3 ms·

The worst part: > We've worked with other browser representatives to incorporate URL display guidance into the web URL standard (https://url.spec.whatwg.org/#u

The worst part: > We've worked with other browser representatives to incorporate URL display guidance into the web URL standard (https://url.spec.whatwg.org/#url-rendering-simplification https://url.spec.whatwg.org/#url-rendering-simplification). The URL spec documents that browsers may simplify the URL by omitting irrelevant subdomains and schemes in security-sensitive surfaces like the omnibox. Google is trying to make this obfuscation a standard.

danShumway 7y ago
I don't think it's deliberate undermining, I think it's more, "people complained that we were breaking standards, so we fixed it by changing the standard." The Chrome team is almost incapable of reversing course on their decisions. Even when they get massive pushback and enough negative press to effectively force them to reverse course, it's only ever temporary. "Widespread criticism over a decision? That just means people aren't ready yet, or they're too emotional to think clearly about our position. Give it a couple of months to a year, and they'll all have calmed down enough to realize we're right." "People are complaining about breaking standards? It's not that our decision was wrong, people are just upset we didn't check all the right boxes and fill out all the right forms before we made it. It's not real criticism, it's just people being legalistic about the standards process. Fine, we'll play that game." And then they wonder why people automatically assume the worst whenever Chrome devs propose something new.
- skybrian 7y ago
  There is a positive feedback cycle leading to polarization, and it works both ways. The more people assume the worst, the more likely they are to criticize with only a cursory understanding what's going on, and the more that justified criticism gets lost in the noise, leading to further communication breakdown as more people stop listening. In the worst case, certain things become "common knowledge" that nobody bothers checking anymore. Breaking that cycle requires putting effort into understanding both sides and going beyond quick comments.
  - danShumway 7y ago
    Breaking the cycle can't be done by only one side. If good maintainers aren't put in contact with good critiques, then they'll eventually assume every take on their work is purely reactionary. But in the same way, if good critics who take the time to write detailed critiques aren't listened to, then they'll eventually get tired and stop engaging. One side can't put in all of the work, or we'll end up in the same exact situation within another year. I've seen the conversation around Chrome degrade dramatically even over the past year or two. Back when Chrome accidentally broke web audio, the community was putting a lot of time into brainstorming possible solutions. You had authors behind some of the biggest games and platforms on the web trying to be constructive. More recently with the V3 manifest, actual adblock developers from the most popular extensions on the store have weighed in, written performance tests, and shared thoughts. But they've been less willing to go out of their way to assume the best of the Chrome team than game developers were in 2018. There's a very visible degradation of trust, and an assumption that there's no point in engaging constructively with Google because Google just does not respond to criticism. Back in 2018, I myself wrote up a massive blog post[0] going over the problems with Google's Web Audio changes. I was careful to assume the best of maintainers, that they really did have the best interest of the web in mind, and that they really were trying to make something great. However, I pointed out: > These mistakes create a narrative undercurrent that will undermine Google's future efforts to get developers to trust them when they're forced to make difficult decisions... Given enough examples of Google dismissing concerns about its pet projects, the public will simply stop believing that the company cares. So now in 2019, I'm not going to write a massive blog post going into extensive detail about why obfuscating URLs is a bad idea, because I've fallen victim to the same thought pattern I warned about above. I don't believe that Google cares, and I have better uses of my time. Why should I waste my time writing this stuff, when I know it's not going to make a difference, and when I know Google is just going to do whatever they want anyway? Why should someone like Gorhill waste their time building detailed breakdowns of an extension API, if there's no chance of getting that API decision reversed? None of this just arbitrarily happened -- even two or three years ago, developers used to engage with the Chrome team with a lot more patience and a lot more good faith. There are still a lot of members of the community that aren't polarized, they're just tired. And if there was any evidence that Chrome developers were willing to listen to people like Gorhill or Ashley, those people would still be willing to step up. [0]: https://danshumway.com/blog/chrome-autoplay/ https://danshumway.com/blog/chrome-autoplay/
josteink 7y ago
> security-sensitive surfaces like the omnibox. Yes. It’s security sensitive. Any incorrect or misleading information placed here can trick a user proceeding with actions they otherwise would not. So we should let the URL-bar present the unmangled URL and nothing else.
- UncleMeat 7y ago
  The "security sensitive" information in the URL bar is horrible. For TLS you need to look for the presence of a single character. For most people, "http://" http://" and "https://" https://" are both gibberish and remembering which one is good is not obvious. For domain names you now need to look past all of the subdomains since mybank.evil.com isn't safe. But don't look all the way to the right since that is usually full of gibberish and everything after the "/" isn't trustworthy either. Oh and watch out for homoglyphs too. URLs suck for security. Also I bet you are upset that port numbers aren't included in the displayed URL too.
- Dylan16807 7y ago
  You need to justify that "So". Showing all the info you have is often less clear than showing the most important parts. Showing the info you have in an unsorted blob is often less clear than having separate fields/fonts. (Read "less clear" as a synonym for "misleading".) Imagine if the URL bar showed the full set of HTTP headers instead. That's more information, and it's more accurate and less mangled than showing just the URL. But it's a much worse interface and harder to use securely.

danShumway 7y ago

I don't think it's deliberate undermining, I think it's more, "people complained that we were breaking standards, so we fixed it by changing the standard." The Chrome team is almost incapable of reversing course on their decisions. Even when they get massive pushback and enough negative press to effectively force them to reverse course, it's only ever temporary. "Widespread criticism over a decision? That just means people aren't ready yet, or they're too emotional to think clearly about our position. Give it a couple of months to a year, and they'll all have calmed down enough to realize we're right." "People are complaining about breaking standards? It's not that our decision was wrong, people are just upset we didn't check all the right boxes and fill out all the right forms before we made it. It's not real criticism, it's just people being legalistic about the standards process. Fine, we'll play that game." And then they wonder why people automatically assume the worst whenever Chrome devs propose something new.

skybrian 7y ago
There is a positive feedback cycle leading to polarization, and it works both ways. The more people assume the worst, the more likely they are to criticize with only a cursory understanding what's going on, and the more that justified criticism gets lost in the noise, leading to further communication breakdown as more people stop listening. In the worst case, certain things become "common knowledge" that nobody bothers checking anymore. Breaking that cycle requires putting effort into understanding both sides and going beyond quick comments.
- danShumway 7y ago
  Breaking the cycle can't be done by only one side. If good maintainers aren't put in contact with good critiques, then they'll eventually assume every take on their work is purely reactionary. But in the same way, if good critics who take the time to write detailed critiques aren't listened to, then they'll eventually get tired and stop engaging. One side can't put in all of the work, or we'll end up in the same exact situation within another year. I've seen the conversation around Chrome degrade dramatically even over the past year or two. Back when Chrome accidentally broke web audio, the community was putting a lot of time into brainstorming possible solutions. You had authors behind some of the biggest games and platforms on the web trying to be constructive. More recently with the V3 manifest, actual adblock developers from the most popular extensions on the store have weighed in, written performance tests, and shared thoughts. But they've been less willing to go out of their way to assume the best of the Chrome team than game developers were in 2018. There's a very visible degradation of trust, and an assumption that there's no point in engaging constructively with Google because Google just does not respond to criticism. Back in 2018, I myself wrote up a massive blog post[0] going over the problems with Google's Web Audio changes. I was careful to assume the best of maintainers, that they really did have the best interest of the web in mind, and that they really were trying to make something great. However, I pointed out: > These mistakes create a narrative undercurrent that will undermine Google's future efforts to get developers to trust them when they're forced to make difficult decisions... Given enough examples of Google dismissing concerns about its pet projects, the public will simply stop believing that the company cares. So now in 2019, I'm not going to write a massive blog post going into extensive detail about why obfuscating URLs is a bad idea, because I've fallen victim to the same thought pattern I warned about above. I don't believe that Google cares, and I have better uses of my time. Why should I waste my time writing this stuff, when I know it's not going to make a difference, and when I know Google is just going to do whatever they want anyway? Why should someone like Gorhill waste their time building detailed breakdowns of an extension API, if there's no chance of getting that API decision reversed? None of this just arbitrarily happened -- even two or three years ago, developers used to engage with the Chrome team with a lot more patience and a lot more good faith. There are still a lot of members of the community that aren't polarized, they're just tired. And if there was any evidence that Chrome developers were willing to listen to people like Gorhill or Ashley, those people would still be willing to step up. [0]: https://danshumway.com/blog/chrome-autoplay/ https://danshumway.com/blog/chrome-autoplay/

josteink 7y ago

> security-sensitive surfaces like the omnibox. Yes. It’s security sensitive. Any incorrect or misleading information placed here can trick a user proceeding with actions they otherwise would not. So we should let the URL-bar present the unmangled URL and nothing else.

UncleMeat 7y ago
The "security sensitive" information in the URL bar is horrible. For TLS you need to look for the presence of a single character. For most people, "http://" http://" and "https://" https://" are both gibberish and remembering which one is good is not obvious. For domain names you now need to look past all of the subdomains since mybank.evil.com isn't safe. But don't look all the way to the right since that is usually full of gibberish and everything after the "/" isn't trustworthy either. Oh and watch out for homoglyphs too. URLs suck for security. Also I bet you are upset that port numbers aren't included in the displayed URL too.
Dylan16807 7y ago
You need to justify that "So". Showing all the info you have is often less clear than showing the most important parts. Showing the info you have in an unsorted blob is often less clear than having separate fields/fonts. (Read "less clear" as a synonym for "misleading".) Imagine if the URL bar showed the full set of HTTP headers instead. That's more information, and it's more accurate and less mangled than showing just the URL. But it's a much worse interface and harder to use securely.