5 ms·

Because its cover to allow them to subsume content and serve it solely from google.com, and deny the originating page any traffic or recognition, or swap it out

by throwaway2048 6y ago

Because its cover to allow them to subsume content and serve it solely from google.com, and deny the originating page any traffic or recognition, or swap it out transparently when they feel like it. This is literally already happening with the info sidebar, the reason signed exchanges matter is so they can throw up the smokescreen about how its cryptographically verified to come from the original page, so why are people upset. Any site that objects and refuses to implement this stuff will just disappear from the first page which is reserved only for Accelerated By Google sites. (Which is already happening for AMP links on mobile searches).

Kalium 6y ago
As I understood signed exchanges, a correct implementation makes it impossible for the intermediary to inject, alter, replace, or otherwise swap out any part of the page without failing verification. This would mean the original server gets to do all the branding and get all the recognition and integrity in transit that its controllers might wish. I've clearly missed something. Can you help me?
- throwaway2048 6y ago
  AMP already heavily restricts what the original page is allowed to put inside, including things like ads, javascript and branding. You can be certain anything google implements around this proposal will have similar very tight restrictions.
  - Kalium 6y ago
    That's definitely a scary thought! Can you share any details of what must be public plans to strip everything non-Google of branding? Surely there must be something out there beyond the IETF docs for the protocol, where I don't see any evil plans to Googlify everything in. If anything, it looks like a design intended to allow relaxing the restrictions imposed by AMP. Perhaps I need to read them more closely.
    - throwaway2048 6y ago
      If you want an honest discussion try toning down the smarmy bullshit.
      - Kalium 6y ago
        I was trying to be nice. I'll stop now. Got any material to back up your rather substantial claims? Right now you're coming across as wildly paranoid and offering absolutely nothing in support but more of the same. Someone else's personal incredulity is, IMO, not a great form of evidence.
        wizzwizz4 6y ago
        Your priors are terrible. Extrapolation from past experience is a perfectly valid form of reasoning: it's called “induction”, and most people consider it a valid form of reasoning. https://en.wikipedia.org/wiki/Inductive_reasoning https://en.wikipedia.org/wiki/Inductive_reasoning Or, to mirror your tone: Being paranoid does sound like an issue! However, just because other people's personal incredulity hasn't been a great form of evidence in the past, that doesn't mean it isn't a good form of evidence at the moment. Got any reason to believe it isn't?
        Kalium 6y ago
        I understand that a lot of people genuinely do not trust Google. It's been their experience, and thus their priors, that Google is attempting to assert control over all aspects of the web. Perhaps someone can find some evidence that allows for deductive reasoning on this subject. I would really like it. Otherwise, all we've got is competing lines of perfectly valid incompatible inductive reasoning. Then people choose the one they like or fear the most. That's a scenario that my priors suggest is not likely to be useful for producing valuable models of the future. Instead, it's a scenario where the primary outcome I expect is for confirmation biases to rule the day.
        wizzwizz4 6y ago
- lightswitch05 6y ago
  Yes, as you say, Integrity is preserved. However, Confidentiality is also another important aspect of Information Security. Making a 3rd party appear as a 1st party, is a privacy and confidentiality violation, which is why I do not like AMP and signed exchanges.
  - Kalium 6y ago
    Yeah, as near as I can tell signed exchanges are essentially a caching proxy. With integrity checks, so that you don't have to trust the proxy all that much and its agency is much reduced. I'm reminded of apt. The calculation appears to be that given the chance, some website controllers will choose to trade confidentiality of public pages for better load times. In business terms, this seems a pretty straightfoward win in many cases, so I can see why some would sign up.
    - DevKoala 6y ago
      The publishers are not mentioning to the visitor they are adding one more third party looking at your data; one that maintains an ad exchange and will be an intermediary on every resource request. A publisher is free to switch to AMP, but choice needs to be given to the user to agree or leave the site the same way it happens with cookies. I wouldn’t opt in and now I cannot block Google tracking at the DNS level thanks to this.
      - Kalium 6y ago
        Publishers can, and should, always make visitors aware of how many third parties are positioned to see all visitor data. We are, unfortunately, a long way from this being normal. Even as third parties doing things like running CDNs or doing TLS termination for other reasons has been pretty thoroughly normalized. Though offering it as a Firefox extension could be an interesting exercise. I think publishers view AMP as a question of their sovereignty and choice. Since it's their website that's being potentially served by Google, it's their choice to make. There's absolutely a lot of room to dispute if this is the morally correct stance, but I also think it's not wildly out of line with other questions publishers weigh in choosing what they serve and how.
joshuamorton 6y ago
> swap it out transparently > cryptographically verified to come from the original page Elaborate.
- throwaway2048 6y ago
  The page results will be a tightly restricted iframe-esque window inside of google results (This is what the Chome "Portals" proposal is about). There will be no obvious distinction between a search result and google's own website, even though the "portals" will be showing cryptographically signed content (which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says) If google swaps one result for another, 95% of users wont even notice.
  - joshuamorton 6y ago
    > If google swaps one result for another, 95% of users wont even notice. Right so exactly the same way the search results page works today? > The page results will be a tightly restricted iframe-esque window inside of google results This is completely independent of AMP. Portals work for non-AMP content too. > which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says So you're suggesting that Google will create a new, even more restricted than AMP protocol to be viewed on the search page?
    - searchableguy 6y ago
      Isn't that what those meta tags are for so google can quickly show scores, reviews and stuff?

Kalium 6y ago

As I understood signed exchanges, a correct implementation makes it impossible for the intermediary to inject, alter, replace, or otherwise swap out any part of the page without failing verification. This would mean the original server gets to do all the branding and get all the recognition and integrity in transit that its controllers might wish. I've clearly missed something. Can you help me?

throwaway2048 6y ago
AMP already heavily restricts what the original page is allowed to put inside, including things like ads, javascript and branding. You can be certain anything google implements around this proposal will have similar very tight restrictions.
- Kalium 6y ago
  That's definitely a scary thought! Can you share any details of what must be public plans to strip everything non-Google of branding? Surely there must be something out there beyond the IETF docs for the protocol, where I don't see any evil plans to Googlify everything in. If anything, it looks like a design intended to allow relaxing the restrictions imposed by AMP. Perhaps I need to read them more closely.
  - throwaway2048 6y ago
    If you want an honest discussion try toning down the smarmy bullshit.
    - Kalium 6y ago
      I was trying to be nice. I'll stop now. Got any material to back up your rather substantial claims? Right now you're coming across as wildly paranoid and offering absolutely nothing in support but more of the same. Someone else's personal incredulity is, IMO, not a great form of evidence.
      - wizzwizz4 6y ago
        Your priors are terrible. Extrapolation from past experience is a perfectly valid form of reasoning: it's called “induction”, and most people consider it a valid form of reasoning. https://en.wikipedia.org/wiki/Inductive_reasoning https://en.wikipedia.org/wiki/Inductive_reasoning Or, to mirror your tone: Being paranoid does sound like an issue! However, just because other people's personal incredulity hasn't been a great form of evidence in the past, that doesn't mean it isn't a good form of evidence at the moment. Got any reason to believe it isn't?
        Kalium 6y ago
        I understand that a lot of people genuinely do not trust Google. It's been their experience, and thus their priors, that Google is attempting to assert control over all aspects of the web. Perhaps someone can find some evidence that allows for deductive reasoning on this subject. I would really like it. Otherwise, all we've got is competing lines of perfectly valid incompatible inductive reasoning. Then people choose the one they like or fear the most. That's a scenario that my priors suggest is not likely to be useful for producing valuable models of the future. Instead, it's a scenario where the primary outcome I expect is for confirmation biases to rule the day.
        wizzwizz4 6y ago
lightswitch05 6y ago
Yes, as you say, Integrity is preserved. However, Confidentiality is also another important aspect of Information Security. Making a 3rd party appear as a 1st party, is a privacy and confidentiality violation, which is why I do not like AMP and signed exchanges.
- Kalium 6y ago
  Yeah, as near as I can tell signed exchanges are essentially a caching proxy. With integrity checks, so that you don't have to trust the proxy all that much and its agency is much reduced. I'm reminded of apt. The calculation appears to be that given the chance, some website controllers will choose to trade confidentiality of public pages for better load times. In business terms, this seems a pretty straightfoward win in many cases, so I can see why some would sign up.
  - DevKoala 6y ago
    The publishers are not mentioning to the visitor they are adding one more third party looking at your data; one that maintains an ad exchange and will be an intermediary on every resource request. A publisher is free to switch to AMP, but choice needs to be given to the user to agree or leave the site the same way it happens with cookies. I wouldn’t opt in and now I cannot block Google tracking at the DNS level thanks to this.
    - Kalium 6y ago
      Publishers can, and should, always make visitors aware of how many third parties are positioned to see all visitor data. We are, unfortunately, a long way from this being normal. Even as third parties doing things like running CDNs or doing TLS termination for other reasons has been pretty thoroughly normalized. Though offering it as a Firefox extension could be an interesting exercise. I think publishers view AMP as a question of their sovereignty and choice. Since it's their website that's being potentially served by Google, it's their choice to make. There's absolutely a lot of room to dispute if this is the morally correct stance, but I also think it's not wildly out of line with other questions publishers weigh in choosing what they serve and how.

joshuamorton 6y ago

> swap it out transparently > cryptographically verified to come from the original page Elaborate.

throwaway2048 6y ago
The page results will be a tightly restricted iframe-esque window inside of google results (This is what the Chome "Portals" proposal is about). There will be no obvious distinction between a search result and google's own website, even though the "portals" will be showing cryptographically signed content (which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says) If google swaps one result for another, 95% of users wont even notice.
- joshuamorton 6y ago
  > If google swaps one result for another, 95% of users wont even notice. Right so exactly the same way the search results page works today? > The page results will be a tightly restricted iframe-esque window inside of google results This is completely independent of AMP. Portals work for non-AMP content too. > which will almost certainly be in a super restricted AMP-esque format that denies sites much control besides what the text says So you're suggesting that Google will create a new, even more restricted than AMP protocol to be viewed on the search page?
  - searchableguy 6y ago
    Isn't that what those meta tags are for so google can quickly show scores, reviews and stuff?