5 ms·

> Hm, hiding the protocol and the host part in the address – what next, hiding the domain? However, the path is hidden already, what's left then? You're right

> Hm, hiding the protocol and the host part in the address – what next, hiding the domain? However, the path is hidden already, what's left then? You're right! Google and Cloudflare are already jointly destroying the meaning of URLs through their "AMP real URLs" specification which allows any AMP gateway to impersonate a host, guaranteeing authenticity of the content through public-key cryptography. https://blog.cloudflare.com/announcing-amp-real-url/ https://blog.cloudflare.com/announcing-amp-real-url/ These changes to the fundamental bricks of the web are not without consequences. They are deliberate attacks on a free and neutral network of equal peers.

derefr 7y ago
> which allows any AMP gateway to impersonate a host Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Personally, I’m for that change, because if it becomes a predictable part of clients, formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. Imagine Wikipedia being able to automatically cite the “original origin” of anything you link!
- inetknght 7y ago
  Imagination is one thing. It's a useless point without it actually being a feature while browsers like Chrome and sites like AMP gateways do actually hide the "original origin" you speak of.
- lostjohnny 7y ago
  Imagine if we spent the same amount of money wasted on countless JS frameworks to build Xanadu...
- southerntofu 7y ago
  > Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Very good points, but the devil lies in the details. Preserving authenticity of web content through public-key cryptography is of course a welcome change. But HTTPS is for encryption from the client to the server (Transport Layer Security). So browser UIs were designed so a lock next to a URL meant you securely connected to the host of the URL. That's what we've been teaching people browsing the web for more than a decade. Subverting the meaning of URL bars and HTTPS indicators to make Google's control over the web less visible to the end user is of course a very politically-motivated choice and is yet another direct attack on the web as we know it to promote corporate interests. I would be all in favor of adding cryptographically-enforced authorship information in browser UIs, but would rather add a clickable "person" icon next to the HTTPS lock. So in the end you would end up with visual indication that a secure connection was established to the Google AMP gateway (or whatever website) and that this website is sharing content that provably originated from somewhere/someone; you would just have to click the button to figure it out (just like for TLS connection details). Also, if authentication of content is a concern or interest of yours, maybe content-addressable systems such as IPFS/DAT (among others) could interest you. > formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. There are already standards for doing precisely this on the web. ActivityStreams with Linked Data Signatures comes to mind, for example. But these corporations have no interest whatsoever in building an open and federated web. We're talking about Google. The company who, for example (among many other scandals) stopped federating their XMPP server (GTalk). From the switch of the button, they consciously chose to prevent millions of people who were previously chatting just fine to do just that. If that's not a manifestation of evil corporate power, i don't know what is.
  - Uristqwerty 7y ago
    Federation is nice, but going out of your way to hide that federation is occurring from users is a bit too much. Doesn't it matter who gets to see the full URL you are accessing (especially after efforts for DNS over HTTPS)? At least it could put an icon in the URL bar that can be clicked to show details about who served the content.
snek 7y ago
This is the thing I would want to ask Matthew Prince about if I ever met him. Cloudflare working on AMP really surprised me, I would've expected them to make some sort of de-AMP product.
realusername 7y ago
That could be a useful feature for decentralization, we could finally serve a mirror of a blocked site with its real origin. Of course, it will probably not be designed by Google to be any useful I guess.
- southerntofu 7y ago
  Yeah that's the problem. Bringing more federation to the web would help defeat censorship by making it easier to relay/aggregate information while retaining proof of authorship. That's just not the way Google is headed.

derefr 7y ago

> which allows any AMP gateway to impersonate a host Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Personally, I’m for that change, because if it becomes a predictable part of clients, formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. Imagine Wikipedia being able to automatically cite the “original origin” of anything you link!

inetknght 7y ago
Imagination is one thing. It's a useless point without it actually being a feature while browsers like Chrome and sites like AMP gateways do actually hide the "original origin" you speak of.
lostjohnny 7y ago
Imagine if we spent the same amount of money wasted on countless JS frameworks to build Xanadu...
southerntofu 7y ago
> Or, from another perspective, they’re pushing for a URL shown in a navigation bar to represent the origin of a document, rather than where you attained it from. (Which is already true of SOCKS and HTTP CONNECT proxies, of course.) Very good points, but the devil lies in the details. Preserving authenticity of web content through public-key cryptography is of course a welcome change. But HTTPS is for encryption from the client to the server (Transport Layer Security). So browser UIs were designed so a lock next to a URL meant you securely connected to the host of the URL. That's what we've been teaching people browsing the web for more than a decade. Subverting the meaning of URL bars and HTTPS indicators to make Google's control over the web less visible to the end user is of course a very politically-motivated choice and is yet another direct attack on the web as we know it to promote corporate interests. I would be all in favor of adding cryptographically-enforced authorship information in browser UIs, but would rather add a clickable "person" icon next to the HTTPS lock. So in the end you would end up with visual indication that a secure connection was established to the Google AMP gateway (or whatever website) and that this website is sharing content that provably originated from somewhere/someone; you would just have to click the button to figure it out (just like for TLS connection details). Also, if authentication of content is a concern or interest of yours, maybe content-addressable systems such as IPFS/DAT (among others) could interest you. > formats will emerge to attach signed origins to more document types (e.g. images; PDFs) and then people won’t be able to do easily lose the source of these documents. There are already standards for doing precisely this on the web. ActivityStreams with Linked Data Signatures comes to mind, for example. But these corporations have no interest whatsoever in building an open and federated web. We're talking about Google. The company who, for example (among many other scandals) stopped federating their XMPP server (GTalk). From the switch of the button, they consciously chose to prevent millions of people who were previously chatting just fine to do just that. If that's not a manifestation of evil corporate power, i don't know what is.
- Uristqwerty 7y ago
  Federation is nice, but going out of your way to hide that federation is occurring from users is a bit too much. Doesn't it matter who gets to see the full URL you are accessing (especially after efforts for DNS over HTTPS)? At least it could put an icon in the URL bar that can be clicked to show details about who served the content.

snek 7y ago

This is the thing I would want to ask Matthew Prince about if I ever met him. Cloudflare working on AMP really surprised me, I would've expected them to make some sort of de-AMP product.

realusername 7y ago

That could be a useful feature for decentralization, we could finally serve a mirror of a blocked site with its real origin. Of course, it will probably not be designed by Google to be any useful I guess.

southerntofu 7y ago
Yeah that's the problem. Bringing more federation to the web would help defeat censorship by making it easier to relay/aggregate information while retaining proof of authorship. That's just not the way Google is headed.