5 ms·

If AMP becomes irrelevant, does this end the war against URLs? Or, with Google owning the most popular browser, does this not matter?

Spivak 6y ago
Probably doesn’t matter since the war on urls is mostly a myth perpetuated by outrage-bait blogspam. By default (i.e. until you click the bar) only showing the part of the URL that the site doesn’t control is really good for security and avoiding phishing. Now apple.paypal.secure.wendys.scamsite.info/payus/wwwcitibank just shows scamsite.info. This is a good thing! And doubly because URL paths and fragments have been made largely irrelevant to end users as app routes. If you're going to rant about the death of the URL you should complain to HN as well that only shows the domain next to posts.
- zbrozek 6y ago
  Why not just bold that part and leave the rest?
  - Spivak 6y ago
    If we're at the point where we're de-emphasizing something because it's almost always visual noise and you don't need to see it often why is "hide it until the bar is selected" worse?
    - zbrozek 6y ago
      I work at an Alphabet company, so at work I use Chrome. Lots of internal tools are really buggy on anything but Chrome, so I have little choice. There's lots of copy-paste of URLs, including fragments, and it's really jarring to have the text suddenly change right after a mouse-up. It's surprising and unpleasant. And of course the browser tries to modify the selection between mouse-up and copy to make sure I get the whole thing, so now the software is not doing what I told it to. It seems harmless to show the full URL and not bait-and-switch the text upon interaction. I don't see it as the browser's job to protect users from their incompetence.
      - themacguffinman 6y ago
        Chrome already visually de-emphasizes the URL path, clearly they don't think it's enough. If you care at all about the health of the web, you should support browsers in protecting users from their own incompetence. Users don't blame themselves for phishing & fraud, when it runs rampant on a platform they simply switch and the end result is that native walled gardens that do protect users win over the web. This is exactly what happened with news on the mobile web; mobile news websites got so slow that Apple & Facebook started gaining a lot of ground with completely closed & proprietary news platforms (Apple News, Facebook Instant), until Google released AMP which both helped & pressured news orgs to get their shit together on the web.
        zbrozek 6y ago
        You started with protection and ended with performance, but I don't see where you connect them. Could you clarify? I see these kinds of features sort of like padding on football players. It enables (encourages?) carelessness. Maybe the jury is still out on the net outcome, but I'm so far away from web development and the overall ecosystem as to have no opinion.
        themacguffinman 6y ago
        The common theme is that in both cases, the web was losing ground to closed, native platforms. If web browsers don't protect users, they stand to lose users to platforms that do protect users in much the same way that slow websites lost users to Apple News & Facebook Instant. Of course it encourages carelessness, that's what users want: they want to care less about the tech they use.They simply want the benefits of tech, not the maintenance or burden of care. It's why many prefer an iPhone that makes all their software choices for them. It's why many trust an email provider to sort & filter their email instead of doing it themselves.
- wzdd 6y ago
  The site controls all parts of the URL. Your example would much more likely show "paypal-accounts.info" or similar.
  - Spivak 6y ago
    True but users are way less likely to fall for that then the hack to push 'paypal.com' to the leftmost position in the bar.
- chrisweekly 6y ago
  Your point about domains and phishing may have some merit. But I strongly object to the idea in your last sentence: >"URL paths and fragments have been made largely irrelevant to end users as app routes" No. Some SPA scenarios, for some end users != "largely irrelevant".
  - Spivak 6y ago
    I mean it's literally one click away. Let me tell you how relevant /reply?id=25150055&goto=threads%3Fid%3DSpivak%2325150055 is to me on this page. If it was id=25151055 I would be worried.
untog 6y ago
What does the "war against URLs" even mean? Sounds like it could be one of two things: 1. Chrome only showing the domain in the address bar No, I doubt it'll make any difference here. Google's reasons for doing that are anti-fraud, not anything to do with AMP. And (I'll give up shouting this into the void one day, I swear) Apple did this with Safari years ago and no-one cared. It's outrage for outrage's sake. 2. The whole "web packaging" format issue Google proposed a standard that let you "fake" the URL of a page (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Mozilla and Apple already came out against it, and one the primary use cases was AMP. I doubt Google will un-implement it any time too soon, but I think it'll end up being a weird edge thing that very few people care about or use.
- dane-pgp 6y ago
  > (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Which is a pity, because this could have been extended into a way to allow browsers to pin a specific version of a web app and warn the user if the server sent something different the next time they visited. Having a TOFU security policy for web apps would have made them roughly comparable to native apps for certain threat models, especially considering that native apps often auto-update without giving the user a meaningful chance to check whether the update is backdoored. For both web and native apps, though, it would be nice if there were independently run Binary Transparency logs published so that apps would only download an update whose source code had been publicly available (and reproducibly buildable) for some reasonable amount of time to allow an audit to occur.
- hrktb 6y ago
  > no-one cared There's not many issues that will gather enough reactions for Apple to ever respond. It would need to be something like removing the eggplant emoji to have anything sizeable from their perspective. A decent amount of people cared about the move to hide most of the URL, just not enough for it to be a wide societal protestation wave.
- decentusername 6y ago
  > Google's reasons for doing that are anti-fraud The problem here is that google has an interest in hiding the URL other than anti-fraud. Apple isn't a major player in the internet market and they have a history of "dumbing down" features, or at least reducing their apparent complexity, to make the experience friendlier to the average user. So when Safari hid the full URL, that didn't raise many eyebrows. Many of Google's moves in recent years, most notably AMP, appear to be part of a larger plan to make the internet require Google to function. Messing around with the URL visible in the address bar seems to fit in with this plan to reduce the average consumer's awareness of where exactly they are going on the internet.

Spivak 6y ago

Probably doesn’t matter since the war on urls is mostly a myth perpetuated by outrage-bait blogspam. By default (i.e. until you click the bar) only showing the part of the URL that the site doesn’t control is really good for security and avoiding phishing. Now apple.paypal.secure.wendys.scamsite.info/payus/wwwcitibank just shows scamsite.info. This is a good thing! And doubly because URL paths and fragments have been made largely irrelevant to end users as app routes. If you're going to rant about the death of the URL you should complain to HN as well that only shows the domain next to posts.

zbrozek 6y ago
Why not just bold that part and leave the rest?
- Spivak 6y ago
  If we're at the point where we're de-emphasizing something because it's almost always visual noise and you don't need to see it often why is "hide it until the bar is selected" worse?
  - zbrozek 6y ago
    I work at an Alphabet company, so at work I use Chrome. Lots of internal tools are really buggy on anything but Chrome, so I have little choice. There's lots of copy-paste of URLs, including fragments, and it's really jarring to have the text suddenly change right after a mouse-up. It's surprising and unpleasant. And of course the browser tries to modify the selection between mouse-up and copy to make sure I get the whole thing, so now the software is not doing what I told it to. It seems harmless to show the full URL and not bait-and-switch the text upon interaction. I don't see it as the browser's job to protect users from their incompetence.
    - themacguffinman 6y ago
      Chrome already visually de-emphasizes the URL path, clearly they don't think it's enough. If you care at all about the health of the web, you should support browsers in protecting users from their own incompetence. Users don't blame themselves for phishing & fraud, when it runs rampant on a platform they simply switch and the end result is that native walled gardens that do protect users win over the web. This is exactly what happened with news on the mobile web; mobile news websites got so slow that Apple & Facebook started gaining a lot of ground with completely closed & proprietary news platforms (Apple News, Facebook Instant), until Google released AMP which both helped & pressured news orgs to get their shit together on the web.
      - zbrozek 6y ago
        You started with protection and ended with performance, but I don't see where you connect them. Could you clarify? I see these kinds of features sort of like padding on football players. It enables (encourages?) carelessness. Maybe the jury is still out on the net outcome, but I'm so far away from web development and the overall ecosystem as to have no opinion.
        themacguffinman 6y ago
        The common theme is that in both cases, the web was losing ground to closed, native platforms. If web browsers don't protect users, they stand to lose users to platforms that do protect users in much the same way that slow websites lost users to Apple News & Facebook Instant. Of course it encourages carelessness, that's what users want: they want to care less about the tech they use.They simply want the benefits of tech, not the maintenance or burden of care. It's why many prefer an iPhone that makes all their software choices for them. It's why many trust an email provider to sort & filter their email instead of doing it themselves.
wzdd 6y ago
The site controls all parts of the URL. Your example would much more likely show "paypal-accounts.info" or similar.
- Spivak 6y ago
  True but users are way less likely to fall for that then the hack to push 'paypal.com' to the leftmost position in the bar.
chrisweekly 6y ago
Your point about domains and phishing may have some merit. But I strongly object to the idea in your last sentence: >"URL paths and fragments have been made largely irrelevant to end users as app routes" No. Some SPA scenarios, for some end users != "largely irrelevant".
- Spivak 6y ago
  I mean it's literally one click away. Let me tell you how relevant /reply?id=25150055&goto=threads%3Fid%3DSpivak%2325150055 is to me on this page. If it was id=25151055 I would be worried.

untog 6y ago

What does the "war against URLs" even mean? Sounds like it could be one of two things: 1. Chrome only showing the domain in the address bar No, I doubt it'll make any difference here. Google's reasons for doing that are anti-fraud, not anything to do with AMP. And (I'll give up shouting this into the void one day, I swear) Apple did this with Safari years ago and no-one cared. It's outrage for outrage's sake. 2. The whole "web packaging" format issue Google proposed a standard that let you "fake" the URL of a page (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Mozilla and Apple already came out against it, and one the primary use cases was AMP. I doubt Google will un-implement it any time too soon, but I think it'll end up being a weird edge thing that very few people care about or use.

dane-pgp 6y ago
> (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Which is a pity, because this could have been extended into a way to allow browsers to pin a specific version of a web app and warn the user if the server sent something different the next time they visited. Having a TOFU security policy for web apps would have made them roughly comparable to native apps for certain threat models, especially considering that native apps often auto-update without giving the user a meaningful chance to check whether the update is backdoored. For both web and native apps, though, it would be nice if there were independently run Binary Transparency logs published so that apps would only download an update whose source code had been publicly available (and reproducibly buildable) for some reasonable amount of time to allow an audit to occur.
hrktb 6y ago
> no-one cared There's not many issues that will gather enough reactions for Apple to ever respond. It would need to be something like removing the eggplant emoji to have anything sizeable from their perspective. A decent amount of people cared about the move to hide most of the URL, just not enough for it to be a wide societal protestation wave.
decentusername 6y ago
> Google's reasons for doing that are anti-fraud The problem here is that google has an interest in hiding the URL other than anti-fraud. Apple isn't a major player in the internet market and they have a history of "dumbing down" features, or at least reducing their apparent complexity, to make the experience friendlier to the average user. So when Safari hid the full URL, that didn't raise many eyebrows. Many of Google's moves in recent years, most notably AMP, appear to be part of a larger plan to make the internet require Google to function. Messing around with the URL visible in the address bar seems to fit in with this plan to reduce the average consumer's awareness of where exactly they are going on the internet.