4 ms·

While that's theoretically possible, the library can be inspected and does not do these things.

by gregable 6y ago

simion314 6y ago
Could Google give specific persons different versions or is technically impossible?
- rocho 6y ago
  It's very possible indeed.
- gregable 6y ago
  Technically yes, but not very practically. The domain is cookieless, so it would be difficult to even identify a specific user, other than by IP. Also, the JavaScript resource is delivered from the cache with a 1 year expiry, which means most times it's loaded it will be served from browser cache rather than the web.
  - ric2b 6y ago
    How is google.com cookieless?
    - gregable 6y ago
      The AMP javascript is served on the cdn.ampproject.org domain, not google.com.
pdkl95 6y ago
> the library can be inspected Really? Could you publish how you are inspecting an unknown program to determine if it exhibits a specific behavior? There are a lot of computer scientists interested in your solution to the halting problem. Joking aside, we already know from the halting problem[1] that it you cannot determine if a program will execute the simplest behavior: halting. Inspecting a program for more complex behaviors is almost always undecidable[2]. In this particular situation where Google is serving an unknown Javascript program, a look at the company's history and business model suggests that the probability they are using that Javascript to track use behavior is very high. [1] https://en.wikipedia.org/wiki/Halting_problem https://en.wikipedia.org/wiki/Halting_problem [2] https://en.wikipedia.org/wiki/Undecidable_problem https://en.wikipedia.org/wiki/Undecidable_problem
- pwdisswordfish2 6y ago
  By reading the source code? def divisors(n): for d in range(1, n): if n % d == 0: yield d n = 1 while True: if n == sum(divisors(n)): break n += 2 print(n) I don’t know if this program halts. But I’m pretty sure it won’t steal my data and send it to third parties. Why? Because at no point does it read my data or communicate with third parties in any way: it would have to have those things programmed into it for that to be a possibility. At no point I had to solve the halting problem to know this. Also, if I execute a program and it does exhibit that behaviour, that’s a proof right there. The same kind of analysis can be applied to Google’s scripts: look what data it collects and where it pushes data to the outside world. If there are any undecidable problems along the way, then Google has no plausible deniability that some nefarious behaviour is possible. Now, whether that is a practical thing to do is another matter; but the halting problem is just a distraction.
  - saagarjha 6y ago
    > I don’t know if this program halts. Be cool if you did ;)
    - FabHK 6y ago
      If you didn't catch the joke: It is currently unknown whether there are any odd perfect numbers (and the program halts on encountering the first). https://en.wikipedia.org/wiki/Perfect_number https://en.wikipedia.org/wiki/Perfect_number https://oeis.org/A000396 https://oeis.org/A000396
  - pdkl95 6y ago
    > at no point does it read my data Tracking doesn't require reading any of your data. All that is necessary is to trigger some kind of signal back to Google's servers on whatever user behavior they are interested in tracking. > or communicate with third parties Third parties like Google? Which is kind of the point? > [example source code] Of course you can generate examples that are trivial to inspect. Real world problems are far harder to understand. Source is minified/uglified/obfuscated, and "bad" behaviors might intermingle with legitimate actions. Instead of speculating, here is Google's JS for AMP pages: https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.js How much tracking does that library implement? What data does it exfiltrate from the user's browser back to Google? It obviously communicates with Google's servers; can you characterize if these communications are "good" or "bad"? Even if you spent the time and effort to manually answer these questions, the javascript might change at any time. Unless you're willing to stop using all AMP pages every time Google changes their JS and you perform another manual inspection, you are going to need some sort of automated process that can inspect and characterize unknown programs. Which is where you will run into the halting problem.
tgv 6y ago
They have the log files.

While that's theoretically possible, the library can be inspected and does not do these things.

simion314 6y ago

Could Google give specific persons different versions or is technically impossible?

rocho 6y ago
It's very possible indeed.
gregable 6y ago
Technically yes, but not very practically. The domain is cookieless, so it would be difficult to even identify a specific user, other than by IP. Also, the JavaScript resource is delivered from the cache with a 1 year expiry, which means most times it's loaded it will be served from browser cache rather than the web.
- ric2b 6y ago
  How is google.com cookieless?
  - gregable 6y ago
    The AMP javascript is served on the cdn.ampproject.org domain, not google.com.

pdkl95 6y ago

> the library can be inspected Really? Could you publish how you are inspecting an unknown program to determine if it exhibits a specific behavior? There are a lot of computer scientists interested in your solution to the halting problem. Joking aside, we already know from the halting problem[1] that it you cannot determine if a program will execute the simplest behavior: halting. Inspecting a program for more complex behaviors is almost always undecidable[2]. In this particular situation where Google is serving an unknown Javascript program, a look at the company's history and business model suggests that the probability they are using that Javascript to track use behavior is very high. [1] https://en.wikipedia.org/wiki/Halting_problem https://en.wikipedia.org/wiki/Halting_problem [2] https://en.wikipedia.org/wiki/Undecidable_problem https://en.wikipedia.org/wiki/Undecidable_problem

pwdisswordfish2 6y ago
By reading the source code? def divisors(n): for d in range(1, n): if n % d == 0: yield d n = 1 while True: if n == sum(divisors(n)): break n += 2 print(n) I don’t know if this program halts. But I’m pretty sure it won’t steal my data and send it to third parties. Why? Because at no point does it read my data or communicate with third parties in any way: it would have to have those things programmed into it for that to be a possibility. At no point I had to solve the halting problem to know this. Also, if I execute a program and it does exhibit that behaviour, that’s a proof right there. The same kind of analysis can be applied to Google’s scripts: look what data it collects and where it pushes data to the outside world. If there are any undecidable problems along the way, then Google has no plausible deniability that some nefarious behaviour is possible. Now, whether that is a practical thing to do is another matter; but the halting problem is just a distraction.
- saagarjha 6y ago
  > I don’t know if this program halts. Be cool if you did ;)
  - FabHK 6y ago
    If you didn't catch the joke: It is currently unknown whether there are any odd perfect numbers (and the program halts on encountering the first). https://en.wikipedia.org/wiki/Perfect_number https://en.wikipedia.org/wiki/Perfect_number https://oeis.org/A000396 https://oeis.org/A000396
- pdkl95 6y ago
  > at no point does it read my data Tracking doesn't require reading any of your data. All that is necessary is to trigger some kind of signal back to Google's servers on whatever user behavior they are interested in tracking. > or communicate with third parties Third parties like Google? Which is kind of the point? > [example source code] Of course you can generate examples that are trivial to inspect. Real world problems are far harder to understand. Source is minified/uglified/obfuscated, and "bad" behaviors might intermingle with legitimate actions. Instead of speculating, here is Google's JS for AMP pages: https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.js How much tracking does that library implement? What data does it exfiltrate from the user's browser back to Google? It obviously communicates with Google's servers; can you characterize if these communications are "good" or "bad"? Even if you spent the time and effort to manually answer these questions, the javascript might change at any time. Unless you're willing to stop using all AMP pages every time Google changes their JS and you perform another manual inspection, you are going to need some sort of automated process that can inspect and characterize unknown programs. Which is where you will run into the halting problem.

tgv 6y ago

They have the log files.