4 ms·

I don't get this. Clearly the contents is served by Google, and so they can do whatever they like with it. How is an end user going to know whether the message

by kebman 6y ago

I don't get this. Clearly the contents is served by Google, and so they can do whatever they like with it. How is an end user going to know whether the message was signed before it was passed on or not?

Sephr 6y ago
> How is an end user going to know whether the message was signed before it was passed on or not? Your web browser will show a scary warning and refuse to display the bundle if it's not correctly signed. Google is not going to fake signatures for other sites, as certificate mis-issuance would open up Google to legal consequences.
izacus 6y ago
How does the end user know now that a file from cdn.cloudflare.com is actually coming from NYTimes when it loads and runs code on their browser?
cjhopman 6y ago
That's nonsense. Take a moment to breathe. Think about just typical https, when you request some nytimes.com content that is actually being delivered to you througha bunch of intermediaries. So, by your logic any of those could just change that content. But it turns out, this was a problem solved like 50 years ago. With https, the content is signed by some key that you trust to represent nytimes.com. Sidenote (this is really not targeted at the specific comment): Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. I have to assume that HN's comments are just as useless on things that I don't know about.
- quadrifoliate 6y ago
  > Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. Given that HTTP Signed Exchanges are nowhere near a web standard at this point, I think you should tone down your vitriol considerably. Currently, what the parent commenter is saying is completely valid and true; if you're serving things on your domain and have a cert for it, you can serve https://youdomain.com/<anything> https://youdomain.com/<anything>, where <anything> could be www.nytimes.com, www.google.com, or whatever. HTTP Signed Exchanges proposes a breaking change to this, and therefore is non-intuitive for the vast majority of users.
- dang 6y ago
  Please review and stick to the site guidelines when posting here (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). They explicitly ask you not to lead with things like "That's nonsense. Take a moment to breathe." The rest of your first paragraph is just fine. Re the second paragraph: people are wrong on the internet. If you want a site that doesn't have this problem, you're going to have to look for something considerably smaller, where countering entropy is an option. I think you might be running into the notice-dislike bias, though: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20notice%20dislike&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Edit: I'm dismayed to see that your last 7 comments have all broken the site guidelines. Trashing this place because you don't like some of what other people post, or because you feel superior to the community, is not ok. I'm sure you wouldn't litter in a city park, so please stop doing the equivalent here.

by kebman 6y ago

Sephr 6y ago

> How is an end user going to know whether the message was signed before it was passed on or not? Your web browser will show a scary warning and refuse to display the bundle if it's not correctly signed. Google is not going to fake signatures for other sites, as certificate mis-issuance would open up Google to legal consequences.

izacus 6y ago

How does the end user know now that a file from cdn.cloudflare.com is actually coming from NYTimes when it loads and runs code on their browser?

cjhopman 6y ago

That's nonsense. Take a moment to breathe. Think about just typical https, when you request some nytimes.com content that is actually being delivered to you througha bunch of intermediaries. So, by your logic any of those could just change that content. But it turns out, this was a problem solved like 50 years ago. With https, the content is signed by some key that you trust to represent nytimes.com. Sidenote (this is really not targeted at the specific comment): Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. I have to assume that HN's comments are just as useless on things that I don't know about.

quadrifoliate 6y ago
> Is there some site where people actually have a clue? On any topic that I have any passing knowledge about, HN is just completely spewing nonsense and the worst part about it is that they think they have a clue. Given that HTTP Signed Exchanges are nowhere near a web standard at this point, I think you should tone down your vitriol considerably. Currently, what the parent commenter is saying is completely valid and true; if you're serving things on your domain and have a cert for it, you can serve https://youdomain.com/<anything> https://youdomain.com/<anything>, where <anything> could be www.nytimes.com, www.google.com, or whatever. HTTP Signed Exchanges proposes a breaking change to this, and therefore is non-intuitive for the vast majority of users.
dang 6y ago
Please review and stick to the site guidelines when posting here (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). They explicitly ask you not to lead with things like "That's nonsense. Take a moment to breathe." The rest of your first paragraph is just fine. Re the second paragraph: people are wrong on the internet. If you want a site that doesn't have this problem, you're going to have to look for something considerably smaller, where countering entropy is an option. I think you might be running into the notice-dislike bias, though: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20notice%20dislike&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Edit: I'm dismayed to see that your last 7 comments have all broken the site guidelines. Trashing this place because you don't like some of what other people post, or because you feel superior to the community, is not ok. I'm sure you wouldn't litter in a city park, so please stop doing the equivalent here.