3 ms·
That "standard" is an abomination. What's next, we 'll upload our SSL certs to google so they can masquerade more efficiently? IETF should not back standards in
by buboard 7y ago
That "standard" is an abomination. What's next, we 'll upload our SSL certs to google so they can masquerade more efficiently? IETF should not back standards introduced by and benefiting only google.
> Prerendering does not have any security issues.
Currently. Are you saying it is impossible that someone will hide a hack in an amp page that steals data or sth without the user ever visiting that amp page?
> AMP guarantees that all resources in preload are served by the AMP cache,
What about privacy? are user data sent through google's servers?
> Javascript based analytics works fine, with support for all major vendors and custom setups.
How do those analytics handle prerendering?
- gregable 7y agoAMP documents are delivered with a Content-Security-Policy which instructs the browser not to load javascript resources outside the AMP origin, including inline scripts. The AMP Cache ensures no remote images or other remote resources can be loaded in preload. When using signed exchanges, the preload does not even parse the document until navigation, as per the signed exchange spec. Analytics loading is deferred until after user navigation, which makes sense as the user has yet to navigate to the document. The AMP Cache serves publicly cached HTML documents, and the static fonts/images within those documents. If a document wants to render user specific data, it can load that directly from the publisher's origin upon navigation (not routed via the AMP Cache). See, for example https://amp.dev/documentation/components/amp-list/ https://amp.dev/documentation/components/amp-list/. Analytics, ads, etc are all fetched directly from the vendor or publisher origin and the AMP Cache will neither proxy nor otherwise see this data.