6 ms·
Google clears up AMP’s confusing URLs by hiding google.com
- josteink 7y agoYmmv but as far as I’m concerned fixing a problem by hiding the evidence and pretending it doesn’t exist does not really count. On the contrary, this makes the problem much, much worse by the url-bar no longer being a reliable indicator of the url actually fetched. Can’t AMP just die already? That would actually solve the problem.
- londons_explore 7y agoIt's signed by the original site though... By your argument, all URL's should say "Comcast", because all webpages you load at home are from Comcast...
- josteink 7y agoThey are not. They are served by the web-server specified in the url at the application level. Routers, switches and repeaters in the middle are serving nothing, they are relaying IP packets at the transport layer. If you can’t tell the difference, you may want to read up on basic network layers.
- foobarding 7y agoYes, but I think you may be missing the point they were trying to make. This is simply a form of caching for content delivered over HTTPS that preserves the key properties of HTTPS. The browser gets the blob and confirms cryptographically the origin of the blob. It can then show the user that origin information so they can know where the content came from. This is the thing browser UI is supposed to communicate to the user. This is why Google is analogous to Comcast here. Neither can mess with the content or impact its origin. They are just part of the packet transmission system in between. Hence this is a huge win. Previously, AMP was served off of Google servers where Google was the man in the middle aware of and even able to manipulate the content. The scripts were running on their origin, etc. Now with this signed exchange tech, the contract is between browser and origin server. The Google cache is now super dumb, which is a big improvement from a privacy and security perspective.
- josteink 7y ago> Now with this signed exchange tech, the contract is between browser and origin server. The Google cache is now super dumb, which is a big improvement from a privacy and security perspective. Transparently serving content from google when the url says something else is a complete loss of privacy and security from a user-perspective.
- lawrenceyan 7y agoOnly if the user doesn't understand how cryptographic signing and verification works. Otherwise, they'll know that doing things this ways actually creates stronger guarantees of privacy than what previously was done.
- josteink 7y agoBut now Google gets to track my requests where they previously couldn’t, because my request goes to their server. That’s a massive loss of privacy right there. How is that even debatable? Also given how Google works, I think it’s reasonable to assume that enabling this additional Google-tracking was the primary intention behind AMP.
- lawrenceyan 7y agoOnce they've been encrypted, it's all just gibberish to the intermediaries. If you truly do see this as a massive loss of privacy, then why are you not outraged at Comcast and others that regularly act as middlemen with your encrypted data today?
- josteink 7y agoThey see the URL I’m requesting. It’s trivial for them to request that same content. My isp cannot do that because the url is part of an encrypted transfer, but a transfer google now has allowed themselves to snoop into.
- raldi 7y agoBetter headline would be, "Google to disguise AMP URLs"
- llbowers 7y agoNow give me the option to opt out of amp results in my search and it'll be perfect.
- ChrisSD 7y agoThere is an option but you have to use Firefox to enable it. For whatever reason Google doesn't give AMP links to Firefox users.
- lawrenceyan 7y agoBecause it results in a meaningful difference in page speed loading that makes Chrome faster than Firefox.
- ttctciyf 7y agoThe lack of this option is the single most eloquent statement of Google's coercive intentions for AMP. It's incredibly easy to implement, and if they were really about improving user experience they'd provide it in a heartbeat.
- frenchy 7y agoYou can opt out here: https://duckduckgo.com/ https://duckduckgo.com/
- dngray 7y agoAlso: https://www.daniel.priv.no/web-extensions/amp2html.html https://www.daniel.priv.no/web-extensions/amp2html.html https://www.ctrl.blog/entry/amp2html-extension.html https://www.ctrl.blog/entry/amp2html-extension.html I opted out of this bullshit when it came out, works on Android Firefox too!
- davidu 7y ago"The answer to the AMP URL problem are "signed exchanges", which allow a publisher's domain to be displayed in the browser address bar, even though the content is loaded from Google's cache when a user clicks on an AMP link in Google Search results." Someone smart thought this was a good idea. "This allows you to use first-party cookies and storage to customize content and simplify analytics integration. Your page appears under your URL instead of the google.com/amp URL." Creating opacity in security and misdirection in trust is unwise for users. Making the address bar lie is dangerous. I just don't get how the smart people at Google allow this to happen. The developers of Chrome and AMP can try to rationalize bad behavior but I'm surprised how all their coworkers let it stand. There was once a Google that would have been displeased with this kind of action.
- ec109685 7y agoHow is the signed exchange materially different than just having the browser make the request when you click on a link? Google hits the page beforehand, gets a cryptographically signed package of assets, verifies its contents and returns that to the user when the user clicks a link versus having the browser make the request itself at that time.
- londons_explore 7y agoAgreed. As long as it's crypto-signed byte-for byte and matches exactly what the original website published, then the actual TCP connection used to deliver the data is irrelevant.
- username444 7y agoThen why have Google deliver it at all, instead of encouraging publishers to simply cache their pages and serve via CDN? Amp is a solution that creates more problems than it helps. But it's a strategic move for Google to exert more control over publishers.
- ec109685 7y ago
- keiru 7y agoWhen will Google stop acting like it owns the internet? Also, isn't this highly exploitable form a security stand point?
- awinder 7y agoWhy is google unable to work with CNAME again, I’m sure amp.washingtonpost.com would suffice? This seems like a Rube Goldberg machine for something with tons of existing solutions...
- ddingus 7y agoGoogle does not control that.
- AndrewDucker 7y agoYou could easily point that URL at a Google server.
- ec109685 7y agoGoogle / chrome can’t prefetch content on amp.washingtonpost.com or it would leak that the publisher’s content was shown in a search result.