4 ms·

I think the correct term I was looking for is prefetching. That's a secure way to tell the browser to start loading search result links in the background.

joshuamorton 7y ago
> That's a secure way to tell the browser to start loading search result links in the background prefetching isn't private cross origin: > Along with the referral and URL-following implications already mentioned above, prefetching will generally cause the cookies of the prefetched site to be accessed.[1] IDK about you, but I'd generally prefer that my cookies and IP not be exposed to all of the links that happen to be in the first page of search results. [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefe...
- dessant 7y ago
  Browser specs can be improved, and new ones introduced. And even if safe prefetching is deemed technically impossible, the question remains: should we give Google and a handful of other companies disproportionate control over how we publish and consume content, for 50ms of load time?
  - joshuamorton 7y ago
    > Browser specs can be improved, and new ones introduced. Yes, for example Signed Exchanges, which on a technical level solves all of the problems of rel=prefetch (and a number of the problems with AMP, like link pasting and copying). > Should we allow a handful of companies to be pinged every time we load a page on the web I'm hopelessly confused here: you're only going to "ping" one of the handful of companies if you were referred by that company. (In a world with signed exchanges) You're not going to come across an AMP-cache link organically. You'll navigate to example.com directly, without anyone except example.com (and your DNS provider) knowing. The cache provider will only know if you navigate to the cached site via the cache provider. Concretely, you don't go to the Google amp-cache unless you're navigating there directly from Google's search results. Same for Microsoft/Bing. So if your metric is > Should we allow a handful of companies to be pinged every time we load a page on the web Then yes, absolutely, because nothing changes! Edit: To address your other question, > should we give Google and a handful of other companies disproportionate control over how we publish and consume content, for 50ms of load time? Alright: how is AMP materially different from <whatever other algorithmic choices rated search results before>? You seem to be claiming that AMP is harmful to someone but who? It's not harmful to competitors or to end users, and its only harmful to developers if you make the most strained argument. My premises here are that users actually prefer AMP results. You may not, but my understanding is that most users do. So from the perspective of an end user browsing the internet, AMP leads to an improved experience. So it's good for users. No one has yet been able to explain to me how its actually harmful to a web developer who now has an incentive to make AMP-compatible sites. Like sure, you now have to work with a framework you may not like, but that's not a compelling argument when people are claiming that AMP is a threat to the sanctity of the internet. So it's not like bad for web developers, it's just sort of a lateral move. That leaves competitors to the giants. But AMP is an open standard, and DDG could, if they wished, implement an AMP cache themselves today and it would just work. And they'd, if anything, benefit from the bigger players pushing that ecosystem. There's the potential for abuse via the caches.json registry, but the AMP project is aware of this and notes that the registry could be decentralized using Subresource Integrity or similar, if such a standard was adopted[1]. So again: I'm confused by how exactly it's bad, beyond the "I am forced to develop in a way I don't want to if I want to appear near the top of the search page", which isn't new. [1]: https://github.com/ampproject/amphtml/pull/18495/commits/c5d714268f0f736a0855bd443bc5d2aaba2ad857 https://github.com/ampproject/amphtml/pull/18495/commits/c5d...
    - dessant 7y ago
      I've actually removed that second question before I noticed your answer, because I knew you would then skip over the first one. Feel free to address the main point I was making in all my posts in this thread, whenever you feel ready. > So if your metric is Google being pinged obviously isn't my main metric, as you can see from all my posts in our discussion. My main concern is that publishers will be forced to use specific publishing mechanisms (AMP, Signed Exchanges) to appear at the top of Google Search results. That loss of control puts publishers in a vulnerable position, and hurts innovation across the web. > Then yes, absolutely, because nothing changes! Everything changes. Google's influence and control won't end at the moment the user navigates away to a top result on Google Search.
      - joshuamorton 7y ago
        I updated the prior post, but to be a bit more concrete, what differentiates AMP signed exchanges from, say, HTTPS?
        jhasse 7y ago
        Google could serve an older version without the user knowing.
        joshuamorton 7y ago
        The signed exchanges protocol requires that the content be signed with a key with a short expiry date (< 1 week), sites are free to make it shorter. In extreme cases, the providing site could sign with an expiry of < 1 day or even something like 1 hour. And iiuc, sites are still free to revoke their certs. So this is actually probably more secure compared to something like https in that regard. [0]: https://github.com/WICG/webpackage/blob/6cc3237b36c2f9ce75343d1ad39d7f138f07c87f/draft-yasskin-http-origin-signed-responses.md https://github.com/WICG/webpackage/blob/6cc3237b36c2f9ce7534...

joshuamorton 7y ago

> That's a secure way to tell the browser to start loading search result links in the background prefetching isn't private cross origin: > Along with the referral and URL-following implications already mentioned above, prefetching will generally cause the cookies of the prefetched site to be accessed.[1] IDK about you, but I'd generally prefer that my cookies and IP not be exposed to all of the links that happen to be in the first page of search results. [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefe...

dessant 7y ago
Browser specs can be improved, and new ones introduced. And even if safe prefetching is deemed technically impossible, the question remains: should we give Google and a handful of other companies disproportionate control over how we publish and consume content, for 50ms of load time?
- joshuamorton 7y ago
  > Browser specs can be improved, and new ones introduced. Yes, for example Signed Exchanges, which on a technical level solves all of the problems of rel=prefetch (and a number of the problems with AMP, like link pasting and copying). > Should we allow a handful of companies to be pinged every time we load a page on the web I'm hopelessly confused here: you're only going to "ping" one of the handful of companies if you were referred by that company. (In a world with signed exchanges) You're not going to come across an AMP-cache link organically. You'll navigate to example.com directly, without anyone except example.com (and your DNS provider) knowing. The cache provider will only know if you navigate to the cached site via the cache provider. Concretely, you don't go to the Google amp-cache unless you're navigating there directly from Google's search results. Same for Microsoft/Bing. So if your metric is > Should we allow a handful of companies to be pinged every time we load a page on the web Then yes, absolutely, because nothing changes! Edit: To address your other question, > should we give Google and a handful of other companies disproportionate control over how we publish and consume content, for 50ms of load time? Alright: how is AMP materially different from <whatever other algorithmic choices rated search results before>? You seem to be claiming that AMP is harmful to someone but who? It's not harmful to competitors or to end users, and its only harmful to developers if you make the most strained argument. My premises here are that users actually prefer AMP results. You may not, but my understanding is that most users do. So from the perspective of an end user browsing the internet, AMP leads to an improved experience. So it's good for users. No one has yet been able to explain to me how its actually harmful to a web developer who now has an incentive to make AMP-compatible sites. Like sure, you now have to work with a framework you may not like, but that's not a compelling argument when people are claiming that AMP is a threat to the sanctity of the internet. So it's not like bad for web developers, it's just sort of a lateral move. That leaves competitors to the giants. But AMP is an open standard, and DDG could, if they wished, implement an AMP cache themselves today and it would just work. And they'd, if anything, benefit from the bigger players pushing that ecosystem. There's the potential for abuse via the caches.json registry, but the AMP project is aware of this and notes that the registry could be decentralized using Subresource Integrity or similar, if such a standard was adopted[1]. So again: I'm confused by how exactly it's bad, beyond the "I am forced to develop in a way I don't want to if I want to appear near the top of the search page", which isn't new. [1]: https://github.com/ampproject/amphtml/pull/18495/commits/c5d714268f0f736a0855bd443bc5d2aaba2ad857 https://github.com/ampproject/amphtml/pull/18495/commits/c5d...
  - dessant 7y ago
    I've actually removed that second question before I noticed your answer, because I knew you would then skip over the first one. Feel free to address the main point I was making in all my posts in this thread, whenever you feel ready. > So if your metric is Google being pinged obviously isn't my main metric, as you can see from all my posts in our discussion. My main concern is that publishers will be forced to use specific publishing mechanisms (AMP, Signed Exchanges) to appear at the top of Google Search results. That loss of control puts publishers in a vulnerable position, and hurts innovation across the web. > Then yes, absolutely, because nothing changes! Everything changes. Google's influence and control won't end at the moment the user navigates away to a top result on Google Search.
    - joshuamorton 7y ago
      I updated the prior post, but to be a bit more concrete, what differentiates AMP signed exchanges from, say, HTTPS?
      - jhasse 7y ago
        Google could serve an older version without the user knowing.
        joshuamorton 7y ago
        The signed exchanges protocol requires that the content be signed with a key with a short expiry date (< 1 week), sites are free to make it shorter. In extreme cases, the providing site could sign with an expiry of < 1 day or even something like 1 hour. And iiuc, sites are still free to revoke their certs. So this is actually probably more secure compared to something like https in that regard. [0]: https://github.com/WICG/webpackage/blob/6cc3237b36c2f9ce75343d1ad39d7f138f07c87f/draft-yasskin-http-origin-signed-responses.md https://github.com/WICG/webpackage/blob/6cc3237b36c2f9ce7534...