13 ms·

> I'm really concerned about Chrome's 'signed exchanges' where they can fake the URL completely. They're not faking the URL; a signed exchange contains data th

> I'm really concerned about Chrome's 'signed exchanges' where they can fake the URL completely. They're not faking the URL; a signed exchange contains data that can only have come from the original site. It's a secure way of handling caching/CDNs/etc, and it'll be a net improvement for security that allows sites to put less trust in third-party servers and scripts.

throwaway2048 6y ago
Its deeply misleading to pretend stuff like signed exchanges and portals are purely about content distribution and security, and not control over said content being shifted to Google, and away from authors and other sites. Its a similar vein to how many of the objections to AMP were being white-washed with "its open source, if you have a problem with it why aren't you submitting a pull request??"
- joshuamorton 6y ago
  I'll bite: how does signed exchanges provide control to Google?
  - throwaway2048 6y ago
    Because its cover to allow them to subsume content and serve it solely from google.com, and deny the originating page any traffic or recognition, or swap it out transparently when they feel like it. This is literally already happening with the info sidebar, the reason signed exchanges matter is so they can throw up the smokescreen about how its cryptographically verified to come from the original page, so why are people upset. Any site that objects and refuses to implement this stuff will just disappear from the first page which is reserved only for Accelerated By Google sites. (Which is already happening for AMP links on mobile searches).
    - Kalium 6y ago
      As I understood signed exchanges, a correct implementation makes it impossible for the intermediary to inject, alter, replace, or otherwise swap out any part of the page without failing verification. This would mean the original server gets to do all the branding and get all the recognition and integrity in transit that its controllers might wish. I've clearly missed something. Can you help me?
      - throwaway2048 6y ago
        AMP already heavily restricts what the original page is allowed to put inside, including things like ads, javascript and branding. You can be certain anything google implements around this proposal will have similar very tight restrictions.
        Kalium 6y ago
        That's definitely a scary thought! Can you share any details of what must be public plans to strip everything non-Google of branding? Surely there must be something out there beyond the IETF docs for the protocol, where I don't see any evil plans to Googlify everything in. If anything, it looks like a design intended to allow relaxing the restrictions imposed by AMP. Perhaps I need to read them more closely.
        throwaway2048 6y ago
        If you want an honest discussion try toning down the smarmy bullshit.
        Kalium 6y ago
        I was trying to be nice. I'll stop now. Got any material to back up your rather substantial claims? Right now you're coming across as wildly paranoid and offering absolutely nothing in support but more of the same. Someone else's personal incredulity is, IMO, not a great form of evidence.
        6y ago
    - joshuamorton 6y ago
      > swap it out transparently > cryptographically verified to come from the original page Elaborate.
      - throwaway2048 6y ago
        The page results will be a tightly restricted iframe-esque window inside of google results (This is what the Chome "Portals" proposal is about). There will be no obvious distinction between a search result and google's own website, even though the "portals" will be showing cryptographically signed content (which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says) If google swaps one result for another, 95% of users wont even notice.
        joshuamorton 6y ago
        > If google swaps one result for another, 95% of users wont even notice. Right so exactly the same way the search results page works today? > The page results will be a tightly restricted iframe-esque window inside of google results This is completely independent of AMP. Portals work for non-AMP content too. > which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says So you're suggesting that Google will create a new, even more restricted than AMP protocol to be viewed on the search page?
        searchableguy 6y ago
        Isn't that what those meta tags are for so google can quickly show scores, reviews and stuff?
  - rgrs 6y ago
    Does it behave different in different countries? Will Google allow for example, Taiwan content in mainland China? Is it like VPN/Proxy or has more knobs?
    - joshuamorton 6y ago
      > Will Google allow for example, Taiwan content in mainland China? Google doesn't run in mainland china, so this is a bit of a strange question. But let's assume that Google did. How would AMP or signed exchanges change the accessibility of Taiwan related content on Google in mainland china? Are you saying that the current Google results page would show Taiwan related content, but signed exchanges wouldn't, or what? > Is it like VPN/Proxy or has more knobs? Neither. It's literally a way to say "a site had this html, css, and js, and cryptographically signed the blob so that we can re-host it and you can be certain that the person re-hosting hasn't modified it in any way."
      - rgrs 6y ago
        > Are you saying that the current Google results page would show Taiwan related content, but signed exchanges wouldn't, or what? My question is will signed exchanges serve content but where google search results are censored.
  - tyingq 6y ago
    Google can choose today which site (original or AMP cache) to show in their search results. Today, as an end user, I know, via the URL, when I land on a Google AMP site. That said, Google already has control of every AMP page because the spec REQUIRES you to load a piece of Google controlled/hosted JS onto your page. That JS can change at any time without "signed exchanges" being aware.
    - joshuamorton 6y ago
      > Google can choose today which site (original or AMP cache) to show in their search results. Today, as an end user, I know, via the URL, when I land on a Google AMP site. Ok why is this an issue? Note that HN is a bad place for this kind of socratic method discussion, we'll both quickly run out of the ability to post replies. Assume I'm someone who doesn't share whatever values you share about the purity of the url bar or whatever. Why is you being unable to know whether or not the content came from Google's IP or mysite's IP relevant to anyone as long as it's the same content (which signed exchanges ensure)?
      - wizzwizz4 6y ago
        Centralised collection of metadata, without the users having any way of knowing it's going on.
      - tyingq 6y ago
        Combined with that second thing I mentioned (required Google hosted JS), it is total control by Google with no straightforward way for me to detect it, block it or go around it, as I can today.
        joshuamorton 6y ago
        So if I understand correctly, your threat model is "Google will inject unwanted JS into a JS blob they host (like the amp.js from Google's CDN) and this will do nefarious (for some definition of nefarious) things to me without me knowing." How is this different than today, where many sites use js from google, either as a cdn or part of the ads infrastructure? I guess you can block some of those, but blocking the jquery provided by google's CDN isn't going to work too well. (And further, what kind of nefarious thing do you fear Google will do? How likely is it that they will do so, in your opinion?)
  - deleted 6y ago
    [deleted]
calcifer 6y ago
> a net improvement for security that allows sites to put less trust in third-party servers and scripts. Third parties like Google, right?
- gregable 6y ago
  Yes. Signed Exchanges mean the publisher signs the content using their private key. A third party can provide delivery like a CDN, but they cannot modify the content, or the signature would no longer match. The useragent (browser) enforces this. This gives the secure control of the content back to the publisher, unlike the trust model of CDNs or the AMP Cache.
  - calcifer 6y ago
    > The useragent (browser) enforces this. This assumes the user agent is actually an agent of the user, and not the AMP provider, which is demonstrably [1] not the case. [1] https://github.com/w3ctag/design-reviews/issues/467#issuecomment-581944600 https://github.com/w3ctag/design-reviews/issues/467#issuecom...
    - gregable 6y ago
      Chrome does enforce the matching signature. Browsers without Signed Exchange support will not likely ever get a signed exchange as they do not advertise support for it in the `Accept` request header.
      - freeone3000 6y ago
        Chrome enforces that the signature being served by google is the same signature as the one being served by google. It's a useless verification. If Google were so inclined, they could very well just change the <link> tag too.
      - gregable 6y ago
        @freeone3000, that's incorrect, in the case of Signed Exchanges. Chrome will verify the document's signature against the publisher's public certificate. This will be `nytimes.com` for example. It is not using Google's certificate for this verification, and Google does not possess the private key required to modify the content and update the signature.
monadic2 6y ago
This is changing the semantics of fetching a URL to be agnostic how it gets resolved. That’s disturbing and downright deceitful to the end user. Fifteen years ago, if you asked me how google search would look, I would have responded “mostly the same, maybe they’ll have cool features like asking me which meaning of ‘converse’ i wanted: the shoe brand or the logical relation.” Instead, they’ve only subtracted functionality from the query engine (no more domain blocking), discouraged you from clicking through to sites by automatically scraping and rehosting them as “semantic” results, and now they’re trying to actively acquire 100% of the outbound traffic. Fuck google.
- madeofpalk 6y ago
  I don't think its deceitful - end-to-end, the site you're displaying was loaded somehow from domaina.com and it'll show domaina.com in the address bar.
  - Aeolun 6y ago
    But it’s not loaded from their servers when I request it. So it shouldn’t show as such in the address bar. It blows my mind that anyone thinks that’s an acceptable idea.
    - madeofpalk 6y ago
      If a site is cached locally, it isn’t loaded from ‘their’ servers when you request it. Or maybe it’ll come from a CDN rather than origin. What’s shown in the URL bar has long been divorced from the HTTP request(s) that are made. > It blows my mind that anyone thinks that’s an acceptable idea It blows your mind that different people have difference opinions and values than you?
      - kempbellt 6y ago
        What is stored in your cache was loaded from their servers when you originally visited. Also, you can clear your cache at any time you choose to re-fetch the original content from the provider. Also, a provider uses a CDN at their discretion. Giving them the ability to invalidate or update cached records at times of their choosing. Or remove the CDN entirely if they choose to. This is Google using their weight to be anti-competitive and fall further down the anti-trust rabbit hole.
fomine3 6y ago
Agreed. SXG is better than AMP for providing permalink.

throwaway2048 6y ago

Its deeply misleading to pretend stuff like signed exchanges and portals are purely about content distribution and security, and not control over said content being shifted to Google, and away from authors and other sites. Its a similar vein to how many of the objections to AMP were being white-washed with "its open source, if you have a problem with it why aren't you submitting a pull request??"

joshuamorton 6y ago
I'll bite: how does signed exchanges provide control to Google?
- throwaway2048 6y ago
  Because its cover to allow them to subsume content and serve it solely from google.com, and deny the originating page any traffic or recognition, or swap it out transparently when they feel like it. This is literally already happening with the info sidebar, the reason signed exchanges matter is so they can throw up the smokescreen about how its cryptographically verified to come from the original page, so why are people upset. Any site that objects and refuses to implement this stuff will just disappear from the first page which is reserved only for Accelerated By Google sites. (Which is already happening for AMP links on mobile searches).
  - Kalium 6y ago
    As I understood signed exchanges, a correct implementation makes it impossible for the intermediary to inject, alter, replace, or otherwise swap out any part of the page without failing verification. This would mean the original server gets to do all the branding and get all the recognition and integrity in transit that its controllers might wish. I've clearly missed something. Can you help me?
    - throwaway2048 6y ago
      AMP already heavily restricts what the original page is allowed to put inside, including things like ads, javascript and branding. You can be certain anything google implements around this proposal will have similar very tight restrictions.
      - Kalium 6y ago
        That's definitely a scary thought! Can you share any details of what must be public plans to strip everything non-Google of branding? Surely there must be something out there beyond the IETF docs for the protocol, where I don't see any evil plans to Googlify everything in. If anything, it looks like a design intended to allow relaxing the restrictions imposed by AMP. Perhaps I need to read them more closely.
        throwaway2048 6y ago
        If you want an honest discussion try toning down the smarmy bullshit.
        Kalium 6y ago
        I was trying to be nice. I'll stop now. Got any material to back up your rather substantial claims? Right now you're coming across as wildly paranoid and offering absolutely nothing in support but more of the same. Someone else's personal incredulity is, IMO, not a great form of evidence.
        6y ago
  - joshuamorton 6y ago
    > swap it out transparently > cryptographically verified to come from the original page Elaborate.
    - throwaway2048 6y ago
      The page results will be a tightly restricted iframe-esque window inside of google results (This is what the Chome "Portals" proposal is about). There will be no obvious distinction between a search result and google's own website, even though the "portals" will be showing cryptographically signed content (which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says) If google swaps one result for another, 95% of users wont even notice.
      - joshuamorton 6y ago
        > If google swaps one result for another, 95% of users wont even notice. Right so exactly the same way the search results page works today? > The page results will be a tightly restricted iframe-esque window inside of google results This is completely independent of AMP. Portals work for non-AMP content too. > which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says So you're suggesting that Google will create a new, even more restricted than AMP protocol to be viewed on the search page?
        searchableguy 6y ago
        Isn't that what those meta tags are for so google can quickly show scores, reviews and stuff?
- rgrs 6y ago
  Does it behave different in different countries? Will Google allow for example, Taiwan content in mainland China? Is it like VPN/Proxy or has more knobs?
  - joshuamorton 6y ago
    > Will Google allow for example, Taiwan content in mainland China? Google doesn't run in mainland china, so this is a bit of a strange question. But let's assume that Google did. How would AMP or signed exchanges change the accessibility of Taiwan related content on Google in mainland china? Are you saying that the current Google results page would show Taiwan related content, but signed exchanges wouldn't, or what? > Is it like VPN/Proxy or has more knobs? Neither. It's literally a way to say "a site had this html, css, and js, and cryptographically signed the blob so that we can re-host it and you can be certain that the person re-hosting hasn't modified it in any way."
    - rgrs 6y ago
      > Are you saying that the current Google results page would show Taiwan related content, but signed exchanges wouldn't, or what? My question is will signed exchanges serve content but where google search results are censored.
- tyingq 6y ago
  Google can choose today which site (original or AMP cache) to show in their search results. Today, as an end user, I know, via the URL, when I land on a Google AMP site. That said, Google already has control of every AMP page because the spec REQUIRES you to load a piece of Google controlled/hosted JS onto your page. That JS can change at any time without "signed exchanges" being aware.
  - joshuamorton 6y ago
    > Google can choose today which site (original or AMP cache) to show in their search results. Today, as an end user, I know, via the URL, when I land on a Google AMP site. Ok why is this an issue? Note that HN is a bad place for this kind of socratic method discussion, we'll both quickly run out of the ability to post replies. Assume I'm someone who doesn't share whatever values you share about the purity of the url bar or whatever. Why is you being unable to know whether or not the content came from Google's IP or mysite's IP relevant to anyone as long as it's the same content (which signed exchanges ensure)?
    - wizzwizz4 6y ago
      Centralised collection of metadata, without the users having any way of knowing it's going on.
    - tyingq 6y ago
      Combined with that second thing I mentioned (required Google hosted JS), it is total control by Google with no straightforward way for me to detect it, block it or go around it, as I can today.
      - joshuamorton 6y ago
        So if I understand correctly, your threat model is "Google will inject unwanted JS into a JS blob they host (like the amp.js from Google's CDN) and this will do nefarious (for some definition of nefarious) things to me without me knowing." How is this different than today, where many sites use js from google, either as a cdn or part of the ads infrastructure? I guess you can block some of those, but blocking the jquery provided by google's CDN isn't going to work too well. (And further, what kind of nefarious thing do you fear Google will do? How likely is it that they will do so, in your opinion?)
- deleted 6y ago
  [deleted]

calcifer 6y ago

> a net improvement for security that allows sites to put less trust in third-party servers and scripts. Third parties like Google, right?

gregable 6y ago
Yes. Signed Exchanges mean the publisher signs the content using their private key. A third party can provide delivery like a CDN, but they cannot modify the content, or the signature would no longer match. The useragent (browser) enforces this. This gives the secure control of the content back to the publisher, unlike the trust model of CDNs or the AMP Cache.
- calcifer 6y ago
  > The useragent (browser) enforces this. This assumes the user agent is actually an agent of the user, and not the AMP provider, which is demonstrably [1] not the case. [1] https://github.com/w3ctag/design-reviews/issues/467#issuecomment-581944600 https://github.com/w3ctag/design-reviews/issues/467#issuecom...
  - gregable 6y ago
    Chrome does enforce the matching signature. Browsers without Signed Exchange support will not likely ever get a signed exchange as they do not advertise support for it in the `Accept` request header.
    - freeone3000 6y ago
      Chrome enforces that the signature being served by google is the same signature as the one being served by google. It's a useless verification. If Google were so inclined, they could very well just change the <link> tag too.
    - gregable 6y ago
      @freeone3000, that's incorrect, in the case of Signed Exchanges. Chrome will verify the document's signature against the publisher's public certificate. This will be `nytimes.com` for example. It is not using Google's certificate for this verification, and Google does not possess the private key required to modify the content and update the signature.

monadic2 6y ago

This is changing the semantics of fetching a URL to be agnostic how it gets resolved. That’s disturbing and downright deceitful to the end user. Fifteen years ago, if you asked me how google search would look, I would have responded “mostly the same, maybe they’ll have cool features like asking me which meaning of ‘converse’ i wanted: the shoe brand or the logical relation.” Instead, they’ve only subtracted functionality from the query engine (no more domain blocking), discouraged you from clicking through to sites by automatically scraping and rehosting them as “semantic” results, and now they’re trying to actively acquire 100% of the outbound traffic. Fuck google.

madeofpalk 6y ago
I don't think its deceitful - end-to-end, the site you're displaying was loaded somehow from domaina.com and it'll show domaina.com in the address bar.
- Aeolun 6y ago
  But it’s not loaded from their servers when I request it. So it shouldn’t show as such in the address bar. It blows my mind that anyone thinks that’s an acceptable idea.
  - madeofpalk 6y ago
    If a site is cached locally, it isn’t loaded from ‘their’ servers when you request it. Or maybe it’ll come from a CDN rather than origin. What’s shown in the URL bar has long been divorced from the HTTP request(s) that are made. > It blows my mind that anyone thinks that’s an acceptable idea It blows your mind that different people have difference opinions and values than you?
    - kempbellt 6y ago
      What is stored in your cache was loaded from their servers when you originally visited. Also, you can clear your cache at any time you choose to re-fetch the original content from the provider. Also, a provider uses a CDN at their discretion. Giving them the ability to invalidate or update cached records at times of their choosing. Or remove the CDN entirely if they choose to. This is Google using their weight to be anti-competitive and fall further down the anti-trust rabbit hole.

fomine3 6y ago

Agreed. SXG is better than AMP for providing permalink.