3 ms·

Google tried to solve this by having the URL bar show the cryptographic origin of the page being displayed, rather than the URL it was fetched from (the deliver

Google tried to solve this by having the URL bar show the cryptographic origin of the page being displayed, rather than the URL it was fetched from (the delivery provider). There was strong pushback here on HN - people cared more about who delivered the page than who wrote it. To me that argument is non-sensical - if you take it to the extreme, the URL bar should always just display 'data from Comcast via 192.168.0.1'

deleted 3y ago
[deleted]
mesebrec 3y ago
This is a strawman argument. You're misrepresenting the pushback and then argue against that misrepresentation. A large part of the pushback can be summerized as such: "Google created a technology that is incompatible with the open web. Now they want browsers to change their behavior to solve some of the ways this breaks the web." Google is the only company that can get away with this, due to their incredible market share in browser, mobile and web. Browser vendors serve as the gatekeepers deciding what the operating space is for web developers. As a result, web developers can't fundamentally change how the web works, for better or for worse. Google can, and did, and is now cleaning up the mess this left behind. The entire argument comes down to whether you think AMP is a good or a bad thing. Either you believe it's good, and you believe browsers should change to make it work, or you believe it's bad, and it's a problem that google has so much leverage to push this tech onto us.
account42 3y ago
Signed exchanges don't prove that that is the CURRENT content from the purpoted website while hiding the true (hosting) URL would give that impression.
- Spivak 3y ago
  Within epsilon yes it does because the signer chooses the signature expiration and it's no more than 7 days. If you don't like this you should also take issue with Cache-Control. You, the website operator, opt in to signed exchanges and define exactly what resources are valid for how long. If you're okay with the browser caching pages there really should be no reason to be weirded out by any 3rd party caching them too.
zagrebian 3y ago
> URL bar show the cryptographic origin Chrome’s URL bar? When was this?
ffpip 3y ago
I feel like that was just an exploit waiting to happen. Showing a different URL than the page was delivered from.

deleted 3y ago

[deleted]

mesebrec 3y ago

This is a strawman argument. You're misrepresenting the pushback and then argue against that misrepresentation. A large part of the pushback can be summerized as such: "Google created a technology that is incompatible with the open web. Now they want browsers to change their behavior to solve some of the ways this breaks the web." Google is the only company that can get away with this, due to their incredible market share in browser, mobile and web. Browser vendors serve as the gatekeepers deciding what the operating space is for web developers. As a result, web developers can't fundamentally change how the web works, for better or for worse. Google can, and did, and is now cleaning up the mess this left behind. The entire argument comes down to whether you think AMP is a good or a bad thing. Either you believe it's good, and you believe browsers should change to make it work, or you believe it's bad, and it's a problem that google has so much leverage to push this tech onto us.

account42 3y ago

Signed exchanges don't prove that that is the CURRENT content from the purpoted website while hiding the true (hosting) URL would give that impression.

Spivak 3y ago
Within epsilon yes it does because the signer chooses the signature expiration and it's no more than 7 days. If you don't like this you should also take issue with Cache-Control. You, the website operator, opt in to signed exchanges and define exactly what resources are valid for how long. If you're okay with the browser caching pages there really should be no reason to be weirded out by any 3rd party caching them too.

zagrebian 3y ago

> URL bar show the cryptographic origin Chrome’s URL bar? When was this?

ffpip 3y ago

I feel like that was just an exploit waiting to happen. Showing a different URL than the page was delivered from.