5 ms·

>A third party can provide delivery like a CDN, but they cannot modify the content, or the signature would no longer match. To make sure I understand, does thi

>A third party can provide delivery like a CDN, but they cannot modify the content, or the signature would no longer match. To make sure I understand, does this mean that in principle a third party other than Google can deliver the AMP pages? Is google working to facilitate that AMP hosting is open to everyone and calibrating their searches point to any and all alternative AMP hosters?

madeofpalk 6y ago
When you search for a term on Google.com, should that load request HTTP assets from multiple potentially-untrusted third parties?
- prepend 6y ago
  If that best matches my query, then yes.
  - lern_too_spel 6y ago
    If a result matches your query, you would like the publisher to know even if the user never clicks on the result? Reread GP's comment.
- glenstein 6y ago
  How is this reconciled with lern_to_spel's reply to my comment, where they claim this is already implemented and there already are such third parties? Are Google searches right now that use AMP exposing users to risks because they are currently requesting assets from potentially untrustworthy third parties?
lern_too_spel 6y ago
AMP hosting is already open to everyone, and multiple third parties other than Google deliver AMP pages.
- glenstein 6y ago
  Interesting. Are there examples I can search for right now? For instance, are there searches I could do for a news article, that will show an AMP for a CNN article that's on a non-google url? Do you have a ballpark estimate of what percentage of total amps are delivered by non Google domains? Also how would you reconcile your comment with that of madeofpalk who appears to be treating that possibility as a hypothetical idea that hasn't happened, and which would be unpraticable due to needing to trust third parties?
  - lern_too_spel 6y ago
    > an AMP for a CNN article that's on a non-google url? All AMP pages exist at non-Google URLs. They are just cached by the link aggregator (typically a search engine), so the link aggregator can prerender them without deanonymizing the user to the publisher until the user clicks the link. AMP served by CNN: https://amp.cnn.com/cnn/2020/05/27/world/france-shooting-saint-varen-intl/index.html https://amp.cnn.com/cnn/2020/05/27/world/france-shooting-sai... The same page served out of Bing's AMP cache: https://www.bing.com/amp/s/amp.cnn.com/cnn/2020/05/27/world/france-shooting-saint-varen-intl/index.html https://www.bing.com/amp/s/amp.cnn.com/cnn/2020/05/27/world/... > Do you have a ballpark estimate of what percentage of total amps are delivered by non Google domains? All of them (100%) are delivered by non-Google domains to Google, Bing, and other caches. > Also how would you reconcile your comment with that of madeofpalk who appears to be treating that possibility as a hypothetical idea that hasn't happened, and which would be unpraticable due to needing to trust third parties? madeofpalk's comment makes perfect sense if you understood what I wrote above. Why should CNN or Bing be told that you have searched for a particular news article on Google before you have clicked it? The page has to be served from the link aggregator the user is browsing to maintain the user's privacy when prerendering results.
    - glenstein 6y ago
      You appear to have reinterpreted my questions and translated them into terms that were different than I intended, so I guess I have to take care to go back to the start and restate my original question in a way that uses the appropriate magic words correctly. I don't intend to ask whether AMPs (hard to resist calling them 'AMP pages') exist somewhere on non Google servers. Obviously third party content that Google is presenting exists somewhere off Google. And obviously it has to be formatted in a way that's compatible with AMP, and it makes sense that that is going to be done off Google domains. I at least knew the gist of that already, and I regard the detour into that explanation to have been a non sequitur. The point is that Google presents AMPs and it serves it's cached version of them from Google servers, on a Google domain. The beginning, middle, and end of the experience of searching for finding and consuming that news never has to involve leaving a Google domain. It's not open in the sense of involving interaction between servers that aren't controlled by Google, until you make that extra click to go from a cached Google version of an AMP to the version that sits on the domain controlled by a third party, at which point going to the third party has been rendered optional and largely unnecessary from the point of view of the user. This next part is super important: the fact that I'm asking about openness and interoperability, or the lack thereof, in this sense doesn't mean that I'm failing understand the technical advantages with caching and optimization. I regard those as derails that don't wrestle with the issue of openness that's being raised. The point is that the connection between consumers of content who start on Google, and the third party content provider, increasingly depends on Google in a way that shifts nearly the entire experience of consuming content onto Google's infrastructure. >All of them (100%) are delivered by non-Google domains to Google, Bing, and other caches. This is the starkest example of a question not being answered but replaced with a different question. I asked 'what percentage of total amps are delivered by non Google domains' and you replied by answering a different question, what percent of non-Google amps were delivered TO Google and other caches, noting that it was 100%. Which of course it is, but that's because that's a tautology. By contrast, it is helpful to note that there are caches other than Google, like Bing and 'others', which, in contrast to much of the rest of your comment, I feel actually is a pertinent and fair response to the question I'm actually asking. But those aren't content providers, so unless Bing or Google are content creators that were delivering content to themselves, it's tautologically true that 100% of that is going to be delivered to them by third parties, which has absolutely nothing to do with openness. If I'm using magic words correctly, I guess what I want to ask is what percentage of AMP traffic to cached pages is served to users by Bing and others that aren't Google.
gregable 6y ago
I want to break down this question slightly. > Can a third-party other than Google deliver an AMP page? Yes. Examples: Bing runs their own AMP cache and also delivers AMP pages. LinkedIn and Twitter also link to AMP pages, but they don't currently run a cache. IIRC, Twitter links to the Google AMP cache and LinkedIn links directly to the AMP variant on the publisher origin. They could run an AMP Cache. Cloudflare ran one for some time, but shut theirs down recently. The AMP Project maintains a list of known AMP Caches here: https://github.com/ampproject/amphtml/blob/master/build-system/global-configs/caches.json https://github.com/ampproject/amphtml/blob/master/build-syst... And provides some guidelines for running one here: https://github.com/ampproject/amphtml/blob/master/spec/amp-cache-guidelines.md https://github.com/ampproject/amphtml/blob/master/spec/amp-c... It's non-trivial, but absolutely supported. > Can a third-party other than Google deliver a Signed-Exchange? Yes. Cloudflare generates them for their customers who opt-in via their "AMP Real URL" product. "Generates" in this context implies delivering them. To date, I'm unaware of any large scale implementation that is delivering Signed Exchanges for third-party origins other than the Google Cache though this may change. The tech stack absolutely supports this.

madeofpalk 6y ago

When you search for a term on Google.com, should that load request HTTP assets from multiple potentially-untrusted third parties?

prepend 6y ago
If that best matches my query, then yes.
- lern_too_spel 6y ago
  If a result matches your query, you would like the publisher to know even if the user never clicks on the result? Reread GP's comment.
glenstein 6y ago
How is this reconciled with lern_to_spel's reply to my comment, where they claim this is already implemented and there already are such third parties? Are Google searches right now that use AMP exposing users to risks because they are currently requesting assets from potentially untrustworthy third parties?

lern_too_spel 6y ago

AMP hosting is already open to everyone, and multiple third parties other than Google deliver AMP pages.

glenstein 6y ago
Interesting. Are there examples I can search for right now? For instance, are there searches I could do for a news article, that will show an AMP for a CNN article that's on a non-google url? Do you have a ballpark estimate of what percentage of total amps are delivered by non Google domains? Also how would you reconcile your comment with that of madeofpalk who appears to be treating that possibility as a hypothetical idea that hasn't happened, and which would be unpraticable due to needing to trust third parties?
- lern_too_spel 6y ago
  > an AMP for a CNN article that's on a non-google url? All AMP pages exist at non-Google URLs. They are just cached by the link aggregator (typically a search engine), so the link aggregator can prerender them without deanonymizing the user to the publisher until the user clicks the link. AMP served by CNN: https://amp.cnn.com/cnn/2020/05/27/world/france-shooting-saint-varen-intl/index.html https://amp.cnn.com/cnn/2020/05/27/world/france-shooting-sai... The same page served out of Bing's AMP cache: https://www.bing.com/amp/s/amp.cnn.com/cnn/2020/05/27/world/france-shooting-saint-varen-intl/index.html https://www.bing.com/amp/s/amp.cnn.com/cnn/2020/05/27/world/... > Do you have a ballpark estimate of what percentage of total amps are delivered by non Google domains? All of them (100%) are delivered by non-Google domains to Google, Bing, and other caches. > Also how would you reconcile your comment with that of madeofpalk who appears to be treating that possibility as a hypothetical idea that hasn't happened, and which would be unpraticable due to needing to trust third parties? madeofpalk's comment makes perfect sense if you understood what I wrote above. Why should CNN or Bing be told that you have searched for a particular news article on Google before you have clicked it? The page has to be served from the link aggregator the user is browsing to maintain the user's privacy when prerendering results.
  - glenstein 6y ago
    You appear to have reinterpreted my questions and translated them into terms that were different than I intended, so I guess I have to take care to go back to the start and restate my original question in a way that uses the appropriate magic words correctly. I don't intend to ask whether AMPs (hard to resist calling them 'AMP pages') exist somewhere on non Google servers. Obviously third party content that Google is presenting exists somewhere off Google. And obviously it has to be formatted in a way that's compatible with AMP, and it makes sense that that is going to be done off Google domains. I at least knew the gist of that already, and I regard the detour into that explanation to have been a non sequitur. The point is that Google presents AMPs and it serves it's cached version of them from Google servers, on a Google domain. The beginning, middle, and end of the experience of searching for finding and consuming that news never has to involve leaving a Google domain. It's not open in the sense of involving interaction between servers that aren't controlled by Google, until you make that extra click to go from a cached Google version of an AMP to the version that sits on the domain controlled by a third party, at which point going to the third party has been rendered optional and largely unnecessary from the point of view of the user. This next part is super important: the fact that I'm asking about openness and interoperability, or the lack thereof, in this sense doesn't mean that I'm failing understand the technical advantages with caching and optimization. I regard those as derails that don't wrestle with the issue of openness that's being raised. The point is that the connection between consumers of content who start on Google, and the third party content provider, increasingly depends on Google in a way that shifts nearly the entire experience of consuming content onto Google's infrastructure. >All of them (100%) are delivered by non-Google domains to Google, Bing, and other caches. This is the starkest example of a question not being answered but replaced with a different question. I asked 'what percentage of total amps are delivered by non Google domains' and you replied by answering a different question, what percent of non-Google amps were delivered TO Google and other caches, noting that it was 100%. Which of course it is, but that's because that's a tautology. By contrast, it is helpful to note that there are caches other than Google, like Bing and 'others', which, in contrast to much of the rest of your comment, I feel actually is a pertinent and fair response to the question I'm actually asking. But those aren't content providers, so unless Bing or Google are content creators that were delivering content to themselves, it's tautologically true that 100% of that is going to be delivered to them by third parties, which has absolutely nothing to do with openness. If I'm using magic words correctly, I guess what I want to ask is what percentage of AMP traffic to cached pages is served to users by Bing and others that aren't Google.

gregable 6y ago

I want to break down this question slightly. > Can a third-party other than Google deliver an AMP page? Yes. Examples: Bing runs their own AMP cache and also delivers AMP pages. LinkedIn and Twitter also link to AMP pages, but they don't currently run a cache. IIRC, Twitter links to the Google AMP cache and LinkedIn links directly to the AMP variant on the publisher origin. They could run an AMP Cache. Cloudflare ran one for some time, but shut theirs down recently. The AMP Project maintains a list of known AMP Caches here: https://github.com/ampproject/amphtml/blob/master/build-system/global-configs/caches.json https://github.com/ampproject/amphtml/blob/master/build-syst... And provides some guidelines for running one here: https://github.com/ampproject/amphtml/blob/master/spec/amp-cache-guidelines.md https://github.com/ampproject/amphtml/blob/master/spec/amp-c... It's non-trivial, but absolutely supported. > Can a third-party other than Google deliver a Signed-Exchange? Yes. Cloudflare generates them for their customers who opt-in via their "AMP Real URL" product. "Generates" in this context implies delivering them. To date, I'm unaware of any large scale implementation that is delivering Signed Exchanges for third-party origins other than the Google Cache though this may change. The tech stack absolutely supports this.