4 ms·

With Signed HTTP Exchanges, for Google to modify the content that is served, Google would need access to a private key for a certificate for nytimes.com, no? Ei

With Signed HTTP Exchanges, for Google to modify the content that is served, Google would need access to a private key for a certificate for nytimes.com, no? Either nytimes.com has handed over that key or Google would have to create a key/certificate for nytimes.com. Believing Google would maliciously issue certificates seems a stretch to me. I don't like AMP nor much of how Google has behaved with it (http://exple.tive.org/blarg/2020/05/05/the-shape-of-the-machine/ http://exple.tive.org/blarg/2020/05/05/the-shape-of-the-mach... largely matches my thoughts), but let's stick to what's actually happening with SXG.

gregable 6y ago
That's correct. Only with the private key can one sign a Signed Exchange for the publisher. Like TLS, if you have the key you can already do quite a lot.
kebman 6y ago
I don't get this. Clearly the contents is served by Google, and so they can do whatever they like with it. How is an end user going to know whether the message was signed before it was passed on or not?
- Sephr 6y ago
  > How is an end user going to know whether the message was signed before it was passed on or not? Your web browser will show a scary warning and refuse to display the bundle if it's not correctly signed. Google is not going to fake signatures for other sites, as certificate mis-issuance would open up Google to legal consequences.
- izacus 6y ago
  How does the end user know now that a file from cdn.cloudflare.com is actually coming from NYTimes when it loads and runs code on their browser?
- cjhopman 6y ago
  That's nonsense. Take a moment to breathe. Think about just typical https, when you request some nytimes.com content that is actually being delivered to you througha bunch of intermediaries. So, by your logic any of those could just change that content. But it turns out, this was a problem solved like 50 years ago. With https, the content is signed by some key that you trust to represent nytimes.com. Sidenote (this is really not targeted at the specific comment): Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. I have to assume that HN's comments are just as useless on things that I don't know about.
  - quadrifoliate 6y ago
    > Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. Given that HTTP Signed Exchanges are nowhere near a web standard at this point, I think you should tone down your vitriol considerably. Currently, what the parent commenter is saying is completely valid and true; if you're serving things on your domain and have a cert for it, you can serve https://youdomain.com/<anything> https://youdomain.com/<anything>, where <anything> could be www.nytimes.com, www.google.com, or whatever. HTTP Signed Exchanges proposes a breaking change to this, and therefore is non-intuitive for the vast majority of users.
  - dang 6y ago
    Please review and stick to the site guidelines when posting here (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). They explicitly ask you not to lead with things like "That's nonsense. Take a moment to breathe." The rest of your first paragraph is just fine. Re the second paragraph: people are wrong on the internet. If you want a site that doesn't have this problem, you're going to have to look for something considerably smaller, where countering entropy is an option. I think you might be running into the notice-dislike bias, though: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20notice%20dislike&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Edit: I'm dismayed to see that your last 7 comments have all broken the site guidelines. Trashing this place because you don't like some of what other people post, or because you feel superior to the community, is not ok. I'm sure you wouldn't litter in a city park, so please stop doing the equivalent here.
quadrifoliate 6y ago
> but let's stick to what's actually happening with SXG No, Signed HTTP exchanges are something that Google dreamed up so people don't have to see their hegemony over the modern web (or as the article you linked calls it, a shakedown). It's not a browser standard so far, because of Apple and Mozilla's resistance. There are legitimate ways for NYTimes to allow Google to serve content on behalf of them, like so many other CDNs around the world (it usually involves the CDN generating the certificate for your site as well). Why should people create new standards for HTTPS and URLs simply for Google's benefit? I don't deny that there's a way to make "nytimes.com" work where everything is served by "google.com". What I'm questioning is why we need a completely new web standard for doing so that affects the URL, something that has been standard for decades.
- esrauch 6y ago
  > Why should people create new standards for HTTPS and URLs simply for Google's benefit? Because of the exact reasons that people are complaining about in this very thread: they want NYT to control the content and display the domain name appropriately, but they want to serve it from Google servers and allow for eager prefetching without leaking private details. Today it would be easily possible if NYT just gave Google their private cert, but then Google would be able to serve any content they want as NYT. With the proposed solution they can display the content NYT wants without being able to serve arbitrary other content.

gregable 6y ago

That's correct. Only with the private key can one sign a Signed Exchange for the publisher. Like TLS, if you have the key you can already do quite a lot.

kebman 6y ago

I don't get this. Clearly the contents is served by Google, and so they can do whatever they like with it. How is an end user going to know whether the message was signed before it was passed on or not?

Sephr 6y ago
> How is an end user going to know whether the message was signed before it was passed on or not? Your web browser will show a scary warning and refuse to display the bundle if it's not correctly signed. Google is not going to fake signatures for other sites, as certificate mis-issuance would open up Google to legal consequences.
izacus 6y ago
How does the end user know now that a file from cdn.cloudflare.com is actually coming from NYTimes when it loads and runs code on their browser?
cjhopman 6y ago
That's nonsense. Take a moment to breathe. Think about just typical https, when you request some nytimes.com content that is actually being delivered to you througha bunch of intermediaries. So, by your logic any of those could just change that content. But it turns out, this was a problem solved like 50 years ago. With https, the content is signed by some key that you trust to represent nytimes.com. Sidenote (this is really not targeted at the specific comment): Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. I have to assume that HN's comments are just as useless on things that I don't know about.
- quadrifoliate 6y ago
  > Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. Given that HTTP Signed Exchanges are nowhere near a web standard at this point, I think you should tone down your vitriol considerably. Currently, what the parent commenter is saying is completely valid and true; if you're serving things on your domain and have a cert for it, you can serve https://youdomain.com/<anything> https://youdomain.com/<anything>, where <anything> could be www.nytimes.com, www.google.com, or whatever. HTTP Signed Exchanges proposes a breaking change to this, and therefore is non-intuitive for the vast majority of users.
- dang 6y ago
  Please review and stick to the site guidelines when posting here (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). They explicitly ask you not to lead with things like "That's nonsense. Take a moment to breathe." The rest of your first paragraph is just fine. Re the second paragraph: people are wrong on the internet. If you want a site that doesn't have this problem, you're going to have to look for something considerably smaller, where countering entropy is an option. I think you might be running into the notice-dislike bias, though: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20notice%20dislike&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Edit: I'm dismayed to see that your last 7 comments have all broken the site guidelines. Trashing this place because you don't like some of what other people post, or because you feel superior to the community, is not ok. I'm sure you wouldn't litter in a city park, so please stop doing the equivalent here.

quadrifoliate 6y ago

> but let's stick to what's actually happening with SXG No, Signed HTTP exchanges are something that Google dreamed up so people don't have to see their hegemony over the modern web (or as the article you linked calls it, a shakedown). It's not a browser standard so far, because of Apple and Mozilla's resistance. There are legitimate ways for NYTimes to allow Google to serve content on behalf of them, like so many other CDNs around the world (it usually involves the CDN generating the certificate for your site as well). Why should people create new standards for HTTPS and URLs simply for Google's benefit? I don't deny that there's a way to make "nytimes.com" work where everything is served by "google.com". What I'm questioning is why we need a completely new web standard for doing so that affects the URL, something that has been standard for decades.

esrauch 6y ago
> Why should people create new standards for HTTPS and URLs simply for Google's benefit? Because of the exact reasons that people are complaining about in this very thread: they want NYT to control the content and display the domain name appropriately, but they want to serve it from Google servers and allow for eager prefetching without leaking private details. Today it would be easily possible if NYT just gave Google their private cert, but then Google would be able to serve any content they want as NYT. With the proposed solution they can display the content NYT wants without being able to serve arbitrary other content.