12 ms·

Hm, hiding the protocol and the host part in the address – what next, hiding the domain? However, the path is hidden already, what's left then? Seriously speak

Hm, hiding the protocol and the host part in the address – what next, hiding the domain? However, the path is hidden already, what's left then? Seriously speaking: If browsers are simplifying the URI scheme for the alleged benefit of users, how do we expect these users to know anything about addresses? Isn't this rather undermining security than enhancing it? Highlighting significant parts may be preferable to hiding those deemed insignificant. Moreover, regarding https, I personally prefer positive affirmation over lack of warning. For me, this worked best for desktop browsers with the padlock icon (and, before this, the key icon) shown together with a display of link targets in a status bar as a separate, reserved area. (While allowing pages to overwrite `window.status` was certainly not a good idea.) A consistent display of the authority issuing the certificate of the current page in a status bar like this may be also nice. I'm not convinced that less but more opaque information is the way to go. Dedicating 20 vertical pixels of virtual real estate to security relevant information may be worth it. It may be also easier to parse than an overloaded omnnibox/location/search/navigation/security/menu bar. Cutting down any information which is displayed too densely right from the beginning won't help the issue. How many bits of information are there in this "everything bar"? Yes, there's still a bit of grouping left, mainly by spacing, but color is mostly gone as a signal in order to make the information density bearable. So users will be applying quite an amount of selectivity when parsing this display, by this inevitably missing relevant information. (That this densely combined display is rather homogenous both for esthetics and acceptance just aggravates the need for selective parsing, which is likely to become a habit.) "We'll pre-filter this for you" isn't addressing the problem, it's rather "living with the outcome". Edit: A legitimate reason for redacting the host name are extensive names, crafted to exceed the space available in the location display in order to deceive users regarding the identity of the host. Here, abbreviating by an ellipsis (compare text-overflow: ellipsis) in order to fully display the domain may be a way to go. -- P.S.: What's the general lesson taught by such redactions by the browser vendor? That it is OK to ignore these things, as they are truly irrelevant? (Must be without significance, since Google told me so?)

UncleMeat 7y ago
> Seriously speaking: If browsers are simplifying the URI scheme for the alleged benefit of users, how do we expect these users to know anything about addresses? Isn't this rather undermining security than enhancing it? Users already don't know anything about addresses. Even security professionals botch the "look at some visual indicator of connection security" all the time (see SSLStrip). As a security feature the URL bar is almost entirely useless for the huge majority of users. URL bars also don't really tell you where your content is coming from. Iframes don't have URL bars. All that javascript downloaded from somewhere when the page loaded doesn't have a URL bar. The web isn't made of uniquely identifiable documents anymore.
inimino 7y ago
> What's the general lesson taught by such redactions by the browser vendor? That all you need is keywords and a good search engine. Platform companies hate URLs because they enable interoperability.
stephenr 7y ago
> how do we expect these users to know anything about addresses? Well clearly Google expect people not to. They expect people to "Google" for whatever they want.
- qazpot 7y ago
  Yes these "improvements" in Chrome are meant to make google the defacto interface for using the web. Imagine a world where 99% of users do not have any concept of URLs or any other fundamental WWW concepts. Instead, they open Chrome type whatever they want and get the results. It is not difficult to imagine a world where the non-tech users do not think of google as search engine but as internet in itself.
  - Beltiras 7y ago
    You don't have to imagine that world, merely adjust the ratio of people living in it. Are we at 30% of the population living in that world already? Is the ratio progressing towards 99%? How quickly?
    - iainmerrick 7y ago
      No, we’re at 99% now.
  - nerdponx 7y ago
    It also relegates other browsers to the domain of "that's too technical I don't know what all those letters mean".
  - jimmydddd 7y ago
    Back in the day, the internets worked this way with AOL. Every big compamy had an AOL keyword term.
  - AJ007 7y ago
    Except that Google has to pay Apple $12 billion a year to remain their default search engine, a price that has increased every year. What chrome did by training users to enter their searches in the address bar (via the default tab’s fake google search box which moves the cursor to the URL field) was stupid, expensive, and probably undermines Google’s ability to be a destination web site in the long term. At this point, the overwhelming number of devices are not Google’s. There is no reason to think that in the future they will be. After this anti trust stuff their influence over android may be even less than it is now.
clouddrover 7y ago
> What's the general lesson taught by such redactions by the browser vendor? That it drives traffic to their search engine and increases their revenue. A lot of people always use a search engine to navigate to sites anyway, even if it's a site they've been to many times before and even if the URI is as simple as https://somecompany.com https://somecompany.com. Personally, I always want to see the full URI.
- stephenr 7y ago
  Heck, I've seen people, on multiple occasions, load up a browser tab with the 'default' address of google.com, enter a url into the google search box (not the browser search/address box, the in-page google search box), and then proceed to click the result it gives them.
  - dbtx 7y ago
    This is merely how Google becomes spellcheck. You don't need to memorize strings anymore, that is so industrial-age. </s>
  - judge2020 7y ago
    At the very least, chrome new tab pages send your typing cursor to the Omnibox if you try to use the search box. Doesn't work if google.com is set as the new tab page.
    - stephenr 7y ago
      I wasn't actually talking about people using Chrome.
- rahuldottech 7y ago
  I don't know why the parent is being downvoted, but this is completely true. It's not hard to figure out that one of the reasons Google is doing this is so that more people use search engines to find sites, rather than just straight up enter the URI
mtgx 7y ago
Whatever this move is supposed to do, I guarantee you its #1 goal is to help Google first, and this being some kind of positive for users (not necessarily a net positive, just "a" positive) will be a side-effect at best (after all, everything in life comes with some kind of positive and some kind of negative benefit). It's how Google has approached most things lately. "Oh yeah, we're removing this API for user security. No, it has nothing to do with the same move killing ad-blockers in one blow, why do you ask?! And we're very offended you even think we'd do it for that reason! We'd never..."
martin_a 7y ago
> It may be also easier to parse than an overloaded omnnibox/location/search/navigation/security/menu bar. I think the point is that Google doesn't want users to be able to parse this much information. Keep the people dumb, if you want to call it that way. Or uninformed, uneducated, whatever. "Enter whatever you want to know or see in this field and we will do some magic so you get what you want". That's where they want to go, no doubt about it as Google probably profits the most from technically-uneducated users of its services.
- cm2187 7y ago
  Particularly given that you have a whole generation now that grew up with these technologies, the proportion of technically litterate users will go up over time not down.
  - TeMPOraL 7y ago
    That's absolutely not true. See e.g. how literate are people about cars, vs. how they were 40 years ago. See also the classical 2013 rant on the topic: http://www.coding2learn.org/blog/2013/07/29/kids-cant-use-computers/ http://www.coding2learn.org/blog/2013/07/29/kids-cant-use-co....
  - dsego 7y ago
    Growing up with technologies is not enough to be technically literate. I would say it's the opposite, you grew up with it so you don't really think about how it works.
    - type0 7y ago
      It's the fallacy of digital natives: http://ecdl.org/policy-publications/digital-native-fallacy http://ecdl.org/policy-publications/digital-native-fallacy
  - martin_a 7y ago
    If that would be true, we would see much more skepticism against home assistant technologies, social networks, "funny apps" and alike. I think people fail to grasp the full impact of technology on their lives, although (or because) they are surrounded by it.
skocznymroczny 7y ago
I guess the direction is appification of the Internet. On your phone, you launch "Facebook" and "Instagram", not /mnt/apps/facebook.apk and /mnt/apps/instagram.apk. Likewise, on the internet, they want you to visit "Facebook.com", not "https://facebook.com/index.html" https://facebook.com/index.html".
- dvfjsdhgfv 7y ago
  You meant index.php, not .html - FB is still largely based on a variant of PHP. If you try both constructs, .html will return their equivalent of 404, whereas .php will display the main page without complaint.
- tarsinge 7y ago
  Exactly this. But even as the URL is irrelevant for apps it allows the web as a publication platform to cohabit with the one as an app platform. Removing them is actively pushing for the app platform. Maybe in the future we’ll have 2 different apps with a UI optimized for each usage, ie Chrome for Apps and Chrome for web, even if the rendering is the same.
- masswerk 7y ago
  Yeah, it's about products for the most. (Also, what happened with human readable URLs? Even, if you'r driving your single page app on fragment identifiers, you could route them internally based on the path info.) On a more generally level, I think, it's probably more about amplification vs augmentation, the kind of human-computer symbiosis, what this dialog really is. (Actually, I do prefer Licklider over Engelbart.) Take for example a middle-aged worker in India, who has now one of those new, cheap, not-that-smart phones on a $2/month mobile plan. S/he connects to streaming services via voice search and communicates by the press of a single button. For the first time in her/his life, s/he's able to reach out on her/his own. This is certainly empowering. There's much to be said in favor of such interfaces on devices like this. However, Licklider's vision of a human-computer symbiosis was of a completely different nature, of partners in cooperation on equal levels. This was not about amplification in this sense, it was about mutual comprehension and directing work flows, with the later heavily depending on the former. This is the desktop environment. Here, simple amplification models are ultimately doing more harm as they may be convenient. Now, where are the growing markets, what should a company care about? However, this may be a question and an answer too simple. When will our Indian worker gain access to a laptop? The answer may be quite well, "never". Is this still the same market, the same product, the same network?
rakoo 7y ago
There was a plan by Google that makes sense and we should move forward to, it's a shift in mindset: - current situation: http is normal, https with bad certificate is bad, https with good certificate is good - future situation: http is bad, https with bad certificate is bad/acceptable, https with good certificate is normal i.e instead of telling people to check for the padlock icon and the green name that should be everywhere, tell people to check for the red warning that indicates a problem. I think it's lifting the expectation to something more secure by default.
- masswerk 7y ago
  I don't assist this notion. (Compare below, https://news.ycombinator.com/item?id=20573009 https://news.ycombinator.com/item?id=20573009) Understanding the basics of a secure connection and what possible consequences are is part of liability and being of sound mind. Teach them first, what it is and why it matters, to never engage in a critical communication without a verified secure connection as indicated by this and that signal. Facilitate users in asserting the mode of their electronic interactions. Then put an additional warning line on. But never replace the former by the latter. There is no "easy mode" when it comes to your livelihood. And, if users are able to grasp these basics (and sure they are – heck, not that long ago drivers had to understand and to be able to describe the workings of a car engine and transmission in order to pass a drivers test), understanding why a basic connection has become unbearable, shouldn't be much of a problem.
  - Avamander 7y ago
    I assist the notion because I've seen people get phished by pages with TLS certs for a long long time. The teaching that "HTTPS == secure" is just malicious and has to be dropped.
    - masswerk 7y ago
      Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. Edit: E.g., have a dedicated status bar, displaying to whom the certificate was issued by what CA and what the security level (level of identification) is, possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,...
starbugs 7y ago
Apple did this a while ago. Safari only shows the domain and the lock icon, nothing else. I get the discussion about Google changing the web to something that pleases their pockets over everything else, but I am not so sure whether that's the actual motivation in this case. Non-technical users can't do a lot with the rest of the URL anyway and even I as a technical user didn't mind Safari hiding the path and scheme up to now.
- jfindley 7y ago
  Yep. I've found the dissonance here particularly jarring - collective shrug when Apple hides the URL, but if Google does so we get huge outrage and assumptions that this must clearly be done primarily for malicious reasons. I know it's fashionable to hate Google right now, but this reaction seems a little over the top.
  - gsich 7y ago
    Safari usage is too low for most to rage about.
  - hannasanarion 7y ago
    Because Safari has a tiny user base?
  - darkarmani 7y ago
    > collective shrug when Apple hides the URL, but if Google does so we get huge outrage and assumptions that this must clearly be done primarily for malicious reasons. Who uses Safari? People depend on Chrome on all sorts of platforms. Screwing with the URL field affects millions of people.
    - schnable 7y ago
      I use desktop Safari because it is much more energy efficient than Chrome.
  - danShumway 7y ago
southerntofu 7y ago
> Hm, hiding the protocol and the host part in the address – what next, hiding the domain? However, the path is hidden already, what's left then? You're right! Google and Cloudflare are already jointly destroying the meaning of URLs through their "AMP real URLs" specification which allows any AMP gateway to impersonate a host, guaranteeing authenticity of the content through public-key cryptography. https://blog.cloudflare.com/announcing-amp-real-url/ https://blog.cloudflare.com/announcing-amp-real-url/ These changes to the fundamental bricks of the web are not without consequences. They are deliberate attacks on a free and neutral network of equal peers.
- derefr 7y ago
  > which allows any AMP gateway to impersonate a host Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Personally, I’m for that change, because if it becomes a predictable part of clients, formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. Imagine Wikipedia being able to automatically cite the “original origin” of anything you link!
  - inetknght 7y ago
    Imagination is one thing. It's a useless point without it actually being a feature while browsers like Chrome and sites like AMP gateways do actually hide the "original origin" you speak of.
  - lostjohnny 7y ago
    Imagine if we spent the same amount of money wasted on countless JS frameworks to build Xanadu...
  - southerntofu 7y ago
    > Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Very good points, but the devil lies in the details. Preserving authenticity of web content through public-key cryptography is of course a welcome change. But HTTPS is for encryption from the client to the server (Transport Layer Security). So browser UIs were designed so a lock next to a URL meant you securely connected to the host of the URL. That's what we've been teaching people browsing the web for more than a decade. Subverting the meaning of URL bars and HTTPS indicators to make Google's control over the web less visible to the end user is of course a very politically-motivated choice and is yet another direct attack on the web as we know it to promote corporate interests. I would be all in favor of adding cryptographically-enforced authorship information in browser UIs, but would rather add a clickable "person" icon next to the HTTPS lock. So in the end you would end up with visual indication that a secure connection was established to the Google AMP gateway (or whatever website) and that this website is sharing content that provably originated from somewhere/someone; you would just have to click the button to figure it out (just like for TLS connection details). Also, if authentication of content is a concern or interest of yours, maybe content-addressable systems such as IPFS/DAT (among others) could interest you. > formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. There are already standards for doing precisely this on the web. ActivityStreams with Linked Data Signatures comes to mind, for example. But these corporations have no interest whatsoever in building an open and federated web. We're talking about Google. The company who, for example (among many other scandals) stopped federating their XMPP server (GTalk). From the switch of the button, they consciously chose to prevent millions of people who were previously chatting just fine to do just that. If that's not a manifestation of evil corporate power, i don't know what is.
JadeNB 7y ago
> Seriously speaking: If browsers are simplifying the URI scheme for the alleged benefit of users, how do we expect these users to know anything about addresses? This has always driven me bonkers about the ProofPoint URL-obfuscation 'security'. My work started enforcing this recently, and it drives me crazy: 1. rather than training you to think more carefully about links in e-mails, it trains you to click blindly, because the software says it's safe; 2. it obscures the target of the URL, so that a URL that even a novice would recognise as fishy becomes a garbled string like any other—here's an example (but safe) mangled URL: https://urldefense.proofpoint.com/v2/url?u=https-3A__escholarship.org_content_qt5dj9b74w_qt5dj9b74w.pdf&d=DwIC-g&c=7Q-FWLBTAxn3T_E3HWrzGYJrC4RvUoWDrzTlitGRH_A&r=fDFfg5N-sxMSxbW3hS6WsQ&m=giTLUqirmM6FZGAOLKIp-AHow2YDDWYuGHGz6jjxykY&s=FhP_G8aKAp6QmXR9rR0Pl8L5Z5_XlDPql2uQqmKhDxM&e= 3. it filters outgoing links, meaning it assumes that the university employees, not just outside spammers, are hostile (but maybe this is a reasonable assumption?).
- judge2020 7y ago
  > meaning it assumes that the university employees, Phishing is definitely possible inside your email org, anything from a malicious browser extension to desktop malware might be geared to send bad links to all users (or a subset) within the logged-in Gmail/Outlook directories. But ya, that sounds like some pretty bad anti-phishing software. Sounds like vendor lock-in more than anything, especially if it's replacing the email links on the mail server itself. What are the chances it just runs the domain through Google safe browsing? :P
Dolores12 7y ago
We are heading to AOL-type internet where you enter keyword in address bar and go to a single direction -- shopping, weather, search, stocks, email, etc.
- partiallypro 7y ago
  I was just thinking this...and that is very good for Google, and perhaps Bing. So this move is totally selfish.
asdfman123 7y ago
> how do we expect these users to know anything about addresses Here's an experiment: walk down any street in the US. Actually, scratch that, because there's a good chance that you live in SF or Seattle and your streets are filled with computer programmers. Call a random number in a random area code. Ask them what the difference between HTTP and HTTPS is. The users already don't know.
- inetknght 7y ago
  Then educate them.
  - asdfman123 7y ago
    Which goes to my point: wanting users to be better educated is wishful thinking. Do you have a plan to educate even 90% of users? That would be a dream come true, but that still leaves a gaping hole of 10%. I would guess 90% of programmers could explain the difference between HTTP and HTTPS (the other 10% being the dreadfully incompetent). Right now I'm guessing we're at 5% or so and no amount of wanting that to not be true will change that.
    - gsich 7y ago
      Yes, by not hiding any relevant information. It's a good start.
    - inetknght 7y ago
      > Do you have a plan to educate even 90% of users? No, but I could easily create one if I was paid to put my mind to it. Just as a hobby, I already educate peers about how a lot of the internet and web and technology work anyway. I don't really have a desire to add to my life the stress of dealing with the terrible decisions, past and present, of "modern" UI driven almost completely by shady marketing tactics encouraged and often forced by business. I certainly don't have the desire to do so without compensation to offset that stress.
- magashna 7y ago
  So the answer is to make it even more obscure?
clhodapp 7y ago
Gah. The metaphor of calling screen area "screen real estate" has always been a pet peeve of mine but this "20 vertical pixels of virtual real estate" has me simultaneously impressed and horrified. Why not just "20 vertical pixels"?
- masswerk 7y ago
  Used here because of the implied greed and speculative use made of the resources, as well as for the idea of an alleged market of competing interest. Empirically (I've done the comparison), desktop browser UIs have been growing in vertical screen occupation since Netscape Navigator 2 quite continuously, including the most recent versions, while reducing the amount of information and control provided by the interface. (That is, tabs introduced a new demand of some legitimacy. – However, another vertically stacked horizontal bar isn't the single imaginable solution to the problem. Previously, there had been sidebars with extracted link lists, we can do it for bookmarks and reading lists… We're even better at scanning vertical lists. There's quite some dogma involved. Arguably, a horizontal tab list shouldn't exceed 5 items.)
- lnl 7y ago
  That, and calling battery "juice". It shouldn't bother me this much, but it does. Same for saying "daily driver" instead of "main phone". I guess they are meant to color up speech / break monotony, but it gets irritating when metaphors are overused and nobody just says "battery", so in the end, just using the boring regular word feels more refreshing. Similarly for articles that keep overuse words like "whopping" instead of usual formal words (to appear more friendly, I guess), or infallibly say "invest" for everything rather than just "buy".
  - jpindar 7y ago
    Any day now I expect to see some device described as "massively tiny" or "massively lightweight".
OrgNet 7y ago
> Hm, hiding the protocol and the host part in the address – what next, hiding the domain? they will replace the domain with google.com, and it already started
basch 7y ago
MOST PEOPLE dont undersand what is or isnt correct demarcation, and what order to read things in. . / - _ (dot, slash, dash, underscore) all mean very specific things, and different things in different context (period specifically), and if you dont have their meanings memorized and what order to read things in, (right to left from the tld, pausing at each period, then left to right from the first slash, pausing at each slash) then URLs look like illegible nonsense.
- masswerk 7y ago
  But there it's really just about 4 major separators and the scheme prefix! (Dot, slash, question mark, hash mark.) – Mind that we're talking about users who are already able to read and parse sentences, including punctuations. There's no special skill set required, just a few bits of information. Users are able to parse post addresses and apply specific meaning and rules to the various parts. (Compared to URIs post adddresses are exceptionally messy und full of edge cases and exceptions.) Before mobile, users have been able to identify phone numbers by country, region, city and district. Where is the crucial difference? Isn't just because they are told it does 't matter and they won't understand anyway!
Kalium 7y ago
> If browsers are simplifying the URI scheme for the alleged benefit of users, how do we expect these users to know anything about addresses? You've accurately assessed the current state of affairs. The current average user knows essentially nothing about addresses. They might have a vague sense that domain matters, but that's about it. Displaying more information that they do not understand does not enhance the security of the average user. Displaying more information useful to the exceptional user (i.e., us) has to be weighted the degree to which it leads average users to a learned helplessness reaction.
- masswerk 7y ago
  I don't see, why this should be a matter of capitulation, especially on the desktop environment. Users have been able to maintain a basic understanding of similar schemes and were able to operate them for centuries. Compared to most real world schemes and regulations, basic URIs are exceptionally regulated (there is such a thing as a well-formed URL) and easy to understand. What changed? (My go to example is the level of understanding required to operate a kitchen and to prepare a meal, which is surprisingly high, but not worth even mentioning. Users do understand the difference of a spoon and a knife, as long as they understand the relevance of this to them. They are even able to operate an oven and to deviate from complex recipes in creative ways, while finding and managing all kind of equipment and managing time critical work flows. Is a similar operational understanding of what may be the most important technology of our time really asking too much?)
  - Kalium 7y ago
    You're absolutely correct that URIs are well-regulated, well-defined, and easy to understand for those with appropriately technical backgrounds. You're also correct that users don't need to understand in significant technical depth how URIs work in order to use them for most daily operations. In my opinion, what's changed is that someone won the political battle between "URIs are so simple and well-defined! Everyone understands them." and "Users don't understand URIs" camps. With that said, it's perhaps worth considering that most users might regard computers as essentially magical and fundamentally incomprehensible things. In such a context, could it be possible that it might actually be too much to ask for your average user to have a good operational understanding of something that seems to them to be fundamentally incomprehensible? A great many people have already learned helplessness in the face of technology. Could it be that decades of exposing people to the elegant simplicity of URLs has not created widespread operational comprehension?

UncleMeat 7y ago

> Seriously speaking: If browsers are simplifying the URI scheme for the alleged benefit of users, how do we expect these users to know anything about addresses? Isn't this rather undermining security than enhancing it? Users already don't know anything about addresses. Even security professionals botch the "look at some visual indicator of connection security" all the time (see SSLStrip). As a security feature the URL bar is almost entirely useless for the huge majority of users. URL bars also don't really tell you where your content is coming from. Iframes don't have URL bars. All that javascript downloaded from somewhere when the page loaded doesn't have a URL bar. The web isn't made of uniquely identifiable documents anymore.

inimino 7y ago

> What's the general lesson taught by such redactions by the browser vendor? That all you need is keywords and a good search engine. Platform companies hate URLs because they enable interoperability.

stephenr 7y ago

> how do we expect these users to know anything about addresses? Well clearly Google expect people not to. They expect people to "Google" for whatever they want.

qazpot 7y ago
Yes these "improvements" in Chrome are meant to make google the defacto interface for using the web. Imagine a world where 99% of users do not have any concept of URLs or any other fundamental WWW concepts. Instead, they open Chrome type whatever they want and get the results. It is not difficult to imagine a world where the non-tech users do not think of google as search engine but as internet in itself.
- Beltiras 7y ago
  You don't have to imagine that world, merely adjust the ratio of people living in it. Are we at 30% of the population living in that world already? Is the ratio progressing towards 99%? How quickly?
  - iainmerrick 7y ago
    No, we’re at 99% now.
- nerdponx 7y ago
  It also relegates other browsers to the domain of "that's too technical I don't know what all those letters mean".
- jimmydddd 7y ago
  Back in the day, the internets worked this way with AOL. Every big compamy had an AOL keyword term.
- AJ007 7y ago
  Except that Google has to pay Apple $12 billion a year to remain their default search engine, a price that has increased every year. What chrome did by training users to enter their searches in the address bar (via the default tab’s fake google search box which moves the cursor to the URL field) was stupid, expensive, and probably undermines Google’s ability to be a destination web site in the long term. At this point, the overwhelming number of devices are not Google’s. There is no reason to think that in the future they will be. After this anti trust stuff their influence over android may be even less than it is now.

clouddrover 7y ago

> What's the general lesson taught by such redactions by the browser vendor? That it drives traffic to their search engine and increases their revenue. A lot of people always use a search engine to navigate to sites anyway, even if it's a site they've been to many times before and even if the URI is as simple as https://somecompany.com https://somecompany.com. Personally, I always want to see the full URI.

stephenr 7y ago
Heck, I've seen people, on multiple occasions, load up a browser tab with the 'default' address of google.com, enter a url into the google search box (not the browser search/address box, the in-page google search box), and then proceed to click the result it gives them.
- dbtx 7y ago
  This is merely how Google becomes spellcheck. You don't need to memorize strings anymore, that is so industrial-age. </s>
- judge2020 7y ago
  At the very least, chrome new tab pages send your typing cursor to the Omnibox if you try to use the search box. Doesn't work if google.com is set as the new tab page.
  - stephenr 7y ago
    I wasn't actually talking about people using Chrome.
rahuldottech 7y ago
I don't know why the parent is being downvoted, but this is completely true. It's not hard to figure out that one of the reasons Google is doing this is so that more people use search engines to find sites, rather than just straight up enter the URI

mtgx 7y ago

Whatever this move is supposed to do, I guarantee you its #1 goal is to help Google first, and this being some kind of positive for users (not necessarily a net positive, just "a" positive) will be a side-effect at best (after all, everything in life comes with some kind of positive and some kind of negative benefit). It's how Google has approached most things lately. "Oh yeah, we're removing this API for user security. No, it has nothing to do with the same move killing ad-blockers in one blow, why do you ask?! And we're very offended you even think we'd do it for that reason! We'd never..."

martin_a 7y ago

> It may be also easier to parse than an overloaded omnnibox/location/search/navigation/security/menu bar. I think the point is that Google doesn't want users to be able to parse this much information. Keep the people dumb, if you want to call it that way. Or uninformed, uneducated, whatever. "Enter whatever you want to know or see in this field and we will do some magic so you get what you want". That's where they want to go, no doubt about it as Google probably profits the most from technically-uneducated users of its services.

cm2187 7y ago
Particularly given that you have a whole generation now that grew up with these technologies, the proportion of technically litterate users will go up over time not down.
- TeMPOraL 7y ago
  That's absolutely not true. See e.g. how literate are people about cars, vs. how they were 40 years ago. See also the classical 2013 rant on the topic: http://www.coding2learn.org/blog/2013/07/29/kids-cant-use-computers/ http://www.coding2learn.org/blog/2013/07/29/kids-cant-use-co....
- dsego 7y ago
  Growing up with technologies is not enough to be technically literate. I would say it's the opposite, you grew up with it so you don't really think about how it works.
  - type0 7y ago
    It's the fallacy of digital natives: http://ecdl.org/policy-publications/digital-native-fallacy http://ecdl.org/policy-publications/digital-native-fallacy
- martin_a 7y ago
  If that would be true, we would see much more skepticism against home assistant technologies, social networks, "funny apps" and alike. I think people fail to grasp the full impact of technology on their lives, although (or because) they are surrounded by it.

skocznymroczny 7y ago

I guess the direction is appification of the Internet. On your phone, you launch "Facebook" and "Instagram", not /mnt/apps/facebook.apk and /mnt/apps/instagram.apk. Likewise, on the internet, they want you to visit "Facebook.com", not "https://facebook.com/index.html" https://facebook.com/index.html".

dvfjsdhgfv 7y ago
You meant index.php, not .html - FB is still largely based on a variant of PHP. If you try both constructs, .html will return their equivalent of 404, whereas .php will display the main page without complaint.
tarsinge 7y ago
Exactly this. But even as the URL is irrelevant for apps it allows the web as a publication platform to cohabit with the one as an app platform. Removing them is actively pushing for the app platform. Maybe in the future we’ll have 2 different apps with a UI optimized for each usage, ie Chrome for Apps and Chrome for web, even if the rendering is the same.
masswerk 7y ago
Yeah, it's about products for the most. (Also, what happened with human readable URLs? Even, if you'r driving your single page app on fragment identifiers, you could route them internally based on the path info.) On a more generally level, I think, it's probably more about amplification vs augmentation, the kind of human-computer symbiosis, what this dialog really is. (Actually, I do prefer Licklider over Engelbart.) Take for example a middle-aged worker in India, who has now one of those new, cheap, not-that-smart phones on a $2/month mobile plan. S/he connects to streaming services via voice search and communicates by the press of a single button. For the first time in her/his life, s/he's able to reach out on her/his own. This is certainly empowering. There's much to be said in favor of such interfaces on devices like this. However, Licklider's vision of a human-computer symbiosis was of a completely different nature, of partners in cooperation on equal levels. This was not about amplification in this sense, it was about mutual comprehension and directing work flows, with the later heavily depending on the former. This is the desktop environment. Here, simple amplification models are ultimately doing more harm as they may be convenient. Now, where are the growing markets, what should a company care about? However, this may be a question and an answer too simple. When will our Indian worker gain access to a laptop? The answer may be quite well, "never". Is this still the same market, the same product, the same network?

rakoo 7y ago

There was a plan by Google that makes sense and we should move forward to, it's a shift in mindset: - current situation: http is normal, https with bad certificate is bad, https with good certificate is good - future situation: http is bad, https with bad certificate is bad/acceptable, https with good certificate is normal i.e instead of telling people to check for the padlock icon and the green name that should be everywhere, tell people to check for the red warning that indicates a problem. I think it's lifting the expectation to something more secure by default.

masswerk 7y ago
I don't assist this notion. (Compare below, https://news.ycombinator.com/item?id=20573009 https://news.ycombinator.com/item?id=20573009) Understanding the basics of a secure connection and what possible consequences are is part of liability and being of sound mind. Teach them first, what it is and why it matters, to never engage in a critical communication without a verified secure connection as indicated by this and that signal. Facilitate users in asserting the mode of their electronic interactions. Then put an additional warning line on. But never replace the former by the latter. There is no "easy mode" when it comes to your livelihood. And, if users are able to grasp these basics (and sure they are – heck, not that long ago drivers had to understand and to be able to describe the workings of a car engine and transmission in order to pass a drivers test), understanding why a basic connection has become unbearable, shouldn't be much of a problem.
- Avamander 7y ago
  I assist the notion because I've seen people get phished by pages with TLS certs for a long long time. The teaching that "HTTPS == secure" is just malicious and has to be dropped.
  - masswerk 7y ago
    Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. Edit: E.g., have a dedicated status bar, displaying to whom the certificate was issued by what CA and what the security level (level of identification) is, possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,...

starbugs 7y ago

Apple did this a while ago. Safari only shows the domain and the lock icon, nothing else. I get the discussion about Google changing the web to something that pleases their pockets over everything else, but I am not so sure whether that's the actual motivation in this case. Non-technical users can't do a lot with the rest of the URL anyway and even I as a technical user didn't mind Safari hiding the path and scheme up to now.

jfindley 7y ago
Yep. I've found the dissonance here particularly jarring - collective shrug when Apple hides the URL, but if Google does so we get huge outrage and assumptions that this must clearly be done primarily for malicious reasons. I know it's fashionable to hate Google right now, but this reaction seems a little over the top.
- gsich 7y ago
  Safari usage is too low for most to rage about.
- hannasanarion 7y ago
  Because Safari has a tiny user base?
- darkarmani 7y ago
  > collective shrug when Apple hides the URL, but if Google does so we get huge outrage and assumptions that this must clearly be done primarily for malicious reasons. Who uses Safari? People depend on Chrome on all sorts of platforms. Screwing with the URL field affects millions of people.
  - schnable 7y ago
    I use desktop Safari because it is much more energy efficient than Chrome.
- danShumway 7y ago

southerntofu 7y ago

> Hm, hiding the protocol and the host part in the address – what next, hiding the domain? However, the path is hidden already, what's left then? You're right! Google and Cloudflare are already jointly destroying the meaning of URLs through their "AMP real URLs" specification which allows any AMP gateway to impersonate a host, guaranteeing authenticity of the content through public-key cryptography. https://blog.cloudflare.com/announcing-amp-real-url/ https://blog.cloudflare.com/announcing-amp-real-url/ These changes to the fundamental bricks of the web are not without consequences. They are deliberate attacks on a free and neutral network of equal peers.

derefr 7y ago
> which allows any AMP gateway to impersonate a host Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Personally, I’m for that change, because if it becomes a predictable part of clients, formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. Imagine Wikipedia being able to automatically cite the “original origin” of anything you link!
- inetknght 7y ago
  Imagination is one thing. It's a useless point without it actually being a feature while browsers like Chrome and sites like AMP gateways do actually hide the "original origin" you speak of.
- lostjohnny 7y ago
  Imagine if we spent the same amount of money wasted on countless JS frameworks to build Xanadu...
- southerntofu 7y ago
  > Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Very good points, but the devil lies in the details. Preserving authenticity of web content through public-key cryptography is of course a welcome change. But HTTPS is for encryption from the client to the server (Transport Layer Security). So browser UIs were designed so a lock next to a URL meant you securely connected to the host of the URL. That's what we've been teaching people browsing the web for more than a decade. Subverting the meaning of URL bars and HTTPS indicators to make Google's control over the web less visible to the end user is of course a very politically-motivated choice and is yet another direct attack on the web as we know it to promote corporate interests. I would be all in favor of adding cryptographically-enforced authorship information in browser UIs, but would rather add a clickable "person" icon next to the HTTPS lock. So in the end you would end up with visual indication that a secure connection was established to the Google AMP gateway (or whatever website) and that this website is sharing content that provably originated from somewhere/someone; you would just have to click the button to figure it out (just like for TLS connection details). Also, if authentication of content is a concern or interest of yours, maybe content-addressable systems such as IPFS/DAT (among others) could interest you. > formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. There are already standards for doing precisely this on the web. ActivityStreams with Linked Data Signatures comes to mind, for example. But these corporations have no interest whatsoever in building an open and federated web. We're talking about Google. The company who, for example (among many other scandals) stopped federating their XMPP server (GTalk). From the switch of the button, they consciously chose to prevent millions of people who were previously chatting just fine to do just that. If that's not a manifestation of evil corporate power, i don't know what is.

JadeNB 7y ago

> Seriously speaking: If browsers are simplifying the URI scheme for the alleged benefit of users, how do we expect these users to know anything about addresses? This has always driven me bonkers about the ProofPoint URL-obfuscation 'security'. My work started enforcing this recently, and it drives me crazy: 1. rather than training you to think more carefully about links in e-mails, it trains you to click blindly, because the software says it's safe; 2. it obscures the target of the URL, so that a URL that even a novice would recognise as fishy becomes a garbled string like any other—here's an example (but safe) mangled URL: https://urldefense.proofpoint.com/v2/url?u=https-3A__escholarship.org_content_qt5dj9b74w_qt5dj9b74w.pdf&d=DwIC-g&c=7Q-FWLBTAxn3T_E3HWrzGYJrC4RvUoWDrzTlitGRH_A&r=fDFfg5N-sxMSxbW3hS6WsQ&m=giTLUqirmM6FZGAOLKIp-AHow2YDDWYuGHGz6jjxykY&s=FhP_G8aKAp6QmXR9rR0Pl8L5Z5_XlDPql2uQqmKhDxM&e= 3. it filters outgoing links, meaning it assumes that the university employees, not just outside spammers, are hostile (but maybe this is a reasonable assumption?).

judge2020 7y ago
> meaning it assumes that the university employees, Phishing is definitely possible inside your email org, anything from a malicious browser extension to desktop malware might be geared to send bad links to all users (or a subset) within the logged-in Gmail/Outlook directories. But ya, that sounds like some pretty bad anti-phishing software. Sounds like vendor lock-in more than anything, especially if it's replacing the email links on the mail server itself. What are the chances it just runs the domain through Google safe browsing? :P

Dolores12 7y ago

We are heading to AOL-type internet where you enter keyword in address bar and go to a single direction -- shopping, weather, search, stocks, email, etc.

partiallypro 7y ago
I was just thinking this...and that is very good for Google, and perhaps Bing. So this move is totally selfish.

asdfman123 7y ago

> how do we expect these users to know anything about addresses Here's an experiment: walk down any street in the US. Actually, scratch that, because there's a good chance that you live in SF or Seattle and your streets are filled with computer programmers. Call a random number in a random area code. Ask them what the difference between HTTP and HTTPS is. The users already don't know.

inetknght 7y ago
Then educate them.
- asdfman123 7y ago
  Which goes to my point: wanting users to be better educated is wishful thinking. Do you have a plan to educate even 90% of users? That would be a dream come true, but that still leaves a gaping hole of 10%. I would guess 90% of programmers could explain the difference between HTTP and HTTPS (the other 10% being the dreadfully incompetent). Right now I'm guessing we're at 5% or so and no amount of wanting that to not be true will change that.
  - gsich 7y ago
    Yes, by not hiding any relevant information. It's a good start.
  - inetknght 7y ago
    > Do you have a plan to educate even 90% of users? No, but I could easily create one if I was paid to put my mind to it. Just as a hobby, I already educate peers about how a lot of the internet and web and technology work anyway. I don't really have a desire to add to my life the stress of dealing with the terrible decisions, past and present, of "modern" UI driven almost completely by shady marketing tactics encouraged and often forced by business. I certainly don't have the desire to do so without compensation to offset that stress.
magashna 7y ago
So the answer is to make it even more obscure?

clhodapp 7y ago

Gah. The metaphor of calling screen area "screen real estate" has always been a pet peeve of mine but this "20 vertical pixels of virtual real estate" has me simultaneously impressed and horrified. Why not just "20 vertical pixels"?

masswerk 7y ago
Used here because of the implied greed and speculative use made of the resources, as well as for the idea of an alleged market of competing interest. Empirically (I've done the comparison), desktop browser UIs have been growing in vertical screen occupation since Netscape Navigator 2 quite continuously, including the most recent versions, while reducing the amount of information and control provided by the interface. (That is, tabs introduced a new demand of some legitimacy. – However, another vertically stacked horizontal bar isn't the single imaginable solution to the problem. Previously, there had been sidebars with extracted link lists, we can do it for bookmarks and reading lists… We're even better at scanning vertical lists. There's quite some dogma involved. Arguably, a horizontal tab list shouldn't exceed 5 items.)
lnl 7y ago
That, and calling battery "juice". It shouldn't bother me this much, but it does. Same for saying "daily driver" instead of "main phone". I guess they are meant to color up speech / break monotony, but it gets irritating when metaphors are overused and nobody just says "battery", so in the end, just using the boring regular word feels more refreshing. Similarly for articles that keep overuse words like "whopping" instead of usual formal words (to appear more friendly, I guess), or infallibly say "invest" for everything rather than just "buy".
- jpindar 7y ago
  Any day now I expect to see some device described as "massively tiny" or "massively lightweight".

OrgNet 7y ago

> Hm, hiding the protocol and the host part in the address – what next, hiding the domain? they will replace the domain with google.com, and it already started

basch 7y ago

MOST PEOPLE dont undersand what is or isnt correct demarcation, and what order to read things in. . / - _ (dot, slash, dash, underscore) all mean very specific things, and different things in different context (period specifically), and if you dont have their meanings memorized and what order to read things in, (right to left from the tld, pausing at each period, then left to right from the first slash, pausing at each slash) then URLs look like illegible nonsense.

masswerk 7y ago
But there it's really just about 4 major separators and the scheme prefix! (Dot, slash, question mark, hash mark.) – Mind that we're talking about users who are already able to read and parse sentences, including punctuations. There's no special skill set required, just a few bits of information. Users are able to parse post addresses and apply specific meaning and rules to the various parts. (Compared to URIs post adddresses are exceptionally messy und full of edge cases and exceptions.) Before mobile, users have been able to identify phone numbers by country, region, city and district. Where is the crucial difference? Isn't just because they are told it does 't matter and they won't understand anyway!

Kalium 7y ago

> If browsers are simplifying the URI scheme for the alleged benefit of users, how do we expect these users to know anything about addresses? You've accurately assessed the current state of affairs. The current average user knows essentially nothing about addresses. They might have a vague sense that domain matters, but that's about it. Displaying more information that they do not understand does not enhance the security of the average user. Displaying more information useful to the exceptional user (i.e., us) has to be weighted the degree to which it leads average users to a learned helplessness reaction.

masswerk 7y ago
I don't see, why this should be a matter of capitulation, especially on the desktop environment. Users have been able to maintain a basic understanding of similar schemes and were able to operate them for centuries. Compared to most real world schemes and regulations, basic URIs are exceptionally regulated (there is such a thing as a well-formed URL) and easy to understand. What changed? (My go to example is the level of understanding required to operate a kitchen and to prepare a meal, which is surprisingly high, but not worth even mentioning. Users do understand the difference of a spoon and a knife, as long as they understand the relevance of this to them. They are even able to operate an oven and to deviate from complex recipes in creative ways, while finding and managing all kind of equipment and managing time critical work flows. Is a similar operational understanding of what may be the most important technology of our time really asking too much?)
- Kalium 7y ago
  You're absolutely correct that URIs are well-regulated, well-defined, and easy to understand for those with appropriately technical backgrounds. You're also correct that users don't need to understand in significant technical depth how URIs work in order to use them for most daily operations. In my opinion, what's changed is that someone won the political battle between "URIs are so simple and well-defined! Everyone understands them." and "Users don't understand URIs" camps. With that said, it's perhaps worth considering that most users might regard computers as essentially magical and fundamentally incomprehensible things. In such a context, could it be possible that it might actually be too much to ask for your average user to have a good operational understanding of something that seems to them to be fundamentally incomprehensible? A great many people have already learned helplessness in the face of technology. Could it be that decades of exposing people to the elegant simplicity of URLs has not created widespread operational comprehension?