Does AMP run on Firefox? I've been using Firefox since the Quantum launch and haven't seen any AMP lately. I had completely forgotten this nightmare once existed.

throwaway66666 8y ago

I 've stopped using google because of AMP. Only google can sabotage google at this point, and I think this is how it will happen if they keep going this way.

craftinator 8y ago

Can any Google engineers comment on the the large amount of negativity towards AMP found in these HN comments (and pretty much every other HN forum discussing AMP)? I can't imagine working on a project and seeing so many people (especially given the average education level on HN) who can't stand it. I want to hear from you guys about this!

OnlyRepliesToBS 8y ago

anti-competitive class action lawsuit against google is required now

iandanforth 8y ago

I feel like Google is pushing AMP and components too hard. I've started to balk at the idea of using them even for explorations.

ganeshkrishnan 8y ago
AMP is like Brussels Sprouts. If it's forced on you when you are young, you will grow up hating it.
- 48309248302 8y ago
  Brussels sprouts are good for you. AMP is more like medical experiments performed on you during an alien abduction.
  - ehnto 8y ago
    It's solely the search engine boost you get from AMP that bothers me. Because of the money involved many sites have no choice but to implement AMP and stay competitive. If it weren't for that, it would just be another technology and the fact that it only works in few circumstances would probably make many sites not bother with it. The UX downsides would probably see many sites actively avoid it. The fact that it has seen such adoption is testament to Google's ability to influence with it's rankings alone.
    - luckylion 8y ago
      Have you noticed ranking improvements? We've done AMP on some sites and not others and we saw no difference in ranking. Sure, having a very quickly opened page is nice, but on the other hand, features are limited. That might or might not work well, depending on what kind of content you have, what engagement you're looking for.
  - Kiro 8y ago
    What's up with this extreme hatred for AMP? I personally love AMP.
    - Moru 8y ago
      Most people do not like to be forced to do things a certain way. Especially if they have a working site already and now have to remake it from the ground up just because some other actor decided it isn't good enough to get visitors. Just you wait until you notice you can't go to town in your car any more. Only teslas are allowed into city.
      - Kiro 8y ago

skilled 8y ago

I wonder if Google is self-aware to the fact that majority of webmasters don't give a shit about AMP.

RHSeeger 8y ago
The other half actively despise it.
- ganeshkrishnan 8y ago
  "Your website has been banned for illegal activity and all content has been deleted. The suspension is immediate and indefinite. Please consider using another Internet" Also, their algorithms mistook live streaming of Notre Dame fires as 9/11 incident. How can live stream be a past incident? https://abcnews.go.com/Business/youtube-mistakenly-flags-notre-dame-fire-videos-911/story?id=62419884 https://abcnews.go.com/Business/youtube-mistakenly-flags-not...
  - Lammy 8y ago
    You are confusing the term “live stream” to mean something actually happening at that moment in the real world. All a “live” stream actually is to Youtube or FB or any other streaming service is just incoming RTMP packets. Youtube matches incoming streams against their ContentID database just as they do for normal uploads. I would bet that the same thing would have happened if the same footage were uploaded normally after the fact. People will use unlisted streams to broadcast pirated content otherwise. I faced a similarly false claim once where me playing Super Mario World on a real life SNES was falsely matched to some major label song, and since it was my third strike (all false) my account got banned from being able to use Youtube Live entirely. In the end I’m kind of glad that happened because it led to me developing my own minimal self-hosted stream site for small friends-only streams, including things Youtube would give legit claims for. My tiny VPS wouldn’t stand up to thousands or probably even dozens of simultaneous viewers like Youtube or the other big names can, but that doesn’t matter at all for me.
    - 8y ago

chrisfinazzo 8y ago

I'll just say this: Cache-Control: no-transform

cramforce 8y ago
Signed Exchanges are basically that but with cryptographic guarantee of no transform by caches. See https://github.com/WICG/webpackage/blob/master/explainer.md https://github.com/WICG/webpackage/blob/master/explainer.md [Working on AMP at Google]

albertgoeswoof 8y ago

Let’s hope AMP, like most google products, is shut down within the next 2-3 years

ganeshkrishnan 8y ago
Amen!
sieabahlpark 8y ago
Nah I see AMP staying around long enough to capture a significant portion of web share that they mine data from. Essentially is just a way to insert themselves as "the internet"
zavi 8y ago
Users love it so unlikely.
dreamcompiler 8y ago
Google products that suck the most tend to last a long time. See Google+.
Kiro 8y ago
Why is that? I think AMP is great.
mrweasel 8y ago
What's wrong with it exactly... beside being weird. I'm not a fan of manipulating the URL the way they do with this change, but couldn't you just opt to not use AMP if you don't like it? Ideally people would develop fast sites on their own, but apparently they need the help of Google.
- nerdjon 8y ago
  The issue is that you can't, or you risk your site being basically blacklisted from google. Especially if your a news site. Users have no control outside of not using google. If google were to provide a setting for the user to never see AMP, I would have less issue with this. But they don't Instead, they basically force publishers to use this because if they don't the news carousel will not show their article. It just gives Google more control over the web for minimal at best benefits

48309248302 8y ago

This sounds terrible. Does it mean that browsers will begin lying to users and say that the users are visiting the website's server when they are really visiting a restricted version of the website that is hosted in Google's cache? I don't want my content restricted or hosted in Google's cache. AMP doesn't load in a privacy sensitive way. It's on Google's servers and it takes many seconds to load if you have JavaScript disabled. Also, the feature only works on Google Chrome and possibly Edge, which gives another point to the article below. https://www.zdnet.com/article/former-mozilla-exec-google-has-sabotaged-firefox-for-years/ https://www.zdnet.com/article/former-mozilla-exec-google-has... AMP is a fundamentally bad idea that needs to disappear. Edit: Mozilla has marked Signed HTTP Exchanges as harmful. https://mozilla.github.io/standards-positions/ https://mozilla.github.io/standards-positions/

chii 8y ago
> I don't want my content restricted or hosted in Google's cache. how is this different than using your own domain, but pointing it to a github.io page? Or using medium, but with your own domain (but still being served from medium's servers)? Is it just google you're adverse to, or the entire idea of someone else hosting your content?
- 48309248302 8y ago
  1) I want full control over my servers and to not be penalized in search engines for not hosting my sites on Google. Where are the server-side logs? 2) I want full control over how I publish my sites with real web standards. AMP is not a web standard, it's a Google format that they are strong-arming people into using. 3) Mozilla considers Signed HTTP Exchanges harmful. This technology is as bad as what Microsoft was doing with IE in the old days. 4) I don't publish on Github pages, but if I did, I would still have a choice over which servers I put the sites on. 5) There shouldn't be a single company (or few companies) that dictates how we publish online. 6) Shame on the people who are splitting the web with this fake-opensource technology. There's even a Google engineer over here referring to the Web like it's a Google product. https://news.ycombinator.com/item?id=19631136 https://news.ycombinator.com/item?id=19631136

zjs 8y ago

I found Cloudflare's post on this topic to be more useful: https://news.ycombinator.com/item?id=19678693 https://news.ycombinator.com/item?id=19678693

0x54D5 8y ago

If you use AMP I will be blocking your domain from all my computers. End of story.

p1mrx 8y ago

Seems like a reasonable idea. The content server says "here, you hold this for me", and the address bar only shows who originally signed it. One could imagine replacing the serving layer with something like BitTorrent or IPFS.

AgentME 8y ago
Yeah, I think this feature and the signed exchanges standard both sound great. It allows CDN-like servers to host content without having to be trusted to not modify the content. That sounds like an improvement over the current CDN situation. Also, sites that link to other sites can preload the linked site's content into the user's browser, without leaking the user's IP to the linked site, so if the user doesn't follow the link, nothing about the user is revealed to the linked site. That sounds like a performance and privacy improvement wrapped up into one. I'm finding the rest of this discussion thread extremely disappointing as it seems like most of the posts here are just "amp=bad and amp people like this so it's also bad".
- dane-pgp 8y ago
  Signed Exchanges could also remove some of the concerns around JavaScript crypto, because there is a (potentially offline) key that signs the web app you're running, so you're not vulnerable to hacks of the hosting environment itself. What's really needed is a way for the browser to lock a given web app/package to a specific version (and hash), so that even if the signing key becomes compromised, the app can't auto-update to a newer version containing malicious code. Combining this with something like Certificate/Binary Transparency would allow browsers to check that they are not being uniquely targeted with a specially altered version, and you could set a policy saying "Only auto-update to a newer version of this web app if its hash has been published in a log for more than a month (and/or endorsed by signatures from N out of M other organisations I trust)".

rob-olmos 8y ago

Semi-related, I think Web Packages and Signed Exchanges could have some usefulness outside of Google's caches. One of their spec examples was for verifiable web page archives. Another idea it could be used for a wifi "drop box" (drop station?) when there's no internet connection around. That isn't uncommon at some popular spots up river into the woods in the US. The idea is that as people enter the area, they can update the drop station automatically for things like news or public posts with whatever they've cached recently. I'm pretty sure I read about this idea before the spec was drafted but I couldn't find or remember the site, something like vehicle-transported data.

gregable 8y ago
You may be thinking of this use cases section here: https://wicg.github.io/webpackage/draft-yasskin-webpackage-use-cases.html https://wicg.github.io/webpackage/draft-yasskin-webpackage-u...
- rob-olmos 8y ago
  Thanks. IIRC the site I saw was from a few years ago, before the spec was drafted. (I updated my post to be more clear). Pretty sure there was a few photographs on the page out in the flat grasslands.
gregable 8y ago
In general, this sounds like an interesting use case. One thing to note is that the specification currently limits the lifetime of a signed exchange to 7 days. It's possible that by exploring some of these use cases, especially offline, the spec could be improved with respect to some of these constraints.
pornel 8y ago
Unfortunately, signed packages won't work for archival or any significant offline use. The signed exchanges are forced to be short lived (in days) to limit the damage that can be done when someone steals a TLS private key. It's a very narrow spec designed just for AMP, basically.

nessup 8y ago

Does nothing for publishers' needs for deeper control and analytics. Just a "feel good" gesture that results in additional complexity for everyone involved. Google is not the only company in the world that knows how to load a page efficiently.

gregable 8y ago
The publisher's cookie-based analytics will operate on the origin in the URL bar in this case. The document (though not the delivery server) will have access to publisher origin cookies. Conceptually, you can think of a signed exchange as a 301 redirect to a new URL which has already been cached by the browser (so there is no 2nd network event). The cache was populated by the contents of the signed exchange, assuming the signature validates.
zavi 8y ago
AMP URLs are ugly, so cleaning them up is good for users.

Sephr 8y ago

With the peerweb.com platform I will be providing a free-for-non-commercial-use polyfill for Signed HTTP Exchanges which can be used for distributed p2p content offloading. Peerweb helps sites automatically offload all resources (including streaming ugc video) to a decentralized p2p network. ETA: ~1yr

millstone 8y ago

The headline is an outright lie: these AMP pages are loaded from Google and not your domain. The new feature is that Google's browser displays your domain, obscuring the fact that Google is doing the serving. The change is what is displayed, not the server.

mthoms 8y ago
Indeed. If a web page is being served or loaded "from your own domain" that implies something very specific. What Google actually means here is "We make AMP pages _appear_ to come from your own domain". That's something entirely different. This whole thing is just more doublespeak.
- sametmax 8y ago
  It's even worse than that. When I had a website with embed videos from other sites, I had user contacting me because the other sites had some problems. They couldn't tell the difference between megavideo/youtube/dailymotion content and my site, so they came to me and blamed me. So what this means is that not only Google bullies you into putting your traffic under their control, but now, any problem on their part will be blamed on you by the user.
  - AlexandrB 8y ago
    > So what this means is that not only Google bullies you into putting your traffic under their control, but now, any problem on their part will be blamed on you by the user. I hadn't even considered that. Add to this Google's notoriously absent customer support department and you have a recipe for a lot of frustration.
- deleted 8y ago
  [deleted]
josteink 8y ago
WTF. Lost for words. So Google’s browser now directly lie to the user about what’s being loaded? I bet the SSL mark is still there though? How can anyone trust this Googlan horse? This is why you don’t make a browser and control major web-assets at the same time. These lines should not be muddied.

kuschku 8y ago

So, when will Google roll out signed exchanges for plain HTML content? That's much more interesting, and if combined with e.g. a restriction such as a Lighthouse speed score of > 60, it'd be in all measurable ways better than AMP. Faster than AMP, more open than AMP, and all the benefits of AMP.

strictnein 8y ago

Remember the talk about how the Chrome team was going to "rethink" the navbar, and what domain and site identity really mean? And people were a little worried about this? Turns out people were right to be suspicious. This is hot garbage. You can no longer ask a user "What URL does your navbar say you're at?". It is no longer a source of truth. They will actively be lied to.

notatoad 8y ago
there was no need to be suspicious. google wasn't being sneaky about it, they have been actively talking about, promoting, and openly developing this feature for at least a year.
Agebor 8y ago
But what does it mean that you are on a particular URL? For a long time already it's not being connecter to a particular physical server. Now it's the next step - to be completely decoupled from the server and just mean content instead.
- propogandist 8y ago
  This is meant to offload tracking from just Google Analytics and SERP clicks, which is used to track user behavior (but can be blocked) into services that cannot be blocked beyond Google domains. If Google hosts the website and is masking the resulting url, they're able to have more visibility than Google analytics. They'll likely give this AMP some SEO boost temporarily and that will get web admins to adopt the technology. It's just like reCaptcha, which is used to track users across the web (requires google.com + gstatic.com urls to load, which drops its own cookies or scans existing ones), blocking recaptcha will break core web functionality... and recaptcha v3 is even worse.
- 48309248302 8y ago
  Web publishers don't necessarily want their content decoupled from their own servers, but they don't have a choice now if they depend on traffic from Google.
- 8y ago

jedberg 8y ago

This feels like it solves the biggest user complaint with AMP, which was the ugly URLs and having to click an extra time to get the "real URL" for sharing. It also at least helps slightly address one of the complaints of publishers, which is that cookies and some analytics will work now. But it still doesn't address the biggest complaints of publishers. I'm guessing Google cares a lot more about the user experience than the publisher experience, since users make up most of the traffic and all of the ad consumption, so this is certainly good for them!

dreamcompiler 8y ago

Probably time for a congressional and/or DOJ inquiry into whether AMP is an example of Google abusing its monopoly power in the search engine space.

deleted 8y ago

[deleted]

andy_ppp 8y ago

Who is going to be in charge of the signing process? Can I sign the content myself? Will Google eventually only sign content it deems appropriate? Can we trust Google to always do the right thing?

gregable 8y ago
Good question. The signing is done by the publisher, using the same digital signature infrastructure that is used for TLS (https). So, the publisher alone has the signing key, and any browser can verify the signature by comparing to the public certificate, signed by a certificate authority.

devoply 8y ago

Ah okay so Google is the new Facebook walled garden.

908087 8y ago
Google is trying to turn the entire internet into their own walled garden.

zaarn 8y ago

I found the Cloudflare announcement to be more useful: https://blog.cloudflare.com/announcing-amp-real-url/ https://blog.cloudflare.com/announcing-amp-real-url/ I'm not entirely a fan of this, though it could have uses in other places; Debian for example, could use this to enable HTTPS-like security without requiring mirrors to upgrade their security to the late 2000's.

thx-i-hate-it 8y ago

Thanks, I hate it.

noncoml 8y ago

Alternative title: why you shouldn’t be using Chrome. Split Alphabet already.

lovehashbrowns 8y ago
Yep, I'm off to the Firefox world. I hate amp with a passion. Straight garbage.

jonplackett 8y ago

I hate AMP. Not just for google thinking they own the internet. They never seem to load right on my phone and crash a lot too.

stupidthrottle 8y ago

For people who don’t like AMP, avoiding it is really easy: Don’t use Google search. That’s all. That’s really all there is to it. You should give it a try!

dbbk 8y ago
Or Bing... or Twitter...
OrgNet 8y ago
I've also seen HN users share AMP links ... One example: https://news.ycombinator.com/item?id=19679136 https://news.ycombinator.com/item?id=19679136 , luckily someone also provided the non-amp equivalent...

coldtea 8y ago

This calls for several billions EU fine...

Illniyar 8y ago

We need to decouple two things that are mashed together in this post: Web packaging and Signed exchanges seems benign and beneficial, you can sign a particular page inside a package (let's say a zipped folder of some kind) and now anyone can cache that data and show it, while both the browser and the user knows that it's safe to display it. Since the AMP format is similar, it seems quite beneficial to now have all your AMP content support this feature. And anyone who made some of their pages AMP can use that same process to support other Signed Exchanges (such as p2p networks or CDNs) . This is great since it makes distributed caching much easier. The bad part is that google search uses this signed exchange format not to show the actual URL but rather put it in an iframe inside chrome (and only chrome). The real question is whether we will be able to use this functionality outside search, if I have my own site and show a large iframe with signed exchange page, will I also be able to change the browser url bar? mmph, probably not.

gregable 8y ago
There is a little confusion here, understandable. Google search will not show these signed exchanges in an iframe, the pages are full frame. Try it for yourself. Using Chrome 73 or later (you probably already have this), and a mobile browser (either a phone or mobile emulation), try the query [amp dev success stories]. It will only use signed exchanges in Chrome because currently only Chrome supports signed exchanges. The search engine explicitly looks for the browser to state that it supports signed exchanges in an Accept header, like any other new technology. Yes, any page can use this. So, for example if you went and fetched a signed exchange from https://amppackageexample.com/ https://amppackageexample.com/ (or any other site that supports one, this is just an example), you could then serve that from your own server, more or less just like any other file (the less is that you need to set the right Content-Type header, but it otherwise works just like serving an image or a zip file). Then, if a user visited the URL on your site https://yoursite.com/cached-copy-of-amppackageexample.com/ https://yoursite.com/cached-copy-of-amppackageexample.com/ then the browser would display https://amppackageexample.com/ https://amppackageexample.com/ in the URL bar, as though that URL had 301 redirected, but without the extra network fetch. Google search does exactly this, just loading a cached copy of the Signed Exchange, and any other cache (or even any website) can do the same.

dbbk 8y ago

So now there's literally no way to 'break out' of the AMP version and get the real webpage. Great.

Illniyar 8y ago

Here's the real question - how is this implemented in chrome? are signed exchange website that are clicked in google search page and whose url is switched is still running the google search page's code? If this is so, and it only works for google search's page and not some generic web strategy, this is a massive breach of browser/web-content separation, bigger then even the auto-sign-in to google from chrome.

gregable 8y ago
Good question. Conceptually, you can think of a signed exchange as a 301 redirect to a new URL which has already been cached by the browser (so there is no 2nd network event). The cache was populated by the contents of the signed exchange, assuming the signature validates. There is no "reaching into the document" from the previous click or anything weird like that.
- Vinnl 8y ago
  I just wanted to say a quick thank you for going out of your way to answer to many questions here. Despite the obviously hostile environment (I have some reservations about AMP myself), your answers have been very clear, informative and level-headed, so thanks for that.
  - gregable 8y ago
    I appreciate the comment. My goal here is simply to correct some of the misunderstandings about the format, rather than express opinions.

tannhaeuser 8y ago

Wtf? I guess it's time to blacklist Google and their web of worthlessness. I mean, using Google Search is literally "give me advertisement in disguise" these days, and I don't understand what people expect from using it. An effective remedy also seems to block all script; serves as a useful filter for actual content rather than ad-infested clickbait, and the script-ladden pages you can't view aren't worth your time and bandwidth anyway.

jsnell 8y ago

This is such a strange reaction from HN. The AMP cache URLs have been a top 3 complaint about AMP here. "I can't copy-paste URLs, it's hard for users to understand which site they are on, it looks like the content is provided by Google rather than the real provider", etc. Now there's a solution that preserves the preloading and validation benefits of AMP caches but maintains the original URLs, in a way that's cryptographically sound, in the process of being standardized, and controlled by the publisher. This gets launched much faster than one would have expected. And suddenly everyone pretends that the AMP cache URLs were never a problem and this is some kind of a power-grab.

andy_ppp 8y ago
Fair enough but there is now zero need to load them from the AMP cache at all - this security model could allow News Carousel to load them from the originating site and still have access to the pre-rendering instant load magic/lies that AMP provides. It feels a little dodgy to me this standard and a bit embrace extend but I'll see how it plays out and reserve judgement until we see this happening in the wild and how well it works. Personally I'd like to be informed in the browser chrome that it was being served via this mechanism rather than me visiting the original site. Can you maybe see that people feel the browser is now lying to them about where the content is coming from?
- jsnell 8y ago
  If you're loading the content from the originating site, surely there's no benefit at all to signing. If you're loading the content directly from the site, the browser just needs TLS to verify the integrity of the content. And you're also back to the situation where you can't preload the content in a controlled manner or privacy-preserving manner, nor have the page-speed guarantees since the version being served to the user is not the version that Google crawled. It's kind of the opposite. The cache is where the actual benefits come from. That's not the part you want to get rid of. The AMP spec was just a vehicle for making the caching possible in a secure manner. This model would theoretically allow the validation, caching and prefetching to be done for all (signed, so opt-in by the publisher) HTML pages. Which is another one of the historical top complaints about AMP: why can't light, fast-loading, mobile-friendly HTML get the same treatment in search results. > Can you maybe see that people feel the browser is now lying to them about where the content is coming from? I can see that they are feeling like that, I just don't understand how they arrived there. How is this different from a e.g. company X's website being behind Cloudflare? The browser didn't contact the actual server that company X hosted the content on. Instead the browser contacted a server run by Cloudflare that could prove cryptographically (via TLS) that it was authorized to serve content on behalf of the actual site.

deleted 8y ago

[deleted]

Illniyar 8y ago

After reading all of the comments here, this seems like a good thing. This fixes the main UI issues with how AMP is currently used in google search - mainly the url not properly showing where the content is. If secure exchange is treated the same as AMP pages in google search, I.E. SXG content will be preloaded whether or not it's AMP, it would get rid of the second complaint of AMP - that google's preloading of the content is an unfair playing ground and that the only reason it's fast is because it's preloaded. If SXG is treated the same as AMP in the carousal then that would fix the last and most serious complaint about AMP. As far as I can tell, google do seem to be moving in that route, so this should be applauded not derided (the original fiasco that is AMP non-withstanding)

cannedslime 8y ago

There is just something about AMP that reeks of soylent drinking hipsters. Everything from thinking requireing devs to use some abitrary CDN and tons of obfuscated scripts for the most mundane things (like forms?) to the emoji in the <html> tag... Eh no thanks. I get that exchangeable signed website packages might be a good idea for various purposes. But no thanks I don't measure my life in seconds.

rum3 8y ago

So now you can spoof a domain as long as you have the private part of the certificate even though you don't have control over the domain? If I understand this right then this seems to open up some doors for some new email phishing scams.

gregable 8y ago
This is true with TLS as well, though it also requires man-in-the-middling (MITM) the connection. MITM is usually rather easy compared to stealing a private key.
- rum3 8y ago
  Yes but it is much harder to MITM if the users are in different parts of the world. Someone can buy a lookalike domain name using similar-looking UTF characters, send out a bunch of email spam with an URI that looks like the original, and once the user visits the webpage it instantly loads the AMP and suddently the URL is authentic. There will only be a very quick url change from the punycode url to the original that I doubt many will notice.

bbcfake 8y ago

Amp sandbox limited functionality who would not want this ? Let's push Google forward and make them big. They are not evil after all.

zulgan 8y ago

what is happening?!!

andrerm 8y ago
We lost Google but it's hard to let go

Yuval_Halevi 8y ago

one of the biggest issues i had with AMP is the URL (Which cause some of the users in our site a confusion) Implementing AMP while keeping my website URL is great. Glad to hear that Cloudflare is already supporting this. Will implement it now in my sites.

Tepix 8y ago

Using the signed exchange mechanism means you allow anyone to serve your content. You will no longer know when it has been served and by whom. Instead, Google will know more about what your users are consuming on your website than you - despite HTTPS! Also, there is no mechanism to limit who is allowed to serve your content for you. I see no technical reason why the content has to be prefetched from Google instead of your own server. It's also confusing for users and administrators. Want to block access to a website in your network? Guess what: Your block will not be effective because Google will proxy the data unbeknownst to the firewall.

jimktrains2 8y ago
Amp does allow Google analytics and other analytics services. Unfortunately, most places don't use server logs for much :(
- Tepix 8y ago
  Chances are if you don't want Google to serve your content to protect the privacy of your users, you don't want to use Google Analytics either. Btw your account seems rather active for an account with the description "Inactive. Deletion Requested." :-)
  - atoav 8y ago
    Or if you want that stuff to work e.g. in China.
- tracker1 8y ago
  A bit more on this... there are a LOT of secondary bots out there, either searching for security holes to exploit or otherwise slurping content for reasons other than search. JS based analytics (google or otherwise) is generally a better option for detecting actual usage. Yeah, you lose maybe 2% of actual users. You also lose 99% of the various bots. You still have to filter google's and bing's bots that execute JS though.
hknd 8y ago

bluetidepro 8y ago

I would _pay_ google to be able to disable AMP permanently on mobile web results. The experience is the absolute worst. I'm fine with them wanting to ruin mobile web (that's their choice), but PLEASE let the users be able to disable this terrible "feature."

mad182 8y ago
This, x1000. I just can't believe there is no setting to turn it off.

IgorPartola 8y ago

I can’t believe there is no way to opt out of AMP as the end user. The UX is so terrible. Often times I will search for something and have a Reddit result come back. When I tap the link, I get the AMP page which: * does not show all comments, often ones I am actually looking for * does not let me collapse comment sections * uses the default white background theme which burns my retinas if I am looking at my phone in a dark environment * shows overlay ads for the Reddit app that cover about 40% of the screen for no goddamn reason * requires 2-3 separate actions to get to the original page Yet I cannot find a browser extension or setting to tell AMP to fuck off. Honestly AMP might be what finally gets me to switch search engines after many years of using Google.

frostbyte3 7y ago
It's not really google's fault Reddit's amp sucks. AMP sucks, IK, I'm working on my company's AMP pages right now and they are a PAIN. But with enough tweaking, they can be gotten right. So I wouldn't blame Google for Reddit's devs.
smilliken 8y ago
You won't see AMP if you switch search engines.
- jdgoesmarching 8y ago
  Just this morning I got pissed off by an AMP page and was considering a search engine switch. Maybe this is my sign.
  - maxwell 8y ago
    AMP was what made me abandon Google Search in January 2018 for DuckDuckGo. Surprising how little I've noticed the change, after using Google Search for over 15 years. I try queries on google.com maybe once or twice a week if I don't find what I'm looking for on DDG. If it's anything media or product related, I feel like I'm on an old, crowded MySpace page. DDG feels more like the old Google.

sascha_sl 8y ago

I want Google to die already. It's so obvious why AMP is on the main google.com domain. They're collecting your shit. They're doing the same thing with ReCaptcha, also on the main google.com domain. Break this shitty company apart.

deevolution 8y ago

AMP pages take forever to load, I hate seeing a white screen > 1 second. with amp that's all I see on mobile. A white screen burning my eyeballs, seemingly forever. And then I snap out of it and hit back to escape from AMPs empty void.

jefftk 8y ago
It sounds like you're probably running something that blocks 3rd-party JS and also doesn't execute <noscript> blocks. See: https://news.ycombinator.com/item?id=19680033 https://news.ycombinator.com/item?id=19680033
deleted 8y ago
[deleted]
Cthulhu_ 8y ago
I read in probably another HN thread that using an adblocker will actually slow down an AMP page - there's a hardcoded 3 second CSS delay which is cancelled if (via JS) it's detected the page is loaded.

codedokode 8y ago

It's ridiculous. Google wants to keep users at its domain so much that it invents a whole technology to substitute address bar contents. This shows how harmful it is when a company has a significant market share in several different areas (browsers and search engines). I hope at least Mozilla doesn't adopt this technology and will show the true URL. This technology is complicated. Browser vendors have to implement all of this only to please Google.

Ajedi32 8y ago
This is the exact opposite of "keeping users at its domain". That was the situation _before_ they implemented this standard. Now users will get sent to the publisher's domain instead (via a prefetched page load).
- proaralyst 8y ago
  But it's served from Google, so they still control all the analytics
  - Ajedi32 8y ago
    No they don't. The page contents are controlled by the publisher and cryptographically signed so Google can't alter it. Another improvement over the previous situation.
    - josteink 8y ago
      Since it’s not fetched from the publisher they will have to use Google analytics or have nothing. Guess what they’re going to choose.
      - Ajedi32 8y ago
        Google Analytics isn't the only analytics solution out there. Publishers can use literally _any_ method of gathering analytics that's not server logs.

NelsonMinar 8y ago

If you're going to break the way the web works, you might as well break it hard. At least that seems to be Google's philosophy with this unasked-for inserting itself between people and publishers.

deleted 8y ago

[deleted]

j0057 8y ago

Seems dangerous for the web to mess with the URL bar, I get why Google wants to do this.