Hacker News Reader

Comment by dcow | Hacker News Reader

Usually I try to be constructive, but I just need to get this out: fuck AMP. I don't care downvote me to oblivion I'm a little buzzed but FFS who actually wants AMP and why is it even a thing? Why can't Chrome just prefetch shit from the actual servers and let ISPs handle the caching? Why does mother Google need to serve me all the content from its overly suckled teat? I know everyone working on AMP means well but why why why does Google insist on destroying the internet and entirely undermining TLS in the process? Sorry. That was therapeutic.

Bonus Quiz:

1. When I encounter an AMP link I... a) Click it. b) Don't click it. c) I don't see AMP links using FireFox.

2. When my friends send me an AMP link... a) I click it. b) I don't click it. c) Friends don't send friends AMP links.

3. Reasons I've switched to FireFox... a) I love RUst. b) I care about privacy. c) I hate AMP.

4. My ISP is... a) Google b) Chrome c) None of the above.

The answer is 'c'.

View on HN

I largely agree. Every time I bump into yet another AMP link I discard it. I also try to encourage friends to not post these blasted things. They're a poison just as bad as that link.is crap that floated around for a while.

I have been thinking about creating a reference group in Europe to lobby against googles abuse of monopoly. EU has shown time after time that it cares more about its citizens than about how much money countries can make.

If anyone is interested PM me.

An ISP can’t see https content to cache. Having google prefetch normal html pages would thoroughly break most website’s analytics, be potentially a violation of privacy and do a hundred other horrendous things if they tried to instantly load cached normal html pages within the google search result page.

But if Google does it on effectively their own network it's okay? Nothing changes there except analytics and bandwidth usage. Too much for the internet but not to fear Google is here with a web scale solution: build a new internet a googlenet where services only get info Google blesses them with......

Google is caching pages specifically designed to be cached, including supporting ads and analytics for the publisher. You isp caching solution can’t do that.

same thoughts. it's hard to contain myself when smart people seriously discuss it's merits instead of burning it with fire.

Why can't Chrome just prefetch shit from the actual servers and let ISPs handle the caching? Why does mother Google need to serve me all the content from its overly suckled teat?

Ooooh, <raises hand aggressively> I know.

Google is fighting to minimize ISP incidental access to your internet actions, while aggressively expanding the amount of incidental access Google has to your internet actions.

Apparently they've "earned" their surveillance because their core functionality can't be divorced from their ability to conduct surveillance as easily as they can be separated in the case of ISPs.

> Why can't Chrome just prefetch shit from the actual servers

The linked article explains this. Do you really want third party sites to know what you're searching for without you actively deciding to click on their page?

> and let ISPs handle the caching

ISPs can't cache the contents of HTTPS pages.

> Do you really want third party sites knowing what you searched for...?

My user agent /is/ me. If I want to prefetch results, I unerstand it means people know I'm looking at those results. I don't think it's really the privacy issue they are trying to make it out to be. And the counter consideration is that you are implicitly saying you trust Google with that info more than the actual service providers so it's not "do you want people" it's "who do you want" knowing.

Easy solution: off by default and inform users of the implication when turned on. As a user I don't actually want the internet prefetched for me mostly because it's a stupid idea catering to a subset of people who are so impatient it's baffling. If your site performs poorly on mobile let users complain to the creators so they can make better sites. Does Google really get the schtick when a mobile site has a poor UX? No. So why are they even investing effort into this?...

> ISPs can't cache the content of HTTPS pages.

Indeed. That's the point of HTTPS. As a user I don't expect that contract undermined even by a claimed benevolent Google just trying to altruistically get you content better with signed bundles that masquerade around as the original service. A few points, too. Often the static CDN content is served HTTP because it's not sensitive or it employes other means of restricting access such as GUID/signed urls etc., all of which can be cached. But even if that's a bad idea (I think people are moving away from that model, and http2) that just shifts the responsibility to the ISP and CDN providers to make sure that they have good fast connections between their networks. That's something that is in both their business models and it works just fine today. ISPs want to provide the best user experience on their network compared to others and CDNs sell their highly available global network to customers so a better CDN closer to more users means happier customers.

> If I want to prefetch results, I unerstand it means people know I'm looking at those results.

Why do that though when you can have your cake and eat it? Google's proposed solution allows you to prefetch results _and_ not allow the third-party to know you're looking at those results.

> the counter consideration is that your implicitly saying you trust Google with that info more than the actual service providers

If I'm using Google search, then yes, obviously I'm fine with Google knowing what I searched for. If I wasn't okay with that, I most certainly would not be using Google search. In contrast, I'm less likely to be okay with a random site in the search results page that I haven't clicked on knowing that I saw a link to their site in a search results page.

Note that if I were using DuckDuckGo instead and DuckDuckGo supported AMP, then my browser would prefetch from DuckDuckGo's AMP cache, not Google's. No additional information is being shared with any party who doesn't already possess that information. (DuckDuckGo already knows what I searched for. Me loading an AMP page from them related to that query reveals no additional information.)

> Indeed. That's the point of HTTPS. As a user I don't expect that contract undermined even by a claimed benevolent Google

Could you explain how Google's proposed solution here undermines HTTPS? Note that the OP talks about using the upcoming [Web Package standard][1] to distribute AMP pages. This standard would allow the integrity guarantees of HTTPS to be preserved even when the page in question is being served by Google's AMP cache rather than the original server.

[1]: https://github.com/WICG/webpackage

I guess this becomes an interesting discussion about who owns my browsing experience. I believe I (along with what I cede to my browser vendor) own my browsing experience. This means once the content has hit my browser it's no longer Google's domain. It rubs me weird that Google wants to stick their fingers in and control the way my browser handles results served from their service. That's really up to me (and my browser).

re: web packaging, if a new standard is being developed that will set user expectations around content delivered by a third party then fine. But to boot I'm really confused why the content requested is not the result of loading the certified URL in my address bar (which TLS has conditioned us to be privy to). And so users will become accustomed to the implications of using a service that leverages the standard and there shouldn't be any long term confusion, I guess. But let's not ignore what it is: AMP is evolving into a CDN owned by Google only focused on serving Google search results which is only even feasible because it exploits Google's scale to further lock down its search monopoly and prevent information from leaking out that might even arguably benefit users. DuckDuckGo wouldn't get the same benefit from adopting AMP because they don't have loads of internet infrastructure to play with.

Unless you're using Google Chrome, Google does not and can not control "the way [your] browser handles results served from their service". That's completely up to your browser to decide (and by extension, you, by means of which browser you decide to use).

If you're using Firefox, for example, this change to the URL bar will only happen if Mozilla decides to implement the web package standard, after evaluating it and deciding its reasonable to display the URL of the original page for pages loaded using that standard.

> DuckDuckGo wouldn't get the same benefit from adopting AMP because they don't have loads of internet infrastructure to play with.

That may be true in the sense that DuckDuckGo can't deploy a global CDN as easily, since Google has more resources than them, but you could make the same case against almost any new web technology.

For example, you could argue DuckDuckGo wouldn't make as effective use of HTTP/2 as Google, since Google can afford to rewrite their applications to take full advantage of HTTP/2 server push much more quickly than DDG can. That's not a very good argument against HTTP/2 though IMO.

I will add though that despite what it may sound like, I'm still not entirely sold on AMP myself.

My main issue with it is that it the spec still contains [this line][1]:

> AMP HTML documents MUST

> [...]

> * contain a <script async src="https://cdn.ampproject.org/v0.js"></script> tag inside their head tag

The actual specification requiring JavaScript to be loaded into your page from any one particular server is unacceptable IMO. Hopefully this is fixed in future updates to the spec.

My other problem with it is much more minor; I just don't like the idea of serving a "special" version of my site just for mobile. I'm very much a fan of responsive design, and I'd prefer to just serve one version of my site that looks and works great no matter what device or internet connection you're viewing it with.

[1]: https://www.ampproject.org/docs/reference/spec#scrpt

Imagine the side channel attack enabled by having your browser prefetch content that is on a search result but that you didn't click, in a fashion that is not clearanced by a single server but instead can be tied directly to you. Like "hey advertisers, here's a whole lot more information!"

Are we discovering anew just how much information google has and perhaps now the real intention behind AMP: complete control of search. Easy solution, opt in and explain the danger to users...or better yet stuff all the privacy violation shit behind an EULA and call it a day.

Thinking about it more, why is it even a problem if the pizza shop across the street knows I searched for pizza and wants to try and offer me a better deal before I pick up the phone and call someone else? If I buy into having my privacy violated by allowing sites and ad networks to track me anyway, wouldn't the better user experience there be to have services competing over me (my business) as soon as I start looking rather than once I've entered their store? Kinda playing devils advocate but now I'm actually curious.

> who actually wants AMP and why is it even a thing?

AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA.

Here in this thread are people talking about how much they like AMP from a user's perspective.

> Why can't Chrome just prefetch shit from the actual servers

The linked article answers this: for privacy reasons.

> and let ISPs handle the caching?

HTTPS does not allow ISP-level caching. This is generally a good thing; I trust ISPs significantly less than I trust Google.

> Why does mother Google need to serve me all the content from...?

Performance, presumably.

> I know everyone working on AMP means well but why why why does Google insist on destroying the internet and entirely undermining TLS in the process?

I don't think they're doing that.

AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA.

That's not all it does. No-one would object to it if that was all it does.

The more important part is that it hijacks content and serves it from other servers, and requires including a js file from a large corp in every page. That's a massive vulnerability waiting to happen, but it also gives complete control of the web to whoever controls that js.

They need to ditch the requirement for js, and ditch the requirement for framing with Google junk around pages. The web is an open ecosystem, that's its strength.

Also, google should not be using their influence in search to push changes which are profitable for them - that's abusing their monopoly position.

I never said it was all it does. It's the reason AMP exists, and the reason certain users like it.

The "hijacks content" part is by itself unobjectionable, especially with this latest update we're discussing which fixes the URL bar issue. The other server will serve a checksum so Google can't tamper with the contents. That makes it just a free CDN.

Is the problem that you do not want Google to see your content at all? You'll need to use robots.txt to ban Googlebot. You can't simultaneously want to appear in Google search results and also not let Google see your website.

The required JavaScript is legitimately frustrating, I know. The AMP project has an article about why they did it that way:

https://medium.com/@cramforce/why-amp-html-does-not-take-ful...

Specifically, it's to prioritize resource loads. I personally don't think their explanation is very convincing. But whatever, maybe it's easier for them to do it this way or something.

I don't think Google is doing it to push changes which are profitable for them, though. I legitimately believe they're doing it to make the pages load faster and otherwise be better for the users. I don't even understand how it could be profitable in any other way.

I never said it was all it does. It's the reason AMP exists, and the reason certain users like it.

Strategically, for google, owning the frame around the web and a bit of js on each web page is vastly more valuable than customers having faster web pages.

So no, speeding up web pages is not why AMP exists.

Exactly. Either you believe companies act altruistically, or this is a power play by Google.

> AMP is a standard that restricts webpages to a subset known to load very quickly, which is especially useful if you have a mobile device, or are in a country with poor internet such as in the USA.

It is called HTML/CSS with zero JavaScript. Quite fast in dial up modems.

I know AMP has some good purposes, but the correct response should have been to discourage site owners doing stupid things. Google has sufficient power to force them, having done a similar thing for HTTPS (not to say that it's necessarily appropriate, but frankly not so much different from AMP in terms of the amount of abusing).

Reply on news.ycombinator.com