5 ms·

IMO the core point of the article is false. > To be blunt, this is a really dangerous pattern: Google serves NYTimes’ controlled content on a Google domain. N

IMO the core point of the article is false. > To be blunt, this is a really dangerous pattern: Google serves NYTimes’ controlled content on a Google domain. No, "Google serves NYTimes' controlled content" is an oxymoron. Google controls the content that is served, and that's all your browser is verifying. Google could very well make the NYTimes content on there display something else and your browser wouldn't show a warning. NYTimes could do nothing about that. I disagree that this pattern is dangerous. While Google taking over serving the world's content is hardly a thing to celebrate, at least we're seeing that it's doing so here.

rtsil 6y ago
The pattern is dangerous because it trains the user to dissociate URL and legitimate content, and the best tool at our disposal against phishing is still the ability to use the URL to ascertain the legitimacy of a content.
- izacus 6y ago
  URLs haven't been associated with legitimate content for a long time now, since most of the things come from giant CDN companies like CloudFlare anyway. What you're seeing in URL bar has very little to do with where the JS code executed on your computer is coming from.
  - sudoit 6y ago
    Yes, but users at least know the js code loaded was done so on behalf of the webpage the url points too
  - icebraining 6y ago
    Does it matter if it comes from a CDN rented by the NYT or a computer owned by DigitalOcean but rented by the NYT? What matters is that the domain points to where the NYT considers is the correct source of their content.
    - satyrnein 6y ago
      With signed exchanges, the NYT is cryptographically opting into allowing Google (or other cache providers) to represent specific articles as being the NYT. It doesn't seem much different.
- popcorncolonel 6y ago
  Do you really think most smartphone users look at the URL anymore? Or even know what a URL is? From the non-technical people I've talked to, the answer is no, they don't know what a URL is, and that was happening before AMP came around.
  - acdha 6y ago
    You might want to back that up with research: people don’t look at full URLs but that’s exactly why it’s so important that the highly-prominent domain name display is accurate.
  - TLightful 6y ago
    Are you sh!tting me?!!? Had enough of HN ... This place is bullsh!t. Ban me.
- satyrnein 6y ago
  It's the current amp status quo that trains users that legitimate content is sometimes on other domains. This change would restore the idea that the URL indicates the provenance of the content,
gsnedders 6y ago
With Signed HTTP Exchanges, for Google to modify the content that is served, Google would need access to a private key for a certificate for nytimes.com, no? Either nytimes.com has handed over that key or Google would have to create a key/certificate for nytimes.com. Believing Google would maliciously issue certificates seems a stretch to me. I don't like AMP nor much of how Google has behaved with it (http://exple.tive.org/blarg/2020/05/05/the-shape-of-the-machine/ http://exple.tive.org/blarg/2020/05/05/the-shape-of-the-mach... largely matches my thoughts), but let's stick to what's actually happening with SXG.
- gregable 6y ago
  That's correct. Only with the private key can one sign a Signed Exchange for the publisher. Like TLS, if you have the key you can already do quite a lot.
- kebman 6y ago
  I don't get this. Clearly the contents is served by Google, and so they can do whatever they like with it. How is an end user going to know whether the message was signed before it was passed on or not?
  - Sephr 6y ago
    > How is an end user going to know whether the message was signed before it was passed on or not? Your web browser will show a scary warning and refuse to display the bundle if it's not correctly signed. Google is not going to fake signatures for other sites, as certificate mis-issuance would open up Google to legal consequences.
  - izacus 6y ago
    How does the end user know now that a file from cdn.cloudflare.com is actually coming from NYTimes when it loads and runs code on their browser?
  - cjhopman 6y ago
    That's nonsense. Take a moment to breathe. Think about just typical https, when you request some nytimes.com content that is actually being delivered to you througha bunch of intermediaries. So, by your logic any of those could just change that content. But it turns out, this was a problem solved like 50 years ago. With https, the content is signed by some key that you trust to represent nytimes.com. Sidenote (this is really not targeted at the specific comment): Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. I have to assume that HN's comments are just as useless on things that I don't know about.

rtsil 6y ago

The pattern is dangerous because it trains the user to dissociate URL and legitimate content, and the best tool at our disposal against phishing is still the ability to use the URL to ascertain the legitimacy of a content.

izacus 6y ago
URLs haven't been associated with legitimate content for a long time now, since most of the things come from giant CDN companies like CloudFlare anyway. What you're seeing in URL bar has very little to do with where the JS code executed on your computer is coming from.
- sudoit 6y ago
  Yes, but users at least know the js code loaded was done so on behalf of the webpage the url points too
- icebraining 6y ago
  Does it matter if it comes from a CDN rented by the NYT or a computer owned by DigitalOcean but rented by the NYT? What matters is that the domain points to where the NYT considers is the correct source of their content.
  - satyrnein 6y ago
    With signed exchanges, the NYT is cryptographically opting into allowing Google (or other cache providers) to represent specific articles as being the NYT. It doesn't seem much different.
popcorncolonel 6y ago
Do you really think most smartphone users look at the URL anymore? Or even know what a URL is? From the non-technical people I've talked to, the answer is no, they don't know what a URL is, and that was happening before AMP came around.
- acdha 6y ago
  You might want to back that up with research: people don’t look at full URLs but that’s exactly why it’s so important that the highly-prominent domain name display is accurate.
- TLightful 6y ago
  Are you sh!tting me?!!? Had enough of HN ... This place is bullsh!t. Ban me.
satyrnein 6y ago
It's the current amp status quo that trains users that legitimate content is sometimes on other domains. This change would restore the idea that the URL indicates the provenance of the content,

gsnedders 6y ago

With Signed HTTP Exchanges, for Google to modify the content that is served, Google would need access to a private key for a certificate for nytimes.com, no? Either nytimes.com has handed over that key or Google would have to create a key/certificate for nytimes.com. Believing Google would maliciously issue certificates seems a stretch to me. I don't like AMP nor much of how Google has behaved with it (http://exple.tive.org/blarg/2020/05/05/the-shape-of-the-machine/ http://exple.tive.org/blarg/2020/05/05/the-shape-of-the-mach... largely matches my thoughts), but let's stick to what's actually happening with SXG.

gregable 6y ago
That's correct. Only with the private key can one sign a Signed Exchange for the publisher. Like TLS, if you have the key you can already do quite a lot.
kebman 6y ago
I don't get this. Clearly the contents is served by Google, and so they can do whatever they like with it. How is an end user going to know whether the message was signed before it was passed on or not?
- Sephr 6y ago
  > How is an end user going to know whether the message was signed before it was passed on or not? Your web browser will show a scary warning and refuse to display the bundle if it's not correctly signed. Google is not going to fake signatures for other sites, as certificate mis-issuance would open up Google to legal consequences.
- izacus 6y ago
  How does the end user know now that a file from cdn.cloudflare.com is actually coming from NYTimes when it loads and runs code on their browser?
- cjhopman 6y ago
  That's nonsense. Take a moment to breathe. Think about just typical https, when you request some nytimes.com content that is actually being delivered to you througha bunch of intermediaries. So, by your logic any of those could just change that content. But it turns out, this was a problem solved like 50 years ago. With https, the content is signed by some key that you trust to represent nytimes.com. Sidenote (this is really not targeted at the specific comment): Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. I have to assume that HN's comments are just as useless on things that I don't know about.