4 ms·

I understand what you're saying, but I fundamentally disagree with you. The issue is that you're immediately deciding that domain X and domain Y are different

I understand what you're saying, but I fundamentally disagree with you. The issue is that you're immediately deciding that domain X and domain Y are different entities. In practice, I find that there are a HUGE number of use cases where two domains are actually the same organization, or two organizations that are collaborating. There is basically no way to say to the browser - I am "X" and my friends are "Y" and "Z", they should have permissions to do things that I don't allow "A", "B", and "C" to do. --- We actually have a functioning standard for this on mobile (both iOS and Android support /.well-known paths for manifests that allow apps to couple more tightly with sites that list them as "well-known" (aka - friends) The browser support for this kind of thing is basically non-existent, though, and it's maddening. SameSite would have been a PERFECT use case. We're already doing shit like preflight requests, why not just fetch a standard manifest and treat whitelisted sites as "Samesite=none" and everything else as "Samesite=lax"? Instead orgs were forced into a binary choice of none (forfeiting the new csrf protections) or lax (forfeiting cross site sharing).

cxr 5y ago
> but I fundamentally disagree with you ["We actually have a functioning standard for this on mobile"] I wouldn't expect any less. https://quoteinvestigator.com/2017/11/30/salary/ https://quoteinvestigator.com/2017/11/30/salary/ > In practice [...] There's your problem. Try fixing that.
- Spivak 5y ago
  Moving everything under a single domain makes no sense for the use-case of cross-organization sharing though. Domain as as the root identity on the web is just broken and there's no way to make it work. mysharedhosting.com/customer1 mysharedhosting.com/customer2 Two separate identities. Is it even possible to let the browser know that they should be segmented? Nope. customer1.mysharedhosting.com customer2.mysharedhosting.com How about this? No again, not without getting yourself on the suffix list which is just a hack. mycompany.com joinmycompany.com Can you tell the browser that these are actually the same and shouldn't be segmented? Nope!
  - tatersolid 5y ago
    This makes more sense and doesn’t dilute your brand, improves SEO, and helps protect against phishing by making your customers and staff look for a single known-good domain: https://mycompany.com/join
- horsawlarway 5y ago
  Your take is wrong. Having a domain is identical to having a driver's license: This org says I am "X". It is fundamentally different from uniquely identifying me. I am still the same person if I give you my library card - a different ID from a different org that says I am "Y".
  - cxr 5y ago
    Nah, the problem is definitely on your end. > Having a domain is identical to having a driver's license: This org says I am "X". Nope. You just described two different documents. http://horsawlarway.example/drivers-license.html http://horsawlarway.example/drivers-license.html http://horsawlarway.example/library-card.rdf http://horsawlarway.example/library-card.rdf It's very odd the position you're taking here, given the sentiment in your other tirade about being digital sharecroppers to Facebook and Google <https://news.ycombinator.com/item?id=27369652 https://news.ycombinator.com/item?id=27369652>. Your proposed solution is dumping more fuel in their engines—which is why it's the kind of solution they prefer themselves—and completely at odds with e.g. Solid and other attempts to do things thing would actually empower and protect individual users. I'm interacting with your digital homestead, why are you so adamant about leaking my activity to another domain?
Welteam 5y ago
If you actually search a bit on the internet, you'll find Google actually made a RFC for a standard allowing websites to list other domains that should be considered as same origin. Look for the comments on it by the ietf and you'll understand why this is a terrible idea.
- horsawlarway 5y ago
  Why don't you search a bit and come back with a link? Because I can't comment on an RFC I haven't seen, and a quick google search of my own based on your comment turns up nada. That said - I'm fully aware of the downsides of this approach, but I want my browser to be (to put it crudely) MY FUCKING USER AGENT. I want to be able to allow sharing by default in most cases, and I want a little dropdown menu that shows me the domains a site has listed as friendly/same-entity, and I want a checkbox I can uncheck for each of them. Then I want an extension API to allow someone else to do the unchecking for me, based on whether the domain is highly correlated with tracking (Google analytics, Segment, Heap, Braze, etc) ------------- The way I see it, the road to hell is paved with good intentions. If the web was developed in our current climate of security/privacy focus, how likely is it that even a fucking <a href=[3rd party]> would be allowed? Because I see us driving to a spot where this verboten. Which also happens to be the final nail in the coffin for any sort of real open platform. Welcome to the world where the web is literally subdomains of facebook/google. What a fucking trash place to be.
- will4274 5y ago
  As somebody directly involved in this space, that's a pretty bad summary. The spec for first party sets (not an RFC, just a draft) isn't in a great state. Google is going to implement it anyway, Microsoft is supporting, Apple basically said the spec was crap but they might be interested in a good version of it, and Firefox said they didn't like it. Speaking as engineer.. the Firefox folks don't really get it. You can't just break what sites like StackOverflow and Wikipedia have been doing for years (and in some cases decades) and then say "you were doing the wrong thing." Some version of FPS will ship in browsers, probably in the next 2 years. Quoting Apple's position directly "[...] Given these issues, I don’t think we’d implement the proposal in its current state. That said, we’re very interested in this area, and indeed, John Wilander [Safari lead] proposed a form of this idea before Mike West’s [Google] later re-proposal. If these issues were addressed in a satisfactory way, I think we’d be very interested. [...]" Also it was a W3C TAG review. The W3C and IETF are different organizations.
hypertele-Xii 5y ago
> The issue is that you're immediately deciding that domain X and domain Y are different entities. That's... literally what domain means. "A domain name is an identification string that defines a realm of administrative autonomy, authority or control within the Internet." - Wikipedia The entire security policy of the Internet is built on this definition. It's not an assumption. It's a core mechanism.
- horsawlarway 5y ago
  wrong again... It's very clear "*A* realm". Not "The realm". Certainly not "The only realm". Entities are allowed to control many assets. Simplest possible case in the wild for you, since you're being obtuse. I'm company "A". I just bought company "B". Now fucking what?
jameshart 5y ago
> There is basically no way to say to the browser - I am "X" and my friends are "Y" and "Z", they should have permissions to do things that I don't allow "A", "B", and "C" to do. Isn't that CORS? That sounds like CORS.
- afiori 5y ago
  CORS can fully stop an origin from accessing an http resource, this discussion is about allowing different origin to reuse the browser local state (like cookies, http cache, local storage). CORS is a stronger security layer in the browse than cache segregation, some people want to keep the CORS security model but weaken cache segregation.

cxr 5y ago

> but I fundamentally disagree with you ["We actually have a functioning standard for this on mobile"] I wouldn't expect any less. https://quoteinvestigator.com/2017/11/30/salary/ https://quoteinvestigator.com/2017/11/30/salary/ > In practice [...] There's your problem. Try fixing that.

Spivak 5y ago
Moving everything under a single domain makes no sense for the use-case of cross-organization sharing though. Domain as as the root identity on the web is just broken and there's no way to make it work. mysharedhosting.com/customer1 mysharedhosting.com/customer2 Two separate identities. Is it even possible to let the browser know that they should be segmented? Nope. customer1.mysharedhosting.com customer2.mysharedhosting.com How about this? No again, not without getting yourself on the suffix list which is just a hack. mycompany.com joinmycompany.com Can you tell the browser that these are actually the same and shouldn't be segmented? Nope!
- tatersolid 5y ago
  This makes more sense and doesn’t dilute your brand, improves SEO, and helps protect against phishing by making your customers and staff look for a single known-good domain: https://mycompany.com/join
horsawlarway 5y ago
Your take is wrong. Having a domain is identical to having a driver's license: This org says I am "X". It is fundamentally different from uniquely identifying me. I am still the same person if I give you my library card - a different ID from a different org that says I am "Y".
- cxr 5y ago
  Nah, the problem is definitely on your end. > Having a domain is identical to having a driver's license: This org says I am "X". Nope. You just described two different documents. http://horsawlarway.example/drivers-license.html http://horsawlarway.example/drivers-license.html http://horsawlarway.example/library-card.rdf http://horsawlarway.example/library-card.rdf It's very odd the position you're taking here, given the sentiment in your other tirade about being digital sharecroppers to Facebook and Google <https://news.ycombinator.com/item?id=27369652 https://news.ycombinator.com/item?id=27369652>. Your proposed solution is dumping more fuel in their engines—which is why it's the kind of solution they prefer themselves—and completely at odds with e.g. Solid and other attempts to do things thing would actually empower and protect individual users. I'm interacting with your digital homestead, why are you so adamant about leaking my activity to another domain?

Welteam 5y ago

If you actually search a bit on the internet, you'll find Google actually made a RFC for a standard allowing websites to list other domains that should be considered as same origin. Look for the comments on it by the ietf and you'll understand why this is a terrible idea.

horsawlarway 5y ago
Why don't you search a bit and come back with a link? Because I can't comment on an RFC I haven't seen, and a quick google search of my own based on your comment turns up nada. That said - I'm fully aware of the downsides of this approach, but I want my browser to be (to put it crudely) MY FUCKING USER AGENT. I want to be able to allow sharing by default in most cases, and I want a little dropdown menu that shows me the domains a site has listed as friendly/same-entity, and I want a checkbox I can uncheck for each of them. Then I want an extension API to allow someone else to do the unchecking for me, based on whether the domain is highly correlated with tracking (Google analytics, Segment, Heap, Braze, etc) ------------- The way I see it, the road to hell is paved with good intentions. If the web was developed in our current climate of security/privacy focus, how likely is it that even a fucking <a href=[3rd party]> would be allowed? Because I see us driving to a spot where this verboten. Which also happens to be the final nail in the coffin for any sort of real open platform. Welcome to the world where the web is literally subdomains of facebook/google. What a fucking trash place to be.
will4274 5y ago
As somebody directly involved in this space, that's a pretty bad summary. The spec for first party sets (not an RFC, just a draft) isn't in a great state. Google is going to implement it anyway, Microsoft is supporting, Apple basically said the spec was crap but they might be interested in a good version of it, and Firefox said they didn't like it. Speaking as engineer.. the Firefox folks don't really get it. You can't just break what sites like StackOverflow and Wikipedia have been doing for years (and in some cases decades) and then say "you were doing the wrong thing." Some version of FPS will ship in browsers, probably in the next 2 years. Quoting Apple's position directly "[...] Given these issues, I don’t think we’d implement the proposal in its current state. That said, we’re very interested in this area, and indeed, John Wilander [Safari lead] proposed a form of this idea before Mike West’s [Google] later re-proposal. If these issues were addressed in a satisfactory way, I think we’d be very interested. [...]" Also it was a W3C TAG review. The W3C and IETF are different organizations.

hypertele-Xii 5y ago

> The issue is that you're immediately deciding that domain X and domain Y are different entities. That's... literally what domain means. "A domain name is an identification string that defines a realm of administrative autonomy, authority or control within the Internet." - Wikipedia The entire security policy of the Internet is built on this definition. It's not an assumption. It's a core mechanism.

horsawlarway 5y ago
wrong again... It's very clear "*A* realm". Not "The realm". Certainly not "The only realm". Entities are allowed to control many assets. Simplest possible case in the wild for you, since you're being obtuse. I'm company "A". I just bought company "B". Now fucking what?

jameshart 5y ago

> There is basically no way to say to the browser - I am "X" and my friends are "Y" and "Z", they should have permissions to do things that I don't allow "A", "B", and "C" to do. Isn't that CORS? That sounds like CORS.

afiori 5y ago
CORS can fully stop an origin from accessing an http resource, this discussion is about allowing different origin to reuse the browser local state (like cookies, http cache, local storage). CORS is a stronger security layer in the browse than cache segregation, some people want to keep the CORS security model but weaken cache segregation.