3 ms·

So what do you think about the privacy concerns raised in the article, which seem like the more important point?

jefftk 6y ago
The privacy concerns raised in the article are, as spankalee explains, based on a misunderstanding of what WebBundles make easier. (Disclosure: I also work for Google)
- edoceo 6y ago
  No, the tech claims were wrong but since remaking bundles is proven cheap and easy then the bundles can quickly be modified to have malicious payload (for some definition of malicious)
designium 6y ago
Interestingly, most comments are talking about the cache/tech capabilities and not the privacy concerns. I mean the way it was shown is that WebBundles allow the author of that content to arbitrary hide and package content in such a way where you cannot filter specific content; so either you view a page with ads and trackers or you don't see anything at all.
- spankalee 6y ago
  WebBundles can't hide content any more than a regular server can, and blockers can block individual resources from a bundle like they can individual URLs from a server.
  - fabrice_d 6y ago
    but you have to download the whole bundle so you don't get the benefits of blocking at the loading stage, which is quite impactful.
    - tankenmate 6y ago
      remember that chrome / chromium hamstrung the ability to block at the loading stage; only firefox, ff derivatives and hacked up chromium derivatives can still block prior to loading with complex rules.
spankalee 6y ago
All claims seem to be based on the same URL mapping ability that's ascribed to WebBundles and for some reason, not servers or edge workers. The infrastructure needed to randomize and remap URLs for bundles is basically the same as for endpoint URLs. You can already serve all requested content, including things a blocker might want to block, as first party, meaningless URLs. https://my-site.com/1g276dn4kas https://my-site.com/1g276dn4kas for everything. Store the URL map in the session data rather than bundle. I don't even think the hard part in either case is mapping the URLs and serving the content, but rewriting all the references to the URLs in the source files.

The privacy concerns raised in the article are, as spankalee explains, based on a misunderstanding of what WebBundles make easier. (Disclosure: I also work for Google)

edoceo 6y ago
No, the tech claims were wrong but since remaking bundles is proven cheap and easy then the bundles can quickly be modified to have malicious payload (for some definition of malicious)

designium 6y ago

Interestingly, most comments are talking about the cache/tech capabilities and not the privacy concerns. I mean the way it was shown is that WebBundles allow the author of that content to arbitrary hide and package content in such a way where you cannot filter specific content; so either you view a page with ads and trackers or you don't see anything at all.

spankalee 6y ago
WebBundles can't hide content any more than a regular server can, and blockers can block individual resources from a bundle like they can individual URLs from a server.
- fabrice_d 6y ago
  but you have to download the whole bundle so you don't get the benefits of blocking at the loading stage, which is quite impactful.
  - tankenmate 6y ago
    remember that chrome / chromium hamstrung the ability to block at the loading stage; only firefox, ff derivatives and hacked up chromium derivatives can still block prior to loading with complex rules.

spankalee 6y ago

All claims seem to be based on the same URL mapping ability that's ascribed to WebBundles and for some reason, not servers or edge workers. The infrastructure needed to randomize and remap URLs for bundles is basically the same as for endpoint URLs. You can already serve all requested content, including things a blocker might want to block, as first party, meaningless URLs. https://my-site.com/1g276dn4kas https://my-site.com/1g276dn4kas for everything. Store the URL map in the session data rather than bundle. I don't even think the hard part in either case is mapping the URLs and serving the content, but rewriting all the references to the URLs in the source files.