4 ms·

What does the "war against URLs" even mean? Sounds like it could be one of two things: 1. Chrome only showing the domain in the address bar No, I doubt it'll

by untog 6y ago

What does the "war against URLs" even mean? Sounds like it could be one of two things: 1. Chrome only showing the domain in the address bar No, I doubt it'll make any difference here. Google's reasons for doing that are anti-fraud, not anything to do with AMP. And (I'll give up shouting this into the void one day, I swear) Apple did this with Safari years ago and no-one cared. It's outrage for outrage's sake. 2. The whole "web packaging" format issue Google proposed a standard that let you "fake" the URL of a page (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Mozilla and Apple already came out against it, and one the primary use cases was AMP. I doubt Google will un-implement it any time too soon, but I think it'll end up being a weird edge thing that very few people care about or use.

dane-pgp 6y ago
> (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Which is a pity, because this could have been extended into a way to allow browsers to pin a specific version of a web app and warn the user if the server sent something different the next time they visited. Having a TOFU security policy for web apps would have made them roughly comparable to native apps for certain threat models, especially considering that native apps often auto-update without giving the user a meaningful chance to check whether the update is backdoored. For both web and native apps, though, it would be nice if there were independently run Binary Transparency logs published so that apps would only download an update whose source code had been publicly available (and reproducibly buildable) for some reasonable amount of time to allow an audit to occur.
hrktb 6y ago
> no-one cared There's not many issues that will gather enough reactions for Apple to ever respond. It would need to be something like removing the eggplant emoji to have anything sizeable from their perspective. A decent amount of people cared about the move to hide most of the URL, just not enough for it to be a wide societal protestation wave.
decentusername 6y ago
> Google's reasons for doing that are anti-fraud The problem here is that google has an interest in hiding the URL other than anti-fraud. Apple isn't a major player in the internet market and they have a history of "dumbing down" features, or at least reducing their apparent complexity, to make the experience friendlier to the average user. So when Safari hid the full URL, that didn't raise many eyebrows. Many of Google's moves in recent years, most notably AMP, appear to be part of a larger plan to make the internet require Google to function. Messing around with the URL visible in the address bar seems to fit in with this plan to reduce the average consumer's awareness of where exactly they are going on the internet.

by untog 6y ago

dane-pgp 6y ago

> (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Which is a pity, because this could have been extended into a way to allow browsers to pin a specific version of a web app and warn the user if the server sent something different the next time they visited. Having a TOFU security policy for web apps would have made them roughly comparable to native apps for certain threat models, especially considering that native apps often auto-update without giving the user a meaningful chance to check whether the update is backdoored. For both web and native apps, though, it would be nice if there were independently run Binary Transparency logs published so that apps would only download an update whose source code had been publicly available (and reproducibly buildable) for some reasonable amount of time to allow an audit to occur.

hrktb 6y ago

> no-one cared There's not many issues that will gather enough reactions for Apple to ever respond. It would need to be something like removing the eggplant emoji to have anything sizeable from their perspective. A decent amount of people cared about the move to hide most of the URL, just not enough for it to be a wide societal protestation wave.

decentusername 6y ago

> Google's reasons for doing that are anti-fraud The problem here is that google has an interest in hiding the URL other than anti-fraud. Apple isn't a major player in the internet market and they have a history of "dumbing down" features, or at least reducing their apparent complexity, to make the experience friendlier to the average user. So when Safari hid the full URL, that didn't raise many eyebrows. Many of Google's moves in recent years, most notably AMP, appear to be part of a larger plan to make the internet require Google to function. Messing around with the URL visible in the address bar seems to fit in with this plan to reduce the average consumer's awareness of where exactly they are going on the internet.