5 ms·

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a w

by mtrovo 6y ago

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for several unrelated parties, think hosting a store on Shopify (1 domain for N parties). This is so ambiguous that even inside the browser you have two different implementations on the way you handle this attribution, one for cookies and one for Single-Origin Policy. There's a good write up about this problem at https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems. Sometimes I wonder how the web got here with the amount of kludge that we have to carry.

bigth 6y ago
Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.
- gsich 6y ago
  How is this faster? More DNS requests, more TCP connections. At first this is purely slower.
  - hoppi 6y ago
    Pretty sure in HTTP 1.1, there was a max amount of concurrent requests per server/proxy. So using different domains allowed more rq/s.
  - diggan 6y ago
    Browsers used to/still do max number of connections per domain. Adding more domains allows you to do more concurrent requests.
    - kevin_thibedeau 6y ago
      With HTTPS you have to handshake for the first connection on each domain.
      - weird-eye-issue 6y ago
        Yes and it still outweighed that especially if you were loading a lot of images or a stupid amount of different JS/CSS files
  - kevingadd 6y ago
    More connections = better parallelism = faster downloads The DNS is cached.
  - sdflhasjd 6y ago
    It spreads out the load on disks and outbound bandwidth.
    - weird-eye-issue 6y ago
      You are making the assumption that the domain pointed to different physical servers. To get the benefits of what everyone else is describing it does not matter what the domains actually are pointing to.
  - fuzzy2 6y ago
    A separate domain name for static assets would not receive any cookies of the actual site. This means less data transferred and in theory a proxy closer to the user could more easily cache these requests, even for multiple clients.
  - TomGullen 6y ago
    Before HTTP2 this was common
  - herf 6y ago
    Upstreams were very limited, and HTTP requests send cookie data in each GET. For instance, if you had a 128kbps DSL upstream and each request was 2KB (loaded up with cookies), you're already limited to 8 requests/second. A cookie-less domain for small resources helped this a lot.
- stjohnswarts 6y ago
  That's an infrastructure problem. Sure you can solve it with domains, but you can also easily use other current technologies for it with no issues as well and never change the domain name at all.
- hinkley 6y ago
  NCSA was using regional DNS for load balancing in '95. I don't know who invented it but it's at least 25 years old.
swiley 6y ago
That's a good point, the domain should have to match exactly.
throwaway1492 6y ago
> (googler here, but this is my opinion) Sergei here, gtf back to work and stop posting company policy on social media!
1shooner 6y ago
>in a way that we shouldn't assume any ownership only based on the domain itself. I probably have a naive understanding of this, but why not? In your Shopify example, users should certainly be taught that Shopify does have ownership of mystore.shopify.com (in at least the 'security' and 'privacy' areas of concern from the write-up). Likewise, entities proxying resources controlled by others through their own domains (e.g. CNAME cloaking) should take responsibility for what they are serving and how they are exposing their clients.
- mtrovo 6y ago
  mystore.shopify.com is definitely hosted by Shopify but it's content is a totally isolated entity. You can trust laptops.shopify.com but this trust should not automatically transfer to fakestore.shopify.com. In the same way if you have a valid account on laptops.shopify.com, the browser shouldn't allow fakestore.shopify.com to emit a request and buy something on laptops.shopify.com with your valid session on your behalf, even though they're on the base domain. You have also the parallel problem of how do you transfer the trust you have on google.co.uk to youtube.co.jp only based on the domain info you have. This all to say that using only domain names to resolve ownership is a hard problem, since ages browsers use a crowdsourced list [1] to get around this issue but recently it proved not to scale very well, specially after Apple's move to use this list as part of their "Limit Ad Tracking" solution. [1] https://publicsuffix.org/ https://publicsuffix.org/
  - om2 6y ago
    If the proposal was limited to opting into strict origin scope (instead of eTLD+1/registerable domain scope) for cookies and other privacy-related things, it would be an improvement. But it also allows things like specifying that laptops.shopify.com, laptops.com, laptops.social.com, desktops.com and calculators.com are the same party and therefore tracking may happen across them. There's no obvious good way to put the user on notice of this, and the Explainer totally punts on addressing this problem, instead leaving it to each browser to figure out.
dylan604 6y ago
>Sometimes I wonder how the web got here with the amount of kludge that we have to carry. Really? Um, MS led the way with IE6 and all of the baggage they brought. Google took the mantle with Chrome. Ultimately, it is the browser vendors and their "interpretations" on how to handle things. Rather than working with the governing bodies (yes, they are slow), they forged ahead with their own implementations and forced everyone to follow. No browser is perfect, but the travesty that IE left us with should have been the glaring example of what not to do, but yet Google went and did it again. The internet is nothing without the browsers. If the browsers didn't do bad things, we'd be in a lot better situation.
- ampdepolymerase 6y ago
  The standard and governing bodies has no right to demand anything. The internet is not a democracy. If they want something put the money where their mouth is. Until W3C ships their own browser engine and gets it into the hands of customers, relevance is nothing more than a nice-to-have.
  - derefr 6y ago
    There are no members of the W3C other than browser (and web-server) manufacturers. When the members of the W3C decide on something, that’s the browser manufacturers deciding on that thing. The real question, I suppose, is whether the people who interact with the W3C/WHATWG/etc. have decision-making power within the organizations they nominally represent. If not, then these bodies are kind of like the UN: nominally a place for treaties to be made, but in practice a place for ambassadors to glad-hand one-another while their leaders ignore the decisions they make.
  - stjohnswarts 6y ago
    You seriously want google to be defining what the internet is given their current and past activities and abuses? There is no way that could ever be a good thing. If they ever do expect a 50% carve out for targeted ad technologies.
- zdragnar 6y ago
marcosdumay 6y ago
That's a valid point, but as an internet user the domain is the only attribute visible to me that can determine a site's identity. So, I am pretty happy that the W3C insisted on setting the privacy rule based on plainly visible attributes, not on hidden predetermined or site informed data. You call the current policy ambiguous, but the proposal wouldn't even ensure that all browsers block or allow the same sets of domains. Anyway, I am aware that people use multiple domains on the most diverse ways. But it's important to have the technical behavior simple and predictable, and if Google doesn't like the consequences of the way they decided to organize their domains, well, it's their problem for them to fix, not a reason to push complicated unreliable standards on everybody.
stjohnswarts 6y ago
In my opinion that's something the website owner should handle and it's a tractable problem. It shouldn't be pushed to the browser other than as you mentioned through capabilities like SOP and cookies. The way it is is fine.
parliament32 6y ago
>you can have a number of sites that use separate domains but are owned by the same entity Why is this even a thing? There's nothing wrong with storeA.shopify.com, storeB.shopify.com... The only valid use case is if you're somehow trying to hide the shared ownership/platform, in which case it's up to you to deal with the downsides.
- mtrovo 6y ago
  AFAIK there are big security risks on hosting user generated content on the same domain of your parent website. That was the main reason github.com migrated individual repo pages to github.io [1]. Also shopify doesn't serve their shops on the domain of their main website, they use *.myshopify.com, I suppose for the same reason. [1] https://github.blog/2013-04-05-new-github-pages-domain-github-io/#security-vulnerability https://github.blog/2013-04-05-new-github-pages-domain-githu...
mdoms 6y ago
Nothing's stopping you from using the one domain as it was initially intended.
om2 6y ago
Even when multiple domains are controlled by the same party, there is often no good way for users to be aware that seemingly unrelated sites with unrelated-looking brands are the same, and therefore (under this proposal) you can be tracked across them.

by mtrovo 6y ago

bigth 6y ago

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

gsich 6y ago
How is this faster? More DNS requests, more TCP connections. At first this is purely slower.
- hoppi 6y ago
  Pretty sure in HTTP 1.1, there was a max amount of concurrent requests per server/proxy. So using different domains allowed more rq/s.
- diggan 6y ago
  Browsers used to/still do max number of connections per domain. Adding more domains allows you to do more concurrent requests.
  - kevin_thibedeau 6y ago
    With HTTPS you have to handshake for the first connection on each domain.
    - weird-eye-issue 6y ago
      Yes and it still outweighed that especially if you were loading a lot of images or a stupid amount of different JS/CSS files
- kevingadd 6y ago
  More connections = better parallelism = faster downloads The DNS is cached.
- sdflhasjd 6y ago
  It spreads out the load on disks and outbound bandwidth.
  - weird-eye-issue 6y ago
    You are making the assumption that the domain pointed to different physical servers. To get the benefits of what everyone else is describing it does not matter what the domains actually are pointing to.
- fuzzy2 6y ago
  A separate domain name for static assets would not receive any cookies of the actual site. This means less data transferred and in theory a proxy closer to the user could more easily cache these requests, even for multiple clients.
- TomGullen 6y ago
  Before HTTP2 this was common
- herf 6y ago
  Upstreams were very limited, and HTTP requests send cookie data in each GET. For instance, if you had a 128kbps DSL upstream and each request was 2KB (loaded up with cookies), you're already limited to 8 requests/second. A cookie-less domain for small resources helped this a lot.
stjohnswarts 6y ago
That's an infrastructure problem. Sure you can solve it with domains, but you can also easily use other current technologies for it with no issues as well and never change the domain name at all.
hinkley 6y ago
NCSA was using regional DNS for load balancing in '95. I don't know who invented it but it's at least 25 years old.

swiley 6y ago

That's a good point, the domain should have to match exactly.

throwaway1492 6y ago

> (googler here, but this is my opinion) Sergei here, gtf back to work and stop posting company policy on social media!

1shooner 6y ago

>in a way that we shouldn't assume any ownership only based on the domain itself. I probably have a naive understanding of this, but why not? In your Shopify example, users should certainly be taught that Shopify does have ownership of mystore.shopify.com (in at least the 'security' and 'privacy' areas of concern from the write-up). Likewise, entities proxying resources controlled by others through their own domains (e.g. CNAME cloaking) should take responsibility for what they are serving and how they are exposing their clients.

mtrovo 6y ago
mystore.shopify.com is definitely hosted by Shopify but it's content is a totally isolated entity. You can trust laptops.shopify.com but this trust should not automatically transfer to fakestore.shopify.com. In the same way if you have a valid account on laptops.shopify.com, the browser shouldn't allow fakestore.shopify.com to emit a request and buy something on laptops.shopify.com with your valid session on your behalf, even though they're on the base domain. You have also the parallel problem of how do you transfer the trust you have on google.co.uk to youtube.co.jp only based on the domain info you have. This all to say that using only domain names to resolve ownership is a hard problem, since ages browsers use a crowdsourced list [1] to get around this issue but recently it proved not to scale very well, specially after Apple's move to use this list as part of their "Limit Ad Tracking" solution. [1] https://publicsuffix.org/ https://publicsuffix.org/
- om2 6y ago
  If the proposal was limited to opting into strict origin scope (instead of eTLD+1/registerable domain scope) for cookies and other privacy-related things, it would be an improvement. But it also allows things like specifying that laptops.shopify.com, laptops.com, laptops.social.com, desktops.com and calculators.com are the same party and therefore tracking may happen across them. There's no obvious good way to put the user on notice of this, and the Explainer totally punts on addressing this problem, instead leaving it to each browser to figure out.

dylan604 6y ago

>Sometimes I wonder how the web got here with the amount of kludge that we have to carry. Really? Um, MS led the way with IE6 and all of the baggage they brought. Google took the mantle with Chrome. Ultimately, it is the browser vendors and their "interpretations" on how to handle things. Rather than working with the governing bodies (yes, they are slow), they forged ahead with their own implementations and forced everyone to follow. No browser is perfect, but the travesty that IE left us with should have been the glaring example of what not to do, but yet Google went and did it again. The internet is nothing without the browsers. If the browsers didn't do bad things, we'd be in a lot better situation.

ampdepolymerase 6y ago
The standard and governing bodies has no right to demand anything. The internet is not a democracy. If they want something put the money where their mouth is. Until W3C ships their own browser engine and gets it into the hands of customers, relevance is nothing more than a nice-to-have.
- derefr 6y ago
  There are no members of the W3C other than browser (and web-server) manufacturers. When the members of the W3C decide on something, that’s the browser manufacturers deciding on that thing. The real question, I suppose, is whether the people who interact with the W3C/WHATWG/etc. have decision-making power within the organizations they nominally represent. If not, then these bodies are kind of like the UN: nominally a place for treaties to be made, but in practice a place for ambassadors to glad-hand one-another while their leaders ignore the decisions they make.
- stjohnswarts 6y ago
  You seriously want google to be defining what the internet is given their current and past activities and abuses? There is no way that could ever be a good thing. If they ever do expect a 50% carve out for targeted ad technologies.
zdragnar 6y ago

marcosdumay 6y ago

That's a valid point, but as an internet user the domain is the only attribute visible to me that can determine a site's identity. So, I am pretty happy that the W3C insisted on setting the privacy rule based on plainly visible attributes, not on hidden predetermined or site informed data. You call the current policy ambiguous, but the proposal wouldn't even ensure that all browsers block or allow the same sets of domains. Anyway, I am aware that people use multiple domains on the most diverse ways. But it's important to have the technical behavior simple and predictable, and if Google doesn't like the consequences of the way they decided to organize their domains, well, it's their problem for them to fix, not a reason to push complicated unreliable standards on everybody.

stjohnswarts 6y ago

In my opinion that's something the website owner should handle and it's a tractable problem. It shouldn't be pushed to the browser other than as you mentioned through capabilities like SOP and cookies. The way it is is fine.

parliament32 6y ago

>you can have a number of sites that use separate domains but are owned by the same entity Why is this even a thing? There's nothing wrong with storeA.shopify.com, storeB.shopify.com... The only valid use case is if you're somehow trying to hide the shared ownership/platform, in which case it's up to you to deal with the downsides.

mtrovo 6y ago
AFAIK there are big security risks on hosting user generated content on the same domain of your parent website. That was the main reason github.com migrated individual repo pages to github.io [1]. Also shopify doesn't serve their shops on the domain of their main website, they use *.myshopify.com, I suppose for the same reason. [1] https://github.blog/2013-04-05-new-github-pages-domain-github-io/#security-vulnerability https://github.blog/2013-04-05-new-github-pages-domain-githu...

mdoms 6y ago

Nothing's stopping you from using the one domain as it was initially intended.

om2 6y ago

Even when multiple domains are controlled by the same party, there is often no good way for users to be aware that seemingly unrelated sites with unrelated-looking brands are the same, and therefore (under this proposal) you can be tracked across them.