16 ms·

Yes this has been a big issue for a very long time now. Google wants to push a release where it will display the hostname of the amp site even if the content is

Yes this has been a big issue for a very long time now. Google wants to push a release where it will display the hostname of the amp site even if the content is being served from google.com[1]. Mozilla (and Apple) are strictly against it and thank god for Mozilla. If Google had a bigger market share this would already be something we would have been living with. I'm sure there are better sources for this, but here is the first result: https://9to5google.com/2019/04/18/apple-mozilla-google-amp-signed-exchanges/ https://9to5google.com/2019/04/18/apple-mozilla-google-amp-s...

Spivak 6y ago
I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.
- pwdisswordfish2 6y ago
  In what ways is this different/similar from "content centric networking"? https://m.youtube.com/watch?v=gqGEMQveoqg https://m.youtube.com/watch?v=gqGEMQveoqg (Google Tech Talk from Van Jacobsen on CCN many years ago)
  - wmf 6y ago
    AMP is happening and CCN is not.
    - pwdisswordfish2 6y ago
      Do you mean to say that is the only difference?
      - wmf 6y ago
        No, there are many differences but they don't matter. Since CCN is not economically feasible, none of the technical details matter.
        pwdisswordfish2 6y ago
        Why is CCN not economically feasible?
- deleted 6y ago
  [deleted]
- domenicd 6y ago
  +1. The way I think about it is that signed exchanges are basically a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. Instead you just allow distribution of a single resource (perhaps a bundle), in a crytographically verifiable way. Stated another way, with a typical CDN setup the user has to trust their browser, the CDN, and the source. With signed exchanges we're back to the minimal requirement of trusting the browser and the source; the distributor isn't able to make modifications.
  - skybrian 6y ago
    It seems like there is a risk that an old version of a bundle will get served instead of a new one by an arbitrary host? Maybe the bundle should have a list of trusted mirrors?
    - gpm 6y ago
      Alternatively super short expiry times. It doesn't seem like it would be that concerning to have another site serving a bundle that was 5 minutes out of date. It doesn't seem like it should be too much load to be caching content every 5 minutes.
      - deleted 6y ago
        [deleted]
    - gregable 6y ago
      There is a publisher selected expiration date as part of the signed exchange which the client inspects. The expiration also cannot be set to more than 7 days in the future on creation. This minimizes, but of course does not eliminate, this risk.
      - xg15 6y ago
        It also makes signed exchanges completely unusable for delivering packages offline. (E.g. the USB stick scenario) What a bummer.
- tyingq 6y ago
  The AMP spec REQUIRES you include a Google controlled JavaScript URL with the AMP runtime. So technically the whole signing bit is a little moot, given that the JS could do whatever it wanted.
  - gregable 6y ago
    The same could be said of any CDN hosted javascript library. For example: jquery. There is an open intent to implement support for publishers self-hosting the AMP library as well.
    - ComputerGuru 6y ago
      You missed the required part.
    - donaltroddyn 6y ago
      For most JS served by CDN, you can (and should) use Subresource Integrity to verify the content. At least the last time I was involved in an AMP project, Google considered AMP to be an "evergreen" project and did not allow publishers to lock in to a specific version.
      - gregable 6y ago
        Long term versions are now supported, so publishers can lock in a specific version. Publisher hosted copies are in the pipeline, as I referenced in the parent comment. My choice of verbiage was a bit confusing it appears.
        donaltroddyn 6y ago
        I don't think it's your wording that's confusing. You are contradicting the AMP documentation. AMP's documentation seems to indicate that the LTS is stable only for one month (new features released via the same URL each month), and so is not compatible with SRI (see https://github.com/ampproject/amphtml/blob/master/contributing/lts-release.md https://github.com/ampproject/amphtml/blob/master/contributi...) You can specify a version (ie, https://cdn.ampproject.org/rtv/somenum/v0.js https://cdn.ampproject.org/rtv/somenum/v0.js), but the AMP validator complains about that.
- dannyw 6y ago
  The plan is bad because google currently tracks all of your activities inside AMP hosted pages site in their support article. Google controls the AMP project and the AMP library. They can start rewriting all links in AMP containers to Google’s AMP cache and track you across the entire internet, even when you are 50 clicks away from google.com.
  - wmf 6y ago
    Publishers who use AMP were already allowing Google to track everything through either Analytics or Ads. Likewise, AMP pages are mostly accessed from Google search that's already tracked.
    - robin_reala 6y ago
      As a user I can choose to block GA, either through URL blocking or through legally mandated cookie choices in some regions (e.g. France). When served from Google I have no choice in the matter.
      - gowld 6y ago
        If you can block GA at the client, you can block google.com at the client, no?
        robin_reala 6y ago
        Not if I want AMP pages. (I mean, I don’t, but there are presumably people who do.)
  - gregable 6y ago
    While that's theoretically possible, the library can be inspected and does not do these things.
    - simion314 6y ago
      Could Google give specific persons different versions or is technically impossible?
- colordrops 6y ago
  Why do they need a special extension though? What's wrong with DNS?
  - gregable 6y ago
    Signed exchanges are an extension to digital certificates, such as used for TLS. This is independent of DNS.
- grey-area 6y ago
  That's not why Google (the corporation) wants this to happen. This is not about technical capabilities but about power. They cannot be allowed to become the gatekeeper for the web.
  - jacquesm 6y ago
    They already are. The question is not how we're going to stop that from happening but how we are going to roll it back.
- nxnews 6y ago
  Why would it be amazing for decentralized networks and offline web apps?
  - remexre 6y ago
    If I publish mycoolthing.com/thing, it could be mirrored over a P2P network as peer1.com/rehosted/mycoolthing.com/thing, peer2.com/rehosted/mycoolthing.com/thing, etc., in a way that would make it evident to end-users not familiar with the protocol that the content is from mycoolthing.com.
    - tgv 6y ago
      AMP is of course not P2P.
      - tyingq 6y ago
        I think the point is that signed exchanges ( https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc...) could potentially be useful, if separated from AMP, and made an actually secure thing. Like, for example, the spec doesn't require specific Google controlled js URLS to be in the content.
        gregable 6y ago
        Signed exchanges is actually separate spec from AMP. The browser implements it independently. There is no requirement for AMP pages to use signed exchanges nor for signed exchanges to be AMP.
- mulmen 6y ago
  How does centralizing content on Google from multiple sources improve decentralization? The web is already decentralized. That's why it is a web. AMP is a scourge. It's a bad idea being pushed by bad actors.
  - amelius 6y ago
    Google is not a single server. Think of Google as a CDN.
    - deleted 6y ago
      [deleted]
    - oblio 6y ago
      So it's decentralized because Google has multiple servers? And here I was, thinking that Google runs everything from a single IBM mainframe. What you're saying would be described as distributed... Not decentralized.
      - HeWhoLurksLate 6y ago
        Seems to me like it's easy to forget there's a difference between those two..
    - deleted 6y ago
      [deleted]
  - eternalban 6y ago
    > How does centralizing content on Google from multiple sources improve decentralization? It actually makes perfect sense in Doublespeak. /s
    - DougBTX 6y ago
      They’re suggesting a web technology which would allow any website to host content for any other website, under the original site’s URL, as long as the bundle is signed by the original site. That could be quite interesting of a site like archive.org, as the url bar could show the original url. But AMP is a much narrower technology, I’d imagine only Google would be able to impersonate other websites, essentially centralised as you say. The generic idea would just be a distraction to push AMP. Everything would be so much better if the original websites were not so overloaded with trackers, ads and banners, then there would be no need for these “accelerated” versions.
- boomlinde 6y ago
  How is it not weird that I see a domain name in the URL bar that has nothing to do with the domain I actually requested content from?
- jeffdavis 6y ago
  It's completely moving away from the client/server model to something else. Perhaps that's a great thing to do, but it's not something to do quietly.
  - mooman219 6y ago
    Just hearing about this from the thread, I'm getting a IPFS vibe from this. It would be interesting to see that tech get more native integration with the browser from this idea.
- deleted 6y ago
  [deleted]
- xg15 6y ago
  I agree, if we finally got a way to have working bundles on the web, that would be extremely useful. (And would also restore some of the capabilities of browsers to work without internet connection). It seems to me, a lot of the security concerns come from the requirements to make pages served live and pages served from bundles indistinguishable to a user - a requirement that really only makes sense if you're Google and want to make people trust your AMP cache more. I'd be excited about an alternative proposal for bundles that explicitly distinguishes bundle use in the URL (and also uses a unique origin for all files of the bundle).
  - gregable 6y ago
    I believe the issue with this is that users already largely don't understand decorations in the URL. For example, the difference between a lock and an extended verification certificate bubble. Educating a user on what a bundle URL means technically may be exceedingly challenging.
- olingern 6y ago
  The problem is ownership. Google is “stealing” or caching content for what they consider a better web. I don’t support ads but I also don’t support Google serving a version of the page that steals money from content creators. So, therein lies the problem: choice. I can imagine a future where amp is ubiquitous and Google begins serving ads on amp content. Luckily, companies have to make money and amp is not in most people’s or company’s best interests. If amp was opt-in only, this would be much more ethically sound.
  - gregable 6y ago
    Signed exchanges guarantee that the content cannot be modified by the cache, such as ad injection. Google has never injected ads into any cache served AMP document (technically if the publisher uses AdSense, this is false, but that's not the point you are making). It's difficult to follow what definition of theft is being suggested. The cache does not modify the document rendering, it's essentially a proxy. In a semantic sense, this is no different than your ISP delivering the page or your WiFi router.
realusername 6y ago
Being completely against AMP for obvious reasons, I'm personally not against signed exchanges itself, this feature could spawn a whole new class of decentralised and harder to censor web hosting, that sounds like a great addition.
- jhhh 6y ago
  Going to also spawn a whole new class of semi-persistent malicious pages (say created via XSS) that once signed and captured can be continuously replayed to clients until expiration.
  - CGamesPlay 6y ago
    What? The signing allows the content to be mirrored in other locations with guarantees about consistency. It doesn't imply anything more about the content than SSL does.
    - 8organicbits 6y ago
      If Google AMP is acts like a cache of content, then cache poisoning attacks are a concern. How those cached items expire will determine how long an attacker who poisons the cache can serve malicious content.
      - CGamesPlay 6y ago
        Why does Archive.org get a pass on this one? Signed responses mean that there's a very clear way to leverage the browser's domain blacklisting technology to stop the spread of malware, which isn't presently possible for any content mirrors on the web.
        8organicbits 6y ago
        Archive.org makes it clear you are on archive.org. The URL shows archive.org. The page content shows archive.org at the top. [1] Google AMP doesn't show Google on the page. Google is pushing for the URL to show the origin site's URL instead of Google[2]. If an attacker poisons a nytimes.com article served by Google AMP, how does a browser's domain blacklisting help? Block google? Block nytimes.com? Neither makes sense. 1. https://web.archive.org/web/20050401090916/http://www.google.com/ https://web.archive.org/web/20050401090916/http://www.google... 2. https://9to5google.com/2019/04/18/apple-mozilla-google-amp-signed-exchanges/ https://9to5google.com/2019/04/18/apple-mozilla-google-amp-s...
jeffbee 6y ago
Well, it's the going opinion of HN for years that the main problem with AMP is it shows the actual origin instead of the proxied origin. Lying about the URL is something hundreds of HN comments have angrily demanded.
- nojs 6y ago
  Why do you say that? I don’t think people want it to show the “proxied origin”, they want AMP to get out of the way and google to link to the real website.
- ori_b 6y ago
  No. The complaint is that Google is redirecting the content to servers that they control.
  - jeffbee 6y ago
    This is not correct. Anyone can host AMP. See, for example, amp.cnn.com. Google hosts AMP content for its customers who elect to use that service. It’s not a nefarious plot.
dqpb 6y ago
Isn't this basically like a CDN or a PoP cache?
- IncRnd 6y ago
  Not exactly. For a CDN to work, the DNS is repointed towards the CDN's servers. In this case, Google is trying to cover-up that Google and not NYTimes is serving the page.
  - wmf 6y ago
    Is NYTimes's use of Fastly also a cover-up?
    - IncRnd 6y ago
      Google by definition wants to cover-up the domain name that serves amp web pages. Over half of the article discusses that. For your question about fastly, I already answered that in the comment you replied. The fastly CDN requires that the DNS is configured to point at fastly servers. Take a look at https://docs.fastly.com/en/guides/sign-up-and-create-your-first-service https://docs.fastly.com/en/guides/sign-up-and-create-your-fi... under "Start serving traffic through Fastly". Once you’re ready, all you need to do to complete your service setup and start serving traffic through Fastly is set your domain's CNAME DNS record to point to Fastly. For more information, see the instructions in our Adding CNAME records guide." A CNAME record is a dns mechanism that aliases an alternate domain for a canonical domain.
      - wmf 6y ago
        Users don't see DNS records. In the old world they click on a nytimes.com link and get something served from a Fastly server, but in the future AMP world they click on nytimes.com and get it served from a Google server. It isn't different.
        IncRnd 6y ago
esafwan 6y ago
Have a look at this: https://blog.cloudflare.com/announcing-amp-real-url/ https://blog.cloudflare.com/announcing-amp-real-url/ Cloudflare allow using of same domain to use AMP. In this case, content is served from Cloudflare CDN.
- archon810 6y ago
  It's called Signed Exchange and it's the same thing the comment you replied to is about.
- tyingq 6y ago
  Note the Cloudflare hosted AMP pages still mandate AMP requirements, like including a Google controlled JS uri in your content. Signing is moot if you allow Google to run arbitrary JS on your content. They haven't abused it yet, but it's allowed by spec. Subresource integrity isn't mandated, explained, or recommended.
m-p-3 6y ago
I'm still waiting for general support of addons for the next version of Firefox on mobile just so that I can have the Redirect AMP to HTML[1] addon. [1]: https://addons.mozilla.org/firefox/addon/amp2html/ https://addons.mozilla.org/firefox/addon/amp2html/
- henriquemaia 6y ago
  I'm on Firefox on a mobile device. That addon has a redirection link [1] specifically for Firefox' mobile version. As I didn't know about this addon, thanks for sharing it. [1] https://addons.mozilla.org/en-US/android/addon/amp2html/ https://addons.mozilla.org/en-US/android/addon/amp2html/
- deadelvis 6y ago
  Here's a user script to get rid of AMP (I use it with adguard): https://userscripts.adtidy.org/release/disable-amp/1.0/disable-amp.meta.js https://userscripts.adtidy.org/release/disable-amp/1.0/disab...
rpastuszak 6y ago
Remember when Google was telling us that third-party cookies are there to protect us, and Safari/Firefox/Edge are just reckless and pose a risk to users by blocking them?
- Jabbles 6y ago
  Please provide a link, I could only find this, which suggests Google has reversed course: https://www.techradar.com/uk/news/google-is-phasing-out-third-party-cookies-in-chrome-to-protect-your-privacy https://www.techradar.com/uk/news/google-is-phasing-out-thir...
  - rpastuszak 6y ago
    > By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control. https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html https://blog.chromium.org/2020/01/building-more-private-web-... I'm going to copy paste my older comment on this: I find their "removing 3rd party cookies will incentivise businesses to rely on fingerprinting" discourse dangerous. It implies that other browser vendors (Mozilla, Safari/WebKit, new Edge) are in fact making the Web a more dangerous place. I believe it's dangerous because it creates a harmful, unproductive PR narrative—people might just assume this is a true statement, without learning about both sides of the problem. I'm not trying to strip anyone of agency, I just don't think most of my friends would have time to research this topic and might decide to follow the main opinion instead. The answer I'd like to hear: Yes, it does push some actors towards fingerprinting, but preventing fingerprinting should be dealt with regardless. Changes should happen both on legislative and browser-vendor level.
    - Jabbles 6y ago
      Thank you for the additional background.
      - 6y ago
xg15 6y ago
Aren't we essentially reinventing http proxies with this?
nokya 6y ago
Just having this idea already tells how important it is to actively resist Google. One should never forget that at a certain point, Google will likely invoke the looser's argument ("protect you from terrorists and pedophiles") to require proof of identity prior to granting access to any resource or service it controls. Anything that helps them advance in that direction must be fought fiercely.
priyaranjan 6y ago
This has been discussed over & over again and there is no representation from amp team to make it any better. I was surprised to realise how much my life changed when I started using firefox + duckduckgo. Full time, at work & home, on macOS & android.
agumonkey 6y ago
has the mainstream web jumped the shark ?
smpetrey 6y ago
Holy mackerel

Spivak 6y ago

I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.

pwdisswordfish2 6y ago
In what ways is this different/similar from "content centric networking"? https://m.youtube.com/watch?v=gqGEMQveoqg https://m.youtube.com/watch?v=gqGEMQveoqg (Google Tech Talk from Van Jacobsen on CCN many years ago)
- wmf 6y ago
  AMP is happening and CCN is not.
  - pwdisswordfish2 6y ago
    Do you mean to say that is the only difference?
    - wmf 6y ago
      No, there are many differences but they don't matter. Since CCN is not economically feasible, none of the technical details matter.
      - pwdisswordfish2 6y ago
        Why is CCN not economically feasible?
deleted 6y ago
[deleted]
domenicd 6y ago
+1. The way I think about it is that signed exchanges are basically a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. Instead you just allow distribution of a single resource (perhaps a bundle), in a crytographically verifiable way. Stated another way, with a typical CDN setup the user has to trust their browser, the CDN, and the source. With signed exchanges we're back to the minimal requirement of trusting the browser and the source; the distributor isn't able to make modifications.
- skybrian 6y ago
  It seems like there is a risk that an old version of a bundle will get served instead of a new one by an arbitrary host? Maybe the bundle should have a list of trusted mirrors?
  - gpm 6y ago
    Alternatively super short expiry times. It doesn't seem like it would be that concerning to have another site serving a bundle that was 5 minutes out of date. It doesn't seem like it should be too much load to be caching content every 5 minutes.
    - deleted 6y ago
      [deleted]
  - gregable 6y ago
    There is a publisher selected expiration date as part of the signed exchange which the client inspects. The expiration also cannot be set to more than 7 days in the future on creation. This minimizes, but of course does not eliminate, this risk.
    - xg15 6y ago
      It also makes signed exchanges completely unusable for delivering packages offline. (E.g. the USB stick scenario) What a bummer.
tyingq 6y ago
The AMP spec REQUIRES you include a Google controlled JavaScript URL with the AMP runtime. So technically the whole signing bit is a little moot, given that the JS could do whatever it wanted.
- gregable 6y ago
  The same could be said of any CDN hosted javascript library. For example: jquery. There is an open intent to implement support for publishers self-hosting the AMP library as well.
  - ComputerGuru 6y ago
    You missed the required part.
  - donaltroddyn 6y ago
    For most JS served by CDN, you can (and should) use Subresource Integrity to verify the content. At least the last time I was involved in an AMP project, Google considered AMP to be an "evergreen" project and did not allow publishers to lock in to a specific version.
    - gregable 6y ago
      Long term versions are now supported, so publishers can lock in a specific version. Publisher hosted copies are in the pipeline, as I referenced in the parent comment. My choice of verbiage was a bit confusing it appears.
      - donaltroddyn 6y ago
        I don't think it's your wording that's confusing. You are contradicting the AMP documentation. AMP's documentation seems to indicate that the LTS is stable only for one month (new features released via the same URL each month), and so is not compatible with SRI (see https://github.com/ampproject/amphtml/blob/master/contributing/lts-release.md https://github.com/ampproject/amphtml/blob/master/contributi...) You can specify a version (ie, https://cdn.ampproject.org/rtv/somenum/v0.js https://cdn.ampproject.org/rtv/somenum/v0.js), but the AMP validator complains about that.
dannyw 6y ago
The plan is bad because google currently tracks all of your activities inside AMP hosted pages site in their support article. Google controls the AMP project and the AMP library. They can start rewriting all links in AMP containers to Google’s AMP cache and track you across the entire internet, even when you are 50 clicks away from google.com.
- wmf 6y ago
  Publishers who use AMP were already allowing Google to track everything through either Analytics or Ads. Likewise, AMP pages are mostly accessed from Google search that's already tracked.
  - robin_reala 6y ago
    As a user I can choose to block GA, either through URL blocking or through legally mandated cookie choices in some regions (e.g. France). When served from Google I have no choice in the matter.
    - gowld 6y ago
      If you can block GA at the client, you can block google.com at the client, no?
      - robin_reala 6y ago
        Not if I want AMP pages. (I mean, I don’t, but there are presumably people who do.)
- gregable 6y ago
  While that's theoretically possible, the library can be inspected and does not do these things.
  - simion314 6y ago
    Could Google give specific persons different versions or is technically impossible?
colordrops 6y ago
Why do they need a special extension though? What's wrong with DNS?
- gregable 6y ago
  Signed exchanges are an extension to digital certificates, such as used for TLS. This is independent of DNS.
grey-area 6y ago
That's not why Google (the corporation) wants this to happen. This is not about technical capabilities but about power. They cannot be allowed to become the gatekeeper for the web.
- jacquesm 6y ago
  They already are. The question is not how we're going to stop that from happening but how we are going to roll it back.
nxnews 6y ago
Why would it be amazing for decentralized networks and offline web apps?
- remexre 6y ago
  If I publish mycoolthing.com/thing, it could be mirrored over a P2P network as peer1.com/rehosted/mycoolthing.com/thing, peer2.com/rehosted/mycoolthing.com/thing, etc., in a way that would make it evident to end-users not familiar with the protocol that the content is from mycoolthing.com.
  - tgv 6y ago
    AMP is of course not P2P.
    - tyingq 6y ago
      I think the point is that signed exchanges ( https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc...) could potentially be useful, if separated from AMP, and made an actually secure thing. Like, for example, the spec doesn't require specific Google controlled js URLS to be in the content.
      - gregable 6y ago
        Signed exchanges is actually separate spec from AMP. The browser implements it independently. There is no requirement for AMP pages to use signed exchanges nor for signed exchanges to be AMP.
mulmen 6y ago
How does centralizing content on Google from multiple sources improve decentralization? The web is already decentralized. That's why it is a web. AMP is a scourge. It's a bad idea being pushed by bad actors.
- amelius 6y ago
  Google is not a single server. Think of Google as a CDN.
  - deleted 6y ago
    [deleted]
  - oblio 6y ago
    So it's decentralized because Google has multiple servers? And here I was, thinking that Google runs everything from a single IBM mainframe. What you're saying would be described as distributed... Not decentralized.
    - HeWhoLurksLate 6y ago
      Seems to me like it's easy to forget there's a difference between those two..
  - deleted 6y ago
    [deleted]
- eternalban 6y ago
  > How does centralizing content on Google from multiple sources improve decentralization? It actually makes perfect sense in Doublespeak. /s
  - DougBTX 6y ago
    They’re suggesting a web technology which would allow any website to host content for any other website, under the original site’s URL, as long as the bundle is signed by the original site. That could be quite interesting of a site like archive.org, as the url bar could show the original url. But AMP is a much narrower technology, I’d imagine only Google would be able to impersonate other websites, essentially centralised as you say. The generic idea would just be a distraction to push AMP. Everything would be so much better if the original websites were not so overloaded with trackers, ads and banners, then there would be no need for these “accelerated” versions.
boomlinde 6y ago
How is it not weird that I see a domain name in the URL bar that has nothing to do with the domain I actually requested content from?
jeffdavis 6y ago
It's completely moving away from the client/server model to something else. Perhaps that's a great thing to do, but it's not something to do quietly.
- mooman219 6y ago
  Just hearing about this from the thread, I'm getting a IPFS vibe from this. It would be interesting to see that tech get more native integration with the browser from this idea.
deleted 6y ago
[deleted]
xg15 6y ago
I agree, if we finally got a way to have working bundles on the web, that would be extremely useful. (And would also restore some of the capabilities of browsers to work without internet connection). It seems to me, a lot of the security concerns come from the requirements to make pages served live and pages served from bundles indistinguishable to a user - a requirement that really only makes sense if you're Google and want to make people trust your AMP cache more. I'd be excited about an alternative proposal for bundles that explicitly distinguishes bundle use in the URL (and also uses a unique origin for all files of the bundle).
- gregable 6y ago
  I believe the issue with this is that users already largely don't understand decorations in the URL. For example, the difference between a lock and an extended verification certificate bubble. Educating a user on what a bundle URL means technically may be exceedingly challenging.
olingern 6y ago
The problem is ownership. Google is “stealing” or caching content for what they consider a better web. I don’t support ads but I also don’t support Google serving a version of the page that steals money from content creators. So, therein lies the problem: choice. I can imagine a future where amp is ubiquitous and Google begins serving ads on amp content. Luckily, companies have to make money and amp is not in most people’s or company’s best interests. If amp was opt-in only, this would be much more ethically sound.
- gregable 6y ago
  Signed exchanges guarantee that the content cannot be modified by the cache, such as ad injection. Google has never injected ads into any cache served AMP document (technically if the publisher uses AdSense, this is false, but that's not the point you are making). It's difficult to follow what definition of theft is being suggested. The cache does not modify the document rendering, it's essentially a proxy. In a semantic sense, this is no different than your ISP delivering the page or your WiFi router.

realusername 6y ago

Being completely against AMP for obvious reasons, I'm personally not against signed exchanges itself, this feature could spawn a whole new class of decentralised and harder to censor web hosting, that sounds like a great addition.

jhhh 6y ago
Going to also spawn a whole new class of semi-persistent malicious pages (say created via XSS) that once signed and captured can be continuously replayed to clients until expiration.
- CGamesPlay 6y ago
  What? The signing allows the content to be mirrored in other locations with guarantees about consistency. It doesn't imply anything more about the content than SSL does.
  - 8organicbits 6y ago
    If Google AMP is acts like a cache of content, then cache poisoning attacks are a concern. How those cached items expire will determine how long an attacker who poisons the cache can serve malicious content.
    - CGamesPlay 6y ago
      Why does Archive.org get a pass on this one? Signed responses mean that there's a very clear way to leverage the browser's domain blacklisting technology to stop the spread of malware, which isn't presently possible for any content mirrors on the web.
      - 8organicbits 6y ago
        Archive.org makes it clear you are on archive.org. The URL shows archive.org. The page content shows archive.org at the top. [1] Google AMP doesn't show Google on the page. Google is pushing for the URL to show the origin site's URL instead of Google[2]. If an attacker poisons a nytimes.com article served by Google AMP, how does a browser's domain blacklisting help? Block google? Block nytimes.com? Neither makes sense. 1. https://web.archive.org/web/20050401090916/http://www.google.com/ https://web.archive.org/web/20050401090916/http://www.google... 2. https://9to5google.com/2019/04/18/apple-mozilla-google-amp-signed-exchanges/ https://9to5google.com/2019/04/18/apple-mozilla-google-amp-s...

jeffbee 6y ago

Well, it's the going opinion of HN for years that the main problem with AMP is it shows the actual origin instead of the proxied origin. Lying about the URL is something hundreds of HN comments have angrily demanded.

nojs 6y ago
Why do you say that? I don’t think people want it to show the “proxied origin”, they want AMP to get out of the way and google to link to the real website.
ori_b 6y ago
No. The complaint is that Google is redirecting the content to servers that they control.
- jeffbee 6y ago
  This is not correct. Anyone can host AMP. See, for example, amp.cnn.com. Google hosts AMP content for its customers who elect to use that service. It’s not a nefarious plot.

dqpb 6y ago

Isn't this basically like a CDN or a PoP cache?

IncRnd 6y ago
Not exactly. For a CDN to work, the DNS is repointed towards the CDN's servers. In this case, Google is trying to cover-up that Google and not NYTimes is serving the page.
- wmf 6y ago
  Is NYTimes's use of Fastly also a cover-up?
  - IncRnd 6y ago
    Google by definition wants to cover-up the domain name that serves amp web pages. Over half of the article discusses that. For your question about fastly, I already answered that in the comment you replied. The fastly CDN requires that the DNS is configured to point at fastly servers. Take a look at https://docs.fastly.com/en/guides/sign-up-and-create-your-first-service https://docs.fastly.com/en/guides/sign-up-and-create-your-fi... under "Start serving traffic through Fastly". Once you’re ready, all you need to do to complete your service setup and start serving traffic through Fastly is set your domain's CNAME DNS record to point to Fastly. For more information, see the instructions in our Adding CNAME records guide." A CNAME record is a dns mechanism that aliases an alternate domain for a canonical domain.
    - wmf 6y ago
      Users don't see DNS records. In the old world they click on a nytimes.com link and get something served from a Fastly server, but in the future AMP world they click on nytimes.com and get it served from a Google server. It isn't different.
      - IncRnd 6y ago

esafwan 6y ago

Have a look at this: https://blog.cloudflare.com/announcing-amp-real-url/ https://blog.cloudflare.com/announcing-amp-real-url/ Cloudflare allow using of same domain to use AMP. In this case, content is served from Cloudflare CDN.

archon810 6y ago
It's called Signed Exchange and it's the same thing the comment you replied to is about.
tyingq 6y ago
Note the Cloudflare hosted AMP pages still mandate AMP requirements, like including a Google controlled JS uri in your content. Signing is moot if you allow Google to run arbitrary JS on your content. They haven't abused it yet, but it's allowed by spec. Subresource integrity isn't mandated, explained, or recommended.

m-p-3 6y ago

I'm still waiting for general support of addons for the next version of Firefox on mobile just so that I can have the Redirect AMP to HTML[1] addon. [1]: https://addons.mozilla.org/firefox/addon/amp2html/ https://addons.mozilla.org/firefox/addon/amp2html/

henriquemaia 6y ago
I'm on Firefox on a mobile device. That addon has a redirection link [1] specifically for Firefox' mobile version. As I didn't know about this addon, thanks for sharing it. [1] https://addons.mozilla.org/en-US/android/addon/amp2html/ https://addons.mozilla.org/en-US/android/addon/amp2html/
deadelvis 6y ago
Here's a user script to get rid of AMP (I use it with adguard): https://userscripts.adtidy.org/release/disable-amp/1.0/disable-amp.meta.js https://userscripts.adtidy.org/release/disable-amp/1.0/disab...

rpastuszak 6y ago

Remember when Google was telling us that third-party cookies are there to protect us, and Safari/Firefox/Edge are just reckless and pose a risk to users by blocking them?

Jabbles 6y ago
Please provide a link, I could only find this, which suggests Google has reversed course: https://www.techradar.com/uk/news/google-is-phasing-out-third-party-cookies-in-chrome-to-protect-your-privacy https://www.techradar.com/uk/news/google-is-phasing-out-thir...
- rpastuszak 6y ago
  > By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control. https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html https://blog.chromium.org/2020/01/building-more-private-web-... I'm going to copy paste my older comment on this: I find their "removing 3rd party cookies will incentivise businesses to rely on fingerprinting" discourse dangerous. It implies that other browser vendors (Mozilla, Safari/WebKit, new Edge) are in fact making the Web a more dangerous place. I believe it's dangerous because it creates a harmful, unproductive PR narrative—people might just assume this is a true statement, without learning about both sides of the problem. I'm not trying to strip anyone of agency, I just don't think most of my friends would have time to research this topic and might decide to follow the main opinion instead. The answer I'd like to hear: Yes, it does push some actors towards fingerprinting, but preventing fingerprinting should be dealt with regardless. Changes should happen both on legislative and browser-vendor level.
  - Jabbles 6y ago
    Thank you for the additional background.
    - 6y ago

xg15 6y ago

Aren't we essentially reinventing http proxies with this?

nokya 6y ago

Just having this idea already tells how important it is to actively resist Google. One should never forget that at a certain point, Google will likely invoke the looser's argument ("protect you from terrorists and pedophiles") to require proof of identity prior to granting access to any resource or service it controls. Anything that helps them advance in that direction must be fought fiercely.

priyaranjan 6y ago

This has been discussed over & over again and there is no representation from amp team to make it any better. I was surprised to realise how much my life changed when I started using firefox + duckduckgo. Full time, at work & home, on macOS & android.

agumonkey 6y ago

has the mainstream web jumped the shark ?

smpetrey 6y ago

Holy mackerel