13 ms·

Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..." Google has millions / billions of users. From a security

Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..." Google has millions / billions of users. From a security standpoint the focus should be entirely on the root domain, that is the only really meaningful root of trust. If you are talking about a security issue - the KEY security issue is ANY lack of clarity around root domain. "Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage." is a statement they have around this change. I think I agree - I suspect other browsers will have to copy chrome (again) in de-emphasizing the leading URL (often used for fishing). Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant. A fair number of enterprises have (finally) started slow slow switch to mandating chrome.

trekrich 6y ago
at what point is not any longer? Once the URL bar has gone?!
MaxBarraclough 6y ago
> their focus on things like ... security ... helped them become absolutely dominant I don't think Chrome's security features had anything to do with its ascension. Chrome took off because it was fast and had a good UI (iirc it had the ability to drag a tab from one window to another, a while before other browsers did). The average user knows nothing of the security features of their browser.
- chillfox 6y ago
  Also you couldn’t use google search in a different browser without constantly getting harassed to install chrome
- acheron 6y ago
  Chrome took off because Google leveraged their position in another area (search engine) in order to push it. Exactly what people were concerned about with Microsoft and Windows/IE.
  - MaxBarraclough 6y ago
    That's not the whole story. Plenty of people moved from Firefox to Chrome, because they found Chrome to be the better browser.
    - badwolf 6y ago
      Even Microsoft thought that with Edge.
      - kd913 6y ago
        I think Microsoft at the time probably thought it's own engine was also better in many ways. It was in several regarding power efficiency and things like pen/pdf support. Reason Chromium was chosen was more because they already had a bunch of developer experience with the engine. That and more importantly it would cause Google to lose some control over Chrome and the web. Now Google can't exactly do further anti-competitor shenanigans like the whole shadowDOM fiasco and youtube. In this case adding random features to chrome, implementing them and causing other browsers to have a bad experience. That and because edge is as fast as chrome (if not faster), there is less of an incentive to switch to chrome. Oh and Microsoft is one of the few companies to be able to maintain a hostile fork of chrome and have it competitive. Largely because they have enough resources to match google for Chromium. This is one of those cases where Microsoft can subtly claw back marketshare by playing the strength of chromium against Google. They wouldn't be able to do the same at all with Gecko/Firefox.
- donor20 6y ago
  It did in a domain I'm familiar with. I think they were the first to have separate processes for tabs (?) which you could really see add robustness - when flash could blow up your session etc you could much more easily close out the offending tab. They were stricter and more prompt in blocking things like activex controls, they'd remove features tabs would use to try to take control of your session or confuse you. All these enhanced security and usability.
  - MaxBarraclough 6y ago
    There's no disagreement here. Chrome brought lots of good security enhancements, and raised the bar for other browsers, but security isn't the reason people made the switch. Yes, Chrome was the first to do process-isolation. As for ActiveX, I believe that's generally only available through Internet Explorer (not Edge), I don't think Chrome ever supported it. [0] [0] https://en.wikipedia.org/wiki/ActiveX#ActiveX_in_non-Internet_Explorer_applications https://en.wikipedia.org/wiki/ActiveX#ActiveX_in_non-Interne...
mrmcd 6y ago
The degree to which HN is obsessed with AMP is hilarious at times. You'd think every single one of the 100k engineers that work there do nothing but dream up ways to trick people into using AMP for some secret illuminati end goal. If you don't like AMP, that's fine. If you don't like this UX change that's fine too (and I suspect will be easily fixed with an extension). But maybe consider for a moment that not every single UX change to a product with a billion users is part of the vast AMPiracy.
- maest 6y ago
  I'm all for balanced debate, but strawmanning doesn't help anyone.
  - thethethethe 6y ago
    How this this a straw man? Parent is just agreeing with gp that a lot of HN users are obsessed with AMP and it’s supposed evils Disclaimer: googler opinions are my own
    - maest 6y ago
      Nobody is claiming the following ridiculous statements: > every single one of the 100k engineers that work there do nothing but dream up ways to trick people into using AMP for some secret illuminati end goal. > every single UX change to a product with a billion users is part of the vast AMPiracy.
      - thethethethe 6y ago
        First of all, parent is not arguing with anyone, they are building on gp’s comment. Parent is using hyperbole as a rhetorical tool to make a point, not to distort or discredit a particular persons statements
- davidu 6y ago
  You say this as if those engineers (and it's not 100,000) are all voting in a democratic decision-making process on feature direction. It's a very small number of senior leaders who make these calls. Remember, Sundar used to be in charge of the Google Toolbar. That was his claim to fame inside of Google before Chrome.
badwolf 6y ago
My first thought when reading this was relief... For my mother. I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login HN users are fantastic at thinking all technologies should revolve around their niche use case.
- p7hwfizeONj 6y ago
  It looks like non-trivial subdomains will still appear and those seem to me to be the most problematic.
- dgb23 6y ago
  The root domain is highlighted in FF. This must be enough for visual testing. If you want a more reliable approach then you need to work with a whitelist and clear warnings.
  - summerlight 6y ago
    I wouldn't assert it without strong evidence. This URL comprehension problem is probably more complex than what people usually think. There are a number of studies about this issue, if you're interested. https://storage.googleapis.com/pub-tools-public-publication-data/pdf/400599205ab5a1c9efa03e2a7c127eb8200bf288.pdf https://storage.googleapis.com/pub-tools-public-publication-... https://kumarde.com/papers/urls.pdf https://kumarde.com/papers/urls.pdf
    - dgb23 6y ago
      Thank you for those! Side question: I don't have a formal education in CS, but I really enjoy reading papers on programming (languages), architecture, data-engineering and web related things among others, especially when they have a practical focus/impact. Is there a good way for me to find or rather discover resources like these?
      - 6y ago
twirlock 6y ago
> conspiracy theories 2007 called. They want their deflection back.
coronadisaster 6y ago
> Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant. Security is a very small factor, if a factor at all, for Chrome to have become dominant. The main reason is because they keep/kept pushing everyone to install Chrome when you visited https://google.com https://google.com (by showing you a small popup window).
- hu3 6y ago
  Do you have evidence? Because I remember trying Chrome and immediately switching because it was miles ahead. So did my friends. It was faster and had slicker UI. Nobody keeps using a shittier browser no matter how many times you shove it on their faces. Btw Chrome is still faster than Firefox for stuff that matters and often by a considerable amount: https://www.phoronix.com/scan.php?page=article&item=chrome83-firefox77-linux&num=1 https://www.phoronix.com/scan.php?page=article&item=chrome83...
  - coronadisaster 6y ago
    I don't really have any evidence (hopefully Google will be required to release that evidence in a monopoly probe) besides what I recall from advertising but security certainly doesn't seem to be the primary factor. Speed certainly brought in a lot of users, but by the time Firefox caught up, I am not sure what the market share was (at first there was a huge difference in performance, I don't think that today's difference in performance is comparable).
    - coronadisaster 6y ago
      By the way, where is the evidence for your claims that a small change in performance equals large market share?
- donor20 6y ago
  Microsoft had IE as the DEFAULT - and did plenty of pushing itself. Across almost all dimensions chrome was better when it came out - people seem to forget how horrible browsers were historically (and how easily abused). I know ages ago of an entity that just got tired of dealing with the problems folks caused not using chrome (whether it was chrome's website blacklists or whatever - folks using chrome were less likely to get ransomeware - period). Literally - EVERY install of crap seemed to be coming from IE users, except one case I know of where someone had a chrome extension change hands and go rouge.
kevingadd 6y ago
Domains are only a meaningful root of trust if they're tightly controlled by a small set of people. A piece of content being on 'news.ycombinator.com' or 'github.com' literally tells me nothing about how trustworthy it is. In the case of yc, i have to look at the poster, and the actual content, and the replies to it. For github, I have to look at things like who posted the code and which repository it's in - both things that are displayed in the URL, oddly enough... Google's URLs are of course long strings of useless hex/base64 garbage, so it's natural that they want to hide them.
- donor20 6y ago
  100% false. If you login to news.ycombinator.com it's unlikely you are logging into a fishing site for ycombinator. If you login to github.com - again, very unlikely github is running a phishing scam on you. Do folks not understand the importance of this?
izacus 6y ago
The strange part there is that this is mobile Chrome following the mobile Safari UX which has never been criticised like this. It's just bizarre.
- untog 6y ago
  Even desktop Safari does this by default! And yet no one was outraged.
  - andrekandre 6y ago
    i think its because apple isnt trying to mitm your web browsing with some amp-style service (yet)
    - jsnell 6y ago
      But Apple does blatantly MITM urls into their own proprietary walled garden! Just a few days ago there was a HN post about Safari On iOS 14 redirecting from certain articles to Apple News. It was, of course, quickly flagged away from the front page. https://news.ycombinator.com/item?id=24113056 https://news.ycombinator.com/item?id=24113056
      - andrekandre 6y ago
        > It was, of course, quickly flagged away from the front page. what does that imply?
        themacguffinman 6y ago
        That the HN audience in aggregate has a hypocritically lower appetite and interest in Apple's web shenanigans, given that a moderator never identified anything actually wrong with the submission and given that Google would be crucified for a similar action in Chrome for Android.
        6y ago
CptCrunch 6y ago
Google has not only become dominant because their product is good. First and foremost, they leveraged their market power through android and their search engine to get people to use chrome.
- mav3rick 6y ago
  Lol ? You do know Android was nascent when Chrome became dominant.
- buttersbrian 6y ago
  As another said -- chrome was dominant before Android was a player. Firefox blew a hole in the IE wall. Then chrome came along and was more acid compliant, leaner (Ux/ui), faster, and it's approach of per-tab processes was superior to a lock-up prone Firefox, or IE.
  - marcosdumay 6y ago
    Firefox required admin rights to install on Windows, what locked most of the user base out of its reach. Chrome got his market by silently installing as the IE rendering engine, and by being bundled with other software.
    - buttersbrian 6y ago
      I don't think there was anything silent, IMO. The other biggest factor IMO Chrome greatly focusing on developer tools --> eventually stealing away firebug dev, and in turn taking the throne as the developer browser of choice.
      - marcosdumay 6y ago
        Chrome was already very popular by the time it became any good (compared to Firefox). But even sooner than they investing in dev-tools, they made a killing from tab isolation right at a time when Firefox had most of its stability problems.
deleted 6y ago
[deleted]
unethical_ban 6y ago
They could emphasize the FQDN without removing the URL.
- tbodt 6y ago
  They've been doing this (showing the rest in grey) for a long time.
- donor20 6y ago
  People (at least some %) just trigger on see the company name in the bar - if I gave a pop quick to all your relatives do you think they could accruately manager to describe all the separators and what they mean? ?&/: etc? They've wanted to remove the URL for AT LEAST 6 years - it's been a well known issue inside google that URL's dont' do a good job showing orgin info. Didn't they have the origin chip idea way back?
paulnechifor 6y ago
"Conspiracy theory!" has become a term for dismissing genuine concerns.
- exclipy 6y ago
  So the theory is that this is part of Google's evil plan to make it impossible to tell the difference between an AMP page and the real page because the next step is to remove the URL bar. Given that this change makes it plainly obvious what domain you're on... Now tell tell me if this is a genuine concern or a conspiracy theory.
ric2b 6y ago
They could just color it differently or show it in bold text. Hiding the rest is clearly motivated by something else.

trekrich 6y ago

at what point is not any longer? Once the URL bar has gone?!

MaxBarraclough 6y ago

> their focus on things like ... security ... helped them become absolutely dominant I don't think Chrome's security features had anything to do with its ascension. Chrome took off because it was fast and had a good UI (iirc it had the ability to drag a tab from one window to another, a while before other browsers did). The average user knows nothing of the security features of their browser.

chillfox 6y ago
Also you couldn’t use google search in a different browser without constantly getting harassed to install chrome
acheron 6y ago
Chrome took off because Google leveraged their position in another area (search engine) in order to push it. Exactly what people were concerned about with Microsoft and Windows/IE.
- MaxBarraclough 6y ago
  That's not the whole story. Plenty of people moved from Firefox to Chrome, because they found Chrome to be the better browser.
  - badwolf 6y ago
    Even Microsoft thought that with Edge.
    - kd913 6y ago
      I think Microsoft at the time probably thought it's own engine was also better in many ways. It was in several regarding power efficiency and things like pen/pdf support. Reason Chromium was chosen was more because they already had a bunch of developer experience with the engine. That and more importantly it would cause Google to lose some control over Chrome and the web. Now Google can't exactly do further anti-competitor shenanigans like the whole shadowDOM fiasco and youtube. In this case adding random features to chrome, implementing them and causing other browsers to have a bad experience. That and because edge is as fast as chrome (if not faster), there is less of an incentive to switch to chrome. Oh and Microsoft is one of the few companies to be able to maintain a hostile fork of chrome and have it competitive. Largely because they have enough resources to match google for Chromium. This is one of those cases where Microsoft can subtly claw back marketshare by playing the strength of chromium against Google. They wouldn't be able to do the same at all with Gecko/Firefox.
donor20 6y ago
It did in a domain I'm familiar with. I think they were the first to have separate processes for tabs (?) which you could really see add robustness - when flash could blow up your session etc you could much more easily close out the offending tab. They were stricter and more prompt in blocking things like activex controls, they'd remove features tabs would use to try to take control of your session or confuse you. All these enhanced security and usability.
- MaxBarraclough 6y ago
  There's no disagreement here. Chrome brought lots of good security enhancements, and raised the bar for other browsers, but security isn't the reason people made the switch. Yes, Chrome was the first to do process-isolation. As for ActiveX, I believe that's generally only available through Internet Explorer (not Edge), I don't think Chrome ever supported it. [0] [0] https://en.wikipedia.org/wiki/ActiveX#ActiveX_in_non-Internet_Explorer_applications https://en.wikipedia.org/wiki/ActiveX#ActiveX_in_non-Interne...

mrmcd 6y ago

The degree to which HN is obsessed with AMP is hilarious at times. You'd think every single one of the 100k engineers that work there do nothing but dream up ways to trick people into using AMP for some secret illuminati end goal. If you don't like AMP, that's fine. If you don't like this UX change that's fine too (and I suspect will be easily fixed with an extension). But maybe consider for a moment that not every single UX change to a product with a billion users is part of the vast AMPiracy.

maest 6y ago
I'm all for balanced debate, but strawmanning doesn't help anyone.
- thethethethe 6y ago
  How this this a straw man? Parent is just agreeing with gp that a lot of HN users are obsessed with AMP and it’s supposed evils Disclaimer: googler opinions are my own
  - maest 6y ago
    Nobody is claiming the following ridiculous statements: > every single one of the 100k engineers that work there do nothing but dream up ways to trick people into using AMP for some secret illuminati end goal. > every single UX change to a product with a billion users is part of the vast AMPiracy.
    - thethethethe 6y ago
      First of all, parent is not arguing with anyone, they are building on gp’s comment. Parent is using hyperbole as a rhetorical tool to make a point, not to distort or discredit a particular persons statements
davidu 6y ago
You say this as if those engineers (and it's not 100,000) are all voting in a democratic decision-making process on feature direction. It's a very small number of senior leaders who make these calls. Remember, Sundar used to be in charge of the Google Toolbar. That was his claim to fame inside of Google before Chrome.

badwolf 6y ago

My first thought when reading this was relief... For my mother. I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login HN users are fantastic at thinking all technologies should revolve around their niche use case.

p7hwfizeONj 6y ago
It looks like non-trivial subdomains will still appear and those seem to me to be the most problematic.
dgb23 6y ago
The root domain is highlighted in FF. This must be enough for visual testing. If you want a more reliable approach then you need to work with a whitelist and clear warnings.
- summerlight 6y ago
  I wouldn't assert it without strong evidence. This URL comprehension problem is probably more complex than what people usually think. There are a number of studies about this issue, if you're interested. https://storage.googleapis.com/pub-tools-public-publication-data/pdf/400599205ab5a1c9efa03e2a7c127eb8200bf288.pdf https://storage.googleapis.com/pub-tools-public-publication-... https://kumarde.com/papers/urls.pdf https://kumarde.com/papers/urls.pdf
  - dgb23 6y ago
    Thank you for those! Side question: I don't have a formal education in CS, but I really enjoy reading papers on programming (languages), architecture, data-engineering and web related things among others, especially when they have a practical focus/impact. Is there a good way for me to find or rather discover resources like these?
    - 6y ago

twirlock 6y ago

> conspiracy theories 2007 called. They want their deflection back.

coronadisaster 6y ago

> Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant. Security is a very small factor, if a factor at all, for Chrome to have become dominant. The main reason is because they keep/kept pushing everyone to install Chrome when you visited https://google.com https://google.com (by showing you a small popup window).

hu3 6y ago
Do you have evidence? Because I remember trying Chrome and immediately switching because it was miles ahead. So did my friends. It was faster and had slicker UI. Nobody keeps using a shittier browser no matter how many times you shove it on their faces. Btw Chrome is still faster than Firefox for stuff that matters and often by a considerable amount: https://www.phoronix.com/scan.php?page=article&item=chrome83-firefox77-linux&num=1 https://www.phoronix.com/scan.php?page=article&item=chrome83...
- coronadisaster 6y ago
  I don't really have any evidence (hopefully Google will be required to release that evidence in a monopoly probe) besides what I recall from advertising but security certainly doesn't seem to be the primary factor. Speed certainly brought in a lot of users, but by the time Firefox caught up, I am not sure what the market share was (at first there was a huge difference in performance, I don't think that today's difference in performance is comparable).
  - coronadisaster 6y ago
    By the way, where is the evidence for your claims that a small change in performance equals large market share?
donor20 6y ago
Microsoft had IE as the DEFAULT - and did plenty of pushing itself. Across almost all dimensions chrome was better when it came out - people seem to forget how horrible browsers were historically (and how easily abused). I know ages ago of an entity that just got tired of dealing with the problems folks caused not using chrome (whether it was chrome's website blacklists or whatever - folks using chrome were less likely to get ransomeware - period). Literally - EVERY install of crap seemed to be coming from IE users, except one case I know of where someone had a chrome extension change hands and go rouge.

kevingadd 6y ago

Domains are only a meaningful root of trust if they're tightly controlled by a small set of people. A piece of content being on 'news.ycombinator.com' or 'github.com' literally tells me nothing about how trustworthy it is. In the case of yc, i have to look at the poster, and the actual content, and the replies to it. For github, I have to look at things like who posted the code and which repository it's in - both things that are displayed in the URL, oddly enough... Google's URLs are of course long strings of useless hex/base64 garbage, so it's natural that they want to hide them.

donor20 6y ago
100% false. If you login to news.ycombinator.com it's unlikely you are logging into a fishing site for ycombinator. If you login to github.com - again, very unlikely github is running a phishing scam on you. Do folks not understand the importance of this?

izacus 6y ago

The strange part there is that this is mobile Chrome following the mobile Safari UX which has never been criticised like this. It's just bizarre.

untog 6y ago
Even desktop Safari does this by default! And yet no one was outraged.
- andrekandre 6y ago
  i think its because apple isnt trying to mitm your web browsing with some amp-style service (yet)
  - jsnell 6y ago
    But Apple does blatantly MITM urls into their own proprietary walled garden! Just a few days ago there was a HN post about Safari On iOS 14 redirecting from certain articles to Apple News. It was, of course, quickly flagged away from the front page. https://news.ycombinator.com/item?id=24113056 https://news.ycombinator.com/item?id=24113056
    - andrekandre 6y ago
      > It was, of course, quickly flagged away from the front page. what does that imply?
      - themacguffinman 6y ago
        That the HN audience in aggregate has a hypocritically lower appetite and interest in Apple's web shenanigans, given that a moderator never identified anything actually wrong with the submission and given that Google would be crucified for a similar action in Chrome for Android.
        6y ago

CptCrunch 6y ago

Google has not only become dominant because their product is good. First and foremost, they leveraged their market power through android and their search engine to get people to use chrome.

mav3rick 6y ago
Lol ? You do know Android was nascent when Chrome became dominant.
buttersbrian 6y ago
As another said -- chrome was dominant before Android was a player. Firefox blew a hole in the IE wall. Then chrome came along and was more acid compliant, leaner (Ux/ui), faster, and it's approach of per-tab processes was superior to a lock-up prone Firefox, or IE.
- marcosdumay 6y ago
  Firefox required admin rights to install on Windows, what locked most of the user base out of its reach. Chrome got his market by silently installing as the IE rendering engine, and by being bundled with other software.
  - buttersbrian 6y ago
    I don't think there was anything silent, IMO. The other biggest factor IMO Chrome greatly focusing on developer tools --> eventually stealing away firebug dev, and in turn taking the throne as the developer browser of choice.
    - marcosdumay 6y ago
      Chrome was already very popular by the time it became any good (compared to Firefox). But even sooner than they investing in dev-tools, they made a killing from tab isolation right at a time when Firefox had most of its stability problems.

deleted 6y ago

[deleted]

unethical_ban 6y ago

They could emphasize the FQDN without removing the URL.

tbodt 6y ago
They've been doing this (showing the rest in grey) for a long time.
donor20 6y ago
People (at least some %) just trigger on see the company name in the bar - if I gave a pop quick to all your relatives do you think they could accruately manager to describe all the separators and what they mean? ?&/: etc? They've wanted to remove the URL for AT LEAST 6 years - it's been a well known issue inside google that URL's dont' do a good job showing orgin info. Didn't they have the origin chip idea way back?

paulnechifor 6y ago

"Conspiracy theory!" has become a term for dismissing genuine concerns.

exclipy 6y ago
So the theory is that this is part of Google's evil plan to make it impossible to tell the difference between an AMP page and the real page because the next step is to remove the URL bar. Given that this change makes it plainly obvious what domain you're on... Now tell tell me if this is a genuine concern or a conspiracy theory.

ric2b 6y ago

They could just color it differently or show it in bold text. Hiding the rest is clearly motivated by something else.