Google adds experimental setting to hide full URLs in Chrome 85 address bar
androidpolice.com
androidpolice.com
Not to mention all possible problems with misconfigured servers when www and www-less domains lead to same website, but some script refuses to work on one of those. While it was easy to spot with just a glance at URL bar, now one has to do additional clicking or opening devtools.
Probably we are at the crossroads where developers need separate, not dumbed-down version of browser.
Can anyone reproduce this?
You cannot compile Chrome. I've heard that Chromium can be compiled and run, but I've never actually seen it, or hear of anyone using that professionally.
There are other factors at play which mitigate the preferential treatment, but it's definitely there in Firefox as well.
Grand-parents/friends/org users not being sure to be on the right site after a redesign, not seeing amazon in the right language, etc. There’s countless of questions that can be solved faster by looking at the URL.
Understanding that users have more important things to do than spend time on bug reports is an important lesson to learn. If you can gather data without relying on someone whose job is to worry about other things then you will make everyone's life easier.
But if a whole subset of users exclude themselves from that tool, they're going to get the UX that's only as good as the other tools in the toolbox are capable of building.
But telemetry gives web developers an extremely simple and convenient tool to know what users are actually doing without even inconveniencing the users with explicit questions. I've done web development with a good telemetry set built into a page, and it is extremely informative regarding how users actually use the tool, as opposed to how the UX designers have predicted flow through the tool will be.
To give a concrete example, a user might tell you that configuring permissions is "hard," and sitting with them during over the shoulder testing (which is expensive) might tell you a little bit about why. But without even asking the user, page telemetry can tell you that they are making a transition jump from the permissions configuration page to the page listing all of the resource names, because that's what's slowing them down---the UI didn't give them enough information to configure the resources because we assumed they knew what the resources were named.
For a browser, anonymized usage stats can tell you whether most users keep all their bookmarks flat at the top of the bookmark bar or deeply nested in multiple subfolders, and that's usually valuable for deciding whether you want to emphasize a flat bar or folder management in the design.
If most power users disable automatic anonymous telemetry and also use deeply-listed folders, no one should be surprised if deeply nested folders doesn't get better.
People who don't show up to vote also "deserve" a good government by virtue of being people who have to live in a governed society. It's harder to make one for them if the system for selecting leaders is missing their input, regardless of what they deserve.
Popping out of the government analogy and back to software, power users are also in a position where they are more capable of adjusting their experience to suit their needs. All things being equal, a company with finite resources to develop software should dedicate those resources to assisting the non-power users more often than power users.
b) for being "not a good idea", it's pretty much industry standard now for everything from business software to video games.
So you're claiming that it is typical for software with telemetry support to ignore your choice and still send telemetry about you turning off telemetry? That sounds wrong, but I cannot say I investigated this deeply.
> b) for being "not a good idea", it's pretty much industry standard now for everything from business software to video games.
As I understood the discussion, we were in fact discussing whether this is a good idea and whether it makes sense, so I think it's fair game to comment on it. As for it being an industry standard, that sounds like an overgeneralization. It is certainly not typical of software I use.
No; I'm saying missing data leaves holes that can be measured. They know, for example, how many people have downloaded Chrome and how many daily Chrome users they get at google.com (because Chrome will still send a valid UA string if it has telemetry turned off). They can estimate how many users have telemetry turned off from those signals to a pretty decent degree of accuracy; certainly enough to know whether telemetry is telling them about 90% of users of 30%.
For (b), I'm curious what software you use. It's pretty standard in games, online apps, and business software. It's absent in a lot of open-source (mostly because a lot of open-source lacks a centralized vendor who would be willing to pay the cost to collect and interpret that data to improve the software).
I avoid online apps, I don't play a lot of games (and if I do, they're not big titles which are likely to have telemetry) and yes, I primarily use FOSS.
> (mostly because a lot of open-source lacks a centralized vendor who would be willing to pay the cost to collect and interpret that data to improve the software).
This is almost surely an element of it, but I think a respect for privacy and a general distaste for telemetry among FOSS users are more important.
* Apple Watch battery cycle count (not viewable in any UI but is viewable in telemetry logs)
* Clues about why a particular app recently crashed
Yes, we are.
Funny enough, Firefox has a 'Developer edition', but that's just the Beta build, with some features turned-on by default.
At this point ie becomes more useful.
The goal of most web developers is to make pages users can use, not get mired down in the never-ending browser wars.
As the smaller vendor, it's incumbent upon Mozilla to break it. Expecting individual devs to do it collectively when it really isn't in their selfish interests is waiting for a unicorn to appear.
That's kind of impossible to do for a smaller vendor without wider developer cooperation.
I remember Mozilla only started to breach IE's dominance once devs were so sick of IE that they installed Firefox on their mom's computer despite tons of sites being made for IE.
It's possible for something like it to happen again with Chrome, but less likely since Google's a lot smarter and not too lazy to implement latest tech, so it will sure take longer without some activism and evangelism from web devs.
> expecting individual devs to do it collectively when it really isn't in their selfish interests is waiting for a unicorn to appear
Selfishness is a lot more complicated thing than people give it credit for. A lot of 'selfless' acts could be alternatively described as selfish in that it makes one feel good. Free software developers already do a lot of work for the wider community, where probably it would be a lot easier to just use the proprietary, already feature-rich, counterpart than trying to develop a libre alternative. But the movement understands that long-term, having as much free software as possible is what will in the end help preserve general-purpose computing in the sea of silos. It takes some discipline, sure, but long-term it's actually in one's selfish self-interest.
Short-term, sure. Long-term it opens devs to Google's whims and makes the "open" web barely more open than Apple's AppStore.
But that's short-term vs long-term thinking and I can't deny most would prioritize the short-term. Here's hoping there's still enough idealists, even among web devs to avoid that fate and bring about for the web what GNU did for UNIX in the 80/90s.
The only space I can name off the top of my head where my open-source architectures have outstripped Windows and Mac in UX is virtual desktops.
Of course proprietary software has more funding to hire designers and such, but in terms of actual functionality, I'd contest your claim.
If you're talking developer user experience, it's not even a race. The FLOSS ecosystem has a landslide lead here. In fact the whole point of WSL is to try to keep devs on the Windows platform by bringing that experience to Windows more directly.
Customizability is orthogonal with out-of-the box UX, the original axis of comparison here. In fact, the two are often at odds.
The history of biological evolution shows that monocultures invariably fail catastrophically. Diversity is the main way to guard against unpredictable events of the future. Software is not exempt from these general rules I'd presume.
I've looked into switching back to Firefox, but what I've found is that they don't allow me to use my own extensions. I would have to use a beta version of Firefox or submit all of my extensions that only I use for approval to Mozilla or have to reinstall my extensions every time I close Firefox. None of these seem good options to me.
Due to slow loading, I'm considering whatever they call the Microsoft browser today.
I am honestly surprised Firefox on Windows is slow for you. I don't personally use Windows, but many on here say it works well there since v57.
Maybe I don't know what to Google.
That combined with both FF and especially Safari being way behind in terms of standards adoption/development really sucks at the moment. Chrome desperately needs competition.
The standards are meant to be agreed upon by several parties, including both Google and Mozilla. Google implements new features in order to control the way they work, instead of allowing input by all the parties involved. It's always faster for one company to just do whatever they want than for a group of organizations to come to an agreement on what to do. The slower way results in better and more equitable implementation for everyone though.
The URL bar is a disaster for end users. It's full of random junk that users can't read so they stop trying, which means they can then be tricked by phishing websites hosted on any domain at all. Research shows about 25% of users don't look at the URL bar at all even when typing in passwords, they navigate purely by sight, so it's impossible to stop them being phished. The human cost of the resulting hacking is significant.
The fact that the software industry has routinely prioritised historical inertia, the needs of web developers, and all kinds of other trivialities over the security of billions of people is embarrassing. I'm glad to see the Chrome team finally get a grip on this and make the URL bar actually useful for people.
"Side view mirrors are a disaster for drivers. 25% of drivers don't even check them before making a turn." [I'll stop the metaphor here, as I think my point was clear]
This change does exactly nothing to improve security. As for usability, it just puts one more layer of paint over the underlying "complexity" - and we've seen before how well that works (see basically every part of Windows 10 for examples).
Your side view mirror metaphor is unfortunately not clear at all. The side view mirror is simple and performs its function correctly as designed. It can't really be improved without totally replacing it with something else like a camera. Now of course not everyone will use the URL bar even if it's redesigned to work correctly. But right now the bar is practically designed to look as intimidating and useless as possible.
Perhaps you're so used to parsing URLs in your head you don't realise it, but URLs are a baroque and absurd design that nobody without training could properly figure out. It's basically random bits of webapp memory and protocols splatted onto the screen in a large variety of different encodings. In a desktop app dumping RAM straight onto the screen would be considered a severe bug. On the web it's tolerated for no good reason beyond history.
To give just one example that has regularly confused people in the past: URLs are read left to right except for the domain name (the important part) which is read right to left. You don't stop reading a domain name at .com, you stop reading it at the third slash or possibly a colon, but that form is rare.
The way I used to teach was very simple and very effective: there are 3 parts to a URL - the first part tells you if the connection is secure, the second part tells you who you're connected to and the third part tells you where on that site you are. The first part needs to be httpS, the second part needs to be the site you're expecting and the third you can ignore. They're even shaded differently to make it easier to read. "If you're going to Google and the black part ends with anything but google.com, call IT" made sense to even the oldest and most reluctant people I've had to deal with. The problem was actually getting them to check every time and not forget.
It seems to me that this change will not help people without training, change nothing for people with training, and make sharing links even more confusing for everyone.
Are you saying someone is less likely to get phished on "supershop.co.hk" than on "http://supershop.co.hk/account_login.php", even where the http:// part is replaced with a red padlock and /... is grayed out?
I see only one real solution to phishing: don't let users type passwords manually. WebAuthN and password managers both automatically read the domain and won't try to authenticate on a domain that isn't a perfect match. I've had more success with that than any other anti-phishing measure I've tried deploying (history-based domain trust, explicit trust on first use popup, detecting unicode gaps and domains in credential fields...).
The greying out and replacement of padlocks etc, the anti-phishing training, it's all just working around a historical design problem in browsers. There's no need for it to exist. Notably, mobile apps don't have this problem.
I was trying to search for the word "aquarium" but chrome kept filling in "https://aquarium.org", I would delete the ".org" and only the word "aquarium" was shown in the search bar, which was the word I was trying to search.
Of couse "https://" was hidden, so I was actually submitting "https://aquarium" which was not a valid domain and it took many frustrated clicks and enters to actually google the word that was shown. Absolutely infuriating as the true state of the search bar was hidden.
google could make an amp-only web experience without dissent.
hide the URL bar
javascript -> webasm
hiding all this benefits data collection and advertising. Seems obvious to me.
Example.com > Worldnews > 2020 > 06 > 14 > Big aquatic monster spotted outside of Tokyo
or
forum.example.com > Sport > Football > Spain > Real Madrid
It could then work like in Explorer in Windows 10, where you can press one of the breadcrumb separators and see a menu with siblings, or go straight to all news this month. It could use some manifest file in a standard format on the server for the directory information.
Of course, this should never replace the URL completely, you should always be able to get to it easily. But URLs aren't necessarily always the best solution for navigation. We tokenize code and apply different colors, mouse over pop-ups, and links, why should the URL bar be a long raw text string when it's really contains structured data?
This Google nonses of hiding everything except the domain is not a good solution IMO, it doesn't solve a problem and makes it harder to navigate, not easier.
The only difference between
Example.com > Worldnews > 2020 > 06 > 14 > Big aquatic monster spotted outside Tokyo
forum.example.com > Sport > Football > Spain > Real Madrid
https://example.com/worldnews/2020/06/14/big-aquatic-monster-spotted-outside-tokyo
https://forum.example.com/sport/football/spain/real-madrid
And probably some clever logic to deal with the randomforum.php?fid=12345&tpcid=984.3&page=5 goop that is still all-too-common... :/
You say that as though websites like that are random small sites. HN has that kind of a URL, so do YouTube and Google.
You could try to map the parent ==> child relationship of every individual post URL, which might be cool, but think about how long the URLs would get.
For sites with breadcrumbs though, the URL absolutely should follow the crumbs (and I've argued for such at my company).
https://developers.google.com/search/docs/data-types/breadcr...
Sadly not used everywhere, but maybe browser support would encourage its usage by site owners.
https://www.ghacks.net/2011/03/01/improve-firefoxs-urlbar-wi...
They by default worked very similarly the aforementioned Windows Explorer, what in focused state with keyboard input turns into "raw" text field.
Probably worse than the change itself, though, is the tendency of anyone who makes such a change to start playing fast and loose with actually representing the underlying address. You mention Windows 10's address bar - it's one of the worst offenders. My Windows Explorer is currently sitting in my downloads folder, which is at "C:\Users\Wyatt\Downloads". The address bar reads "This PC > Downloads". When I click on the address bar to edit the address, it changes to just "Downloads". What part of all of this is in any way useful to me or the likely action I'm trying to take when I click on the address bar?
However, I think there is something to this idea - a breadcrumb style approach by default in Chrome would encourage developers to use paths in more standard ways that refer to resources, not heavy parameter coupling. As you noted, there are technical barriers to implementing this solution, which might encourage some other good things - servers providing resource discovery so that the browser can understand valid paths when visiting a site.
Google has too much power to dictate standards already, and has been quite happy to use that power for their own sake, rather than the good of the user. I'm not interested in giving them any more.
And like I wrote in my first post, the resource discoverability could be handled by the site itself via some manifest file in a standard format, like robots.txt. It wouldn't be dictated by anybody else.
I think it would have to be some standard format that websites use, not just string manipulation in the browsers. And certainly not some Google dictated feature! For the same reason, each part would have to be navigable on these sites, to work as I described. There's various possible solutions, like meta tags or some manifest like breadcrumbs.jsonld mentioned in another comment.
The fact that Windows Explorer doesn't show the full URL in special folders is a separate issue, I only mentioned it for the breadcrumbs example.
But I disagree with you that not showing the full address in Windows Explorer is a separate issue. In my experience loss of edge-case functionality is a core aspect of changing interfaces. Maybe in another world the address would be preserved, and my use case would still work. But someone else's unusual use would not.
Think about how Powershell use objects instead of text to chain together commands. The address isn't just text, it's structured data, why not treat it as such and make it more useful?
Which sites?
Anyway, almost everyone else would mind. Especially if there was no option to revert to normal behaviour.
> It could then work like in Explorer in Windows 10, ...
That sounds like the worst of both worlds. If people want Explorer in Windows 10 behaviour - can't they just run Explorer in Windows 10?
If people want Chrome as it was yesterday, they've basically got no option now.
> But URLs aren't necessarily always the best solution for navigation.
The Chromium devs demonstrated their lack of interest in being able to navigate via URL / location bar a half decade ago when they changed the default on all operating systems to be single-click in location bar to 'select the whole address'.
I'm beginning to think they are not our friends.
I typically run up breadcrumbkiller as part of any Microsoft Windows desktop build, so I rarely see that configuration for long.
news.ycombinator.com > 2020 > 06 > 14 > Google hides full addresses in URL bar on Chrome 85
This makes it easy to not only see where you are, but also quickly click on a part of the address to go to that hierarchy, or a sibling like yesterdays posts. It makes sense that a forum like this would have a way too see all posts from a day, month, or year.
Of course, most if not all users here are comfortable with URLs so they're probably not the ones that would benefit the most. But I think most common users, the ones who Google everything instead of typing in an address, would use the breadcrumb bar while today they probably see the URL as some weird text string they have little interest in or understanding of.
Attempts to make things simpler by hiding the truth about where you really are in navigation seems like a way to make the web less discoverable except by Google. If you're on a web site you can usually learn more about its structure based on URL format. This makes that more difficult.
This enables you to right click on the address bar, and turn on the option "Always show full URLs". It will always shows the full URL including the protocol, but I suspect they will remove this flag at some point.
This drives me crazy when debugging. Whenever I copy-paste IP addresses from the browser address bar into my console, I have to manually delete the `http://` at the front. I work on a P2P project so this is an extremely common situation for me.
Another solution for Windows and macOS users (no Linux sadly) is to use Edge Chromium, which does it by default, and you prefer to donate your data to Microsoft rather than Google like me :)
I personally don't care much what the default is for the normal user, but I want to be able to have my full urls.
Is there also a #upgrade-to-firefox-immediately flag ?
Seriously, I keep looking at the address bar to make sure the URL is still there and I'm not dreaming.
Now how does this new flag interact? Has anyone enabled both to see?
1: https://bugs.chromium.org/p/chromium/issues/detail?id=106157...
2: https://bugs.chromium.org/p/chromium/issues/detail?id=883038...
However: I believe Apple's motives are aligned with their users and they want their browser to be as safe and as easy to understand/use as possible. Their primary intention is to sell their shiny expensive hardware.
With Google it's more controversial, because who knows what's the plan. Combined with AMP there is a reason to be wary.
Ofc, one can make bad decisions based on good motives.
You'd be surprised how often veteran developers fail to grasp intermediate Unicode concepts (surrogate pairs, for instance) probably since they skipped over (or was not curious enough about) implementation details of such abstractions.
> Needlessly hiding technical details from kids is going to limit their learning.
I watch kids learning circuitry via redstone in Minecraft on iOS and Xbox - walled gardens, yet impressive learning nonetheless.
But when I was his age, all I had was MS-DOS 3.3. And I had to CD around to various directories, DIR *.EXE to remember the names of executables, etc. It was an environment that exposed more technical details, and kids who are predisposed to learn technical details learn a lot just by using it. Windows 10, doesn't promote the learning of technical details to anywhere near the same extent.
(I try to make up for it a bit. I introduced him to DOSBox.)
It is a mistake to conflate “it was harder for me” with “I learned more”.
My kids can program more complicated stuff in Minecraft than I could at their age. Part of that is having a tool that’s fun and abstracts away the boring bits.
What is "boring" varies from person to person.
I know, when our son plays Minecraft Java Edition, he likes to play it with the debug screen (F3) on.
He doesn't understand what most of the details on that screen mean, although he is learning a few. (He was asking me to explain what X, Y and Z coordinates were.) But, even if he doesn't understand most of it, he still likes it, and probably sooner or later he'll ask me more questions about it.
But the point is not that he memorises the ASCII table. The value is that he learns that computers internally represent letters/punctuation as numbers. The underlying concept is what's important, and the learning of specific values is mainly useful as a way of learning and reinforcing that underlying concept.
Here's a comment I made from several years ago when Chrome tried to do before what it's trying again now (it's not the first time): https://news.ycombinator.com/item?id=7678729
Maybe this next point is starting to go into the realm of conspiracy theory, but I see far too much evidence of it every day: companies are doing this because they don't want users to learn. They want to keep users naive, docile, and compliant, and thus easier to "herd" for their purposes. They don't want people knowing the truth behind how things work; they would rather "developers" (and only those who explicitly chose to be one --- probably for monetary reasons) learn from their officially sanctioned documentation (which does not tell the whole truth), and not think or discover for themselves.
(I've memorised most of printable ASCII because I did a lot of Asm programming decades ago, so I instantly understood what you mean.)
There are also definitly conscious design descisions how "cryptic" a particular feature should appear to users. I remember several bugzilla threads with discussion whether a config option should be exposed as an "ordinary" field in the settings or only as an option in about:config, so that normal users won't find it.
I'd stay clear of that project and use mainstream Firefox instead. And afaik they still don't support WebExtensions.
Suppose you always had to tell people to 'Google it'
Suppose 'I feel lucky' was always the default, and the result was sold to the highest bidder.
It's genuinely a benefit for the vast, vast majority of users, where the only important piece of information really is the domain name, to check which site you're actually on. And for more info, you can just click. Copying the URL becomes no more difficult.
The URL path beyond the domain is as useful to most people as an IP address, in other words not at all -- it's just noise. And displaying noise is bad UX. Pretty much only website developers and administrators and SEO people care about the full URL. Granted, there are a lot of those people here on HN, so I understand the pushback, but we're not most users.
But at the end of the day, I don't understand why people seem totally fine with Safari doing this, but not Google?
If find some of reactions on this ridiculously hyperbolic "biggest attack on the web in years" ? seriously ?
I get it, Google is a gigantic monster that does not necessarily act in its users best interests, but that does not mean we need to bring the pitchfork each time they launch an app update.
I'm sure they've always been tracking these search result clicks, but I think this is a somewhat new behavior, and I find it highly deceiving.
Ublock Origin can block this behavior. Here's a posting with links to more resources on hyperlink-auditig
https://github.com/gorhill/uBlock/wiki/Dashboard:-Settings#d...
And also precisely because of AMP, this might be a very dangerous step towards blurring the lines between original and AMP pages.
Right now it is a setting to enable in Chrome.
What makes you think that once it becomes default, the switch won't remain to be able to turn it off?
Chrome is built by developers. Presumably, they pay attention to what developers need from it. Which is why their debugging tools overall are so amazing.
Perhaps you should withold criticism of what you assume they'll do until they, you know, actually do it.
This is bad for web security, since the registerable domain is the part you have to trust, but it's surprisingly difficult to figure out that part.
However I feel a bit uneasy about this since URLs are important and tell you where you are on a website. I prefer Firefox's approach which emphasises the registerable domain in the URL bar and fades out the rest of it, making it easier to spot the important bit. However it's still quite subtle - it could do with being a clearer distinction.
A few years later, instead of type news.ycombinator.com, you would need to search for "hacker news", scroll through the ads and then click on the link.
So it could be a slow transition to inserting a sort of interstitial ads inter your browsing.
I am not calling anybody dumb. I'm saying they don't care and don't know there is any reason to care.
Even if, showing the URL bar changes nothing for them, so why hide it?
Exactly. We should push on the opposite direction (educate people and make the concepts clearer).
https://www.theguardian.com/technology/blog/2010/feb/11/face...
I'm also against this in theory, but in practice I don't care much. We shall see.
https://www.xda-developers.com/fix-dns-ad-blocker-chrome/
seems that the problem is not async itself, but that chrome ignores the system DNS settings and uses googles own DNS servers instead.
search my.home
Google's async DNS feature uses Chrome's own internal DNS resolver which doesn't call gethostname(). It would be incorrect for Chrome to parse this file and attempt to "respect" your settings because NSS is a series of black-box system-specific modules. If you removed the dns module from /etc/nsswitch.conf then resolv.conf wouldn't even enter the mix on your system and then Chrome would do the wrong thing. If the dns module behaved differently on your system and /etc/resolv.conf was actually /etc/resolv.json or /etc/resolver.conf then Chrome would again do the wrong thing.
When resolving a name applications have two choices, either look up the name with glibc, send the request through the NSS gauntlet of black-box modules and take whatever it returns of perform the DNS request itself and ignore everything on the system. Any sort of hybrid approach would be more confusing.
A DNS client looking at the list of servers, and marking the speed and reachability of each server is the most basic optimization. It makes no sense for clients to add n seconds to every request for every unreachable DNS sever.
The async DNS feature using Chrome's internal DNS client which behaves differently than glibc and so pihole appears to not work. Chrome is not injecting its own DNS servers into the mix or whitelisting anything, it always uses your system's DNS servers, it just looks them all up in parallel which it is allowed (and encouraged) to do by the RFC.
Make sure all your configured DNS servers are pihole and everything will work.
I'm having a hard time thinking of a situation where you have information, some more important and some less, where the correct solution is to delete the less important information. It still has importance!
That might help make the URL more readable but again doesn't really help if the relevant parts of the path/query string for trust isn't immediately apparent.
What I hate is how poorly they worded when websites use http instead of https. It says "connection not secure" which makes people think there is a hacker somewhere hacking their connection. What they should have done and must correct is to make the wording "this website is not following safety guidelines". I'm tired if explaining.
At least back in the day they will have the opportunity to learn what a query string is and that no, nobody is hacking anyone.
However with these stupid changes there will no longer be an opportunity to learn even if you wanted to.
Look pilgrim, that's the standard for you right there. It's called RFC3986.
The query component contains non-hierarchical data that, along with
data in the path component (Section 3.3), serves to identify a
resource within the scope of the URI's scheme and naming authority
(if any).
https://developers.google.com/web/updates/2018/11/signed-exc...
Really my point was in jest. I think we need to trash the entire www and start again with something content only focused and hard same-origin policy and far far far lighter than what we have. I tried browsing the web on a dual core celeron N3010 recently and it was unusable on all mainstream browsers.
But my understanding is that they intend to use signed exchanges specifically for their amp URLs, finally finishing their efforts of forcing people to go to google.com without them ever having realized it.
Hiding the https and www is already frustrating enough, and this change would make Chrome barely usable for my purposes.
They explain a number of reasons why it is difficult for people to extract from a URL the part which is relevant to security, ie. the bit that affects who has authority over the page and how your cookies will be separated by the browser. The cookie sharing actually had some rules I didn't know about as a non-web developer but experienced URL user. They show how every browser is already going some way towards this but they all have some problems, for example Safari shows the full domain not just the important part.
Basically any page on the website with this vulnerability will be useable to show a fake login page, and user will not even notice he's not on the /login, but on some weird path + ?_sort=somejavascript
Not that it's that hard to clean up url via history api after you get access to the page via XSS atm, but there's still some short period of time where the full url is shown in such a case, that may provoke suspicion.
I was just about to write this but I don't necessarily think it's that far off.
With signed exchanges, AMP pages have the ability to hide the fact you're accessing content through Google [1]. In 2016 Google wrote about testing 'mobile-first indexing' because more people are using mobile devices than desktop browsers [2].
[1] https://developers.google.com/search/docs/guides/about-amp#a... [2] https://webmasters.googleblog.com/2016/11/mobile-first-index...
If Google can control the URL narrative (keeping users from bouncing off AMP pages) it's just one more ability for them to be MITM.
Also nice to see DigiCert helping them out, but I’m not surprised with how DigiCert’s product lineup isn’t much more than a test of how much of a sucker you are.
Do you know there's a staggering amount of users who type "google.com" into Google?
And this will add a few extra hoops for them to jump through before they learn, so that they'll never have to leave the reassuring embrace of Google's ad trackers. How convenient. :)
Do I need to know an address to drive my car somewhere?
My knowledge that a place exists and I want to go there is sufficient to get me there, without having the physical address memorized.
As a power-user I obviously navigate through URL far more than the average user, but I am not convinced that say a 50 year old nurse using my web software needs to ever touch a URL even a single time, or that it would be beneficial to her user experience to even know what it is.
I think it is down to having to consciously decide to search before starting to type instead of just start typing, if you couldn't remember the URL just misspell it and search and it works, a more specific page throw in another word and you get the correct page as a search result essentially every time.
In any case, if I do decide to search, the search field is just a ctrl+k away, so the additional convenience of combining the fields never seemed that great to me. (But for Google, of course, it's a very convenient property of this design that everything the user types happens to end up being sent to Google.)
Are we promoting idiocracy now? If someone doesn't know what it is he/she should find out, or live with not knowing.
Two recent examples off the top of my head are the recommended stories on the new tab page and the ability to disable images appearing in the omnibox.
If the URL bar would offer full URL for copy/paste, but show only the domain, then the feature of full URL copy/paste is hidden.
I think user-visible links would be considered bad UX if it was presented today.
“Alright then you copy this opaque hundred character string into your chat window, make sure you get everything after the dollar sign, or strip it out. Depends on the site.”
Copy and paste is the lowest common denominator of IPC.
...which does who-knows-what behind your back, including possibly communicating with a third-party to see if you are "properly authorised to share", and meanwhile allowing them to subtly insert themselves into monitoring everyone's communication?
Do NOT want.
I assume that they care more about blurring the line between the "Google"-served internet and the regular internet than about losing 2% of Chrome's usage rate.
positive for them, not necessarily anyone else.
Can you imagine removing house numbers from Street addresses? "Where did you buy that? On Main Str., but there wasn't any number..."
If the URLs are ugly it's not Google's place to regulate that, but website's owner.
If this is to protect users, then instead of removing information, add and/or make it more user friendly.
https://www.google.com/search?q=duck&oq=duck&aqs=chrome..69i57j69i59j0l3j46j0j69i65.864j0j7&sourceid=chrome&ie=UTF-8
Because they may be tracking identifiers...
...which I could argue is precisely why they don't want you to know. I always sanitise URLs when I share them with others, because of such things.
Same here. Before sharing URLs with others, I often experiment with removing parameters to find the minimal URL that still works, and then share that.
As a dev, hiding the HTTPS prefix is already irritating especially when copying the URL. If you copy the whole URL, you're fine. If you manually select part of it, starting with the domain, the prefix doesn't copy.
I expect this upcoming change will exacerbate this kind of problem.
Don't we just need a persistent dev mode that doesn't mess around with the URL?
If your goal is to make people dumb and compliant, this is a great idea. Of course we know that's what Google's goal is, because that's what keeps the money flowing.
That's a bit of an absurd claim. Should my grandparents just be using luakit instead of Safari? Are you sure you aren't projecting your experience of technology onto people with a totally different experience of it to you?
>I see absolutely no benefit whatsoever for the general population
A benefit is reduced probability of being phished.
It’s important to understand, while we, the users of Hacker News may find it odd that everyone doesn’t know these things, perspective will tell us they probably have other priorities for their time–and that’s OK.
I don’t know, and honestly don’t care to know or prioritize the deep and intricate complexities of how deodorant or shampoo is made—or how it’s distributed, made safe for human use, etc. This does not make me dumber, it frees up my mental time for other priorities.
The same can be said for the 1000s of things I use daily from toothpaste to refrigerators to stop-lights to dentistry. While I may have a general idea how these processes happen, my knowledge is by no means expansive.
A deep understanding of everything should absolutely not be a requirement to function in a society.
Is Google doing this for bad reasons? Maybe. But let’s not pretend as if simplifying things makes people dumber. It’s freeing up our limited resources.
Expecting everyone to know deep details on the thousands of things they use everyday would absolutely bog us down into uselessness.
One of the smartest things we ever did was to free ourselves from needing an intense understanding of everything we use throughout the day.
As you move throughout today, notice the thousands of things you interact with which you have little idea about what went into it.
Why? Because we weren't forcing https yet in IIS and while I thought I had told it to go to the https site I was either wrong or it had changed. The address bar notification no longer jumps out at me.
I second a persistent dev mode / not continuing to remove address data from the address bar by default.
This is something else.
I'm actually using Edge and it's not terrible. Multiple choices in the market is good.
Including features that help support, diagnose, log, test, debug, and develop are part of that, especially for software that provides a platform. For platforms, developers are one kind of user.
However, developer features should be out-of-the-way by default. Anything beyond the domain is not meaningful to end-users and should be hidden by default in the same way other developer tools are.
2018 discussion with Google's Chrome demo at AMP event: https://news.ycombinator.com/item?id=17923156
It reminds me of a company which developed a product which was more or less done. So the SWE manager and the product manager made up new (pretty useless) features just to tell their bosses the devs are busy and the team must stay intact.
Also consider the sibling comment about AMP - looks like they already have special behaviour for that so this is barely relevant.
I've seen phishing sites like support.google.com.8n.cn where the right side (the most important) just disappears into the /path. Though this attack is even more brilliant on mobile devices that truncate the right hand side and leave with you with "support.google.com...".
Aside, I encourage fellow HNers to purposely visit seedy websites in a VM without an ad blocker. Especially if you haven't been exposed to crappy behavior since the popup/under days. Great way to see the state of hostile web practices, like unblockable popups and fake macOS notifications.
I can even argue that if you take away the path from the URL, then it's actually easier to spot a phishing website since all you see is the domain if you don't hover over the address bar.
If domain-owning organization fails to prevent a third party from hosting a phishing site under a path or a subdomain, that third party is likely well-positioned to deface the existing pages. With a subtle alteration (scripts that capture credentials and transmit them out), the existing pages grant an attacker all of the users with no extra effort—as opposed distributing a link to a fake page, convincing the user that the page is legit, and in the end getting a fraction of the user base.
It's so obvious this move makes it harder for people to copy-paste links, which is a common practice, and moreover misleads people when they try to know what page they're on lol.
test.com/profile or test.com/dashboard/favorites
or many other pages that look like `home pages` of websites are now going to be misinterpreted as actual home pages themselves by users because of this witchery.
If Google thinks this is a good move in that they can get people to land on websites through Search and not directly, it's an undoubtable massive deal-breaker for people like me.
Oh, really? As a security-aware user I really want to see the full URL to make sure it doesn't look something like https://big-vulnerable-site.com/?redirect_url=http://my-mali.... I fail to see a single use case where showing only the hostname or the domain increases the security of the browsing experience. But by now I'm also quite use to Google's way of shamelessly lying their way through.
then having myevilsite.com be the most prominent thing seems like a win.
For you, a power user with presumably years (decades?) using the web and general technical fluency, sure. This doesn't particularly benefit you.
The person it benefits is a beginner (possibly a permanent beginner), who's needs to be taught to look at the domain name of websites before typing in their password. This is already an unfamiliar and uncomfortable concept for a lot of people, and forcing them to parse a long string of line noise to find the thing they're supposed to check makes it worse.
It's very difficult to for technical experts to put ourselves in the shoes of a permanent beginner. We like using computers. A lot of them hate it, but have to do it to pay their taxes or make appointments with their doctor or see photos of their relatives. We think the idea of protecting ourselves from attackers is neat, because it makes us feel in control. A lot of them think it's horrifying, because they feel out of control and exposed. Adding extra little steps, or little opportunities for confusion, has a big impact on these folks, and they need all the help they can get.
This is clearly not their motive.
What Google is trying to do here is to drift the web from its most iconic components: the URL. This is the biggest threat to the web that we loved for so many years.
If it looks like Google.com, then it Google.com. The logo even says so.
It’s a dumbing down of the internet, in an attempt to help the average user, but it won’t work and you’re just making life harder for those who know just a bit more then average.
What better way to keep people on AMP pages, than to make them so ignorant as to not even know how to tell the difference?
Sometimes I wonder if feudalism must have felt like this from the perspective of the noble people. Will there be a dark age followed by enlightenment? Because right now we seem to encounter self-imposed nonage.
AMP adds 2-3 additional actions to that user flow.
For me, it’s to get information. Why do I care what format the information is presented in?
In fact, I think the evidence is not only overwhelming but the tech community is thoroughly comprimised, proven so on account of all the recent purges and attacks on wrong-think.
I no longer trust my software.
I guess some people just feel guilty/ashamed!
That metaphor is based on a false premise[1]:
> While some 19th-century experiments suggested that the underlying premise is true if the heating is sufficiently gradual, according to contemporary biologists the premise is false: a frog that is gradually heated will jump out. Indeed, thermoregulation by changing location is a fundamentally necessary survival strategy for frogs and other ectotherms.
If this is indeed the real motivation, the next obvious target would be bookmarks. What can be done about them? Replace the bookmarked URLs by Google queries? It would be an interesting functionality if Google could look at a page and give you the smallest query that would have returned exactly this page as a first result. Then bookmark the query instead of the URL. And if the search results change in the future... I suppose, it would be possible to spin this as a feature. ("Self-improving bookmarks" perhaps? You don't have to worry about link rot; with latest Google self-improving bookmarks, your bookmark will always point to the best existing page on given topic!)
Just out of curiosity, is there a publicly accessible Google service, or a third party service, that does this? That would be useful to find more content or point-of-view about a topic (by looking at the other results)
Bookmarking is one of the areas where firefox is clearly superior.
It made the Safari 13 Extension-pocalypse so much harder to bear. Every browser I can pick from has something important I have to compromise on.
Maybe like a decade ago this was a student project that Google sponsored (maybe as either Summer of Code or some precursor to that). A student group developed a system for “tagging” a page with a series of “random” but memorable words that could be used to identify a page. Kinda like how imgur and other other sites generate URLs now. Like “glittery hamster bananas” or something like that.
They already had the feature you are worried about and it's existed since like 1999. Do you remember the "I'm Feeling Lucky" button? You could bookmark a query and it would redirect you to the first result for that search. It was discontinued in 2010 [Wikipedia].
I feel like there are a lot more sane things to be paranoid about in the world right now, but mandatory "I'm feeling lucky" doesn't reach my top 20000.
And no, users do not need to care the slightest whether they go to the first, second or 3rd URL. What they care about is that they are entering their sensitive information on mybank.com's domain and not a russian counterpart, that's it.
The onus to protect against a website takeover is on the domain/server owner, certainly not on the browser vendor although they try to mitigate simple attack vectors.
edit: added a few 9s
They already used colors to de-emphasize other components, this doesn't look like anything else than pushing people to rely more on google search.
Refraining from collecting malicious links happens before you click, by the time it's in the URL bar it's already pretty late to mitigate against attacks.
There are a couple of reasons they could be making this change highlighted in these threads.
Users with the level of paranoia that puts Google in the "untrusted site" space should be sidestepping this whole conversation by avoiding using the browser Google develops regardless of what Google does to its URL bar.
The whole idea of AMP pages is sketchy by default, as it's Google taking content from websites run by news media outlets and hosting it on their own servers so they have even more control over user-tracking.
In the long term, this has the potential to further centralize the Internet, something the Internet was never meant to be.
It's not that difficult to imagine a future where news media won't even host their own stuff anymore but instead outsource it all to Google.
Very comparable to how Facebook has become the de-facto place for small businesses, with little to no IT knowledge, to have their own little web-presence.
Which has certain advantages, but it's dangerous to belittle the very real disadvantages that kind of centralization of content will have in the long term.
In that context, it's a bit cynical to belittle the problem as you are doing there when this has been a very real issue for several years. As by now Google, Facebook, and Amazon control the vast majority of web traffic and have been doing so for years already [0].
This isn't some hypothetical scenario, it's something that's already very real.
[0] https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...
IMHO it's our duty as technical users to advocate for a more private, open and de-centralized web for everyone.... We should especially be doing it on behalf of the users who don't understand the long term implications of Google's (anti-) features.
'Just switch to another browser if you don't like it' is not a compelling argument.
Every tool in the toolbox to make the web better.
“Jerry, you don’t deserve the internet” https://m.youtube.com/watch?v=lcR4h4eIR2E
It's iconic but it's a UI space resource hog. To improve browser experience, sometimes one has to be willing to try slaughtering a sacred cow.
2) UI improvements are not "cosmetic reasons," they directly translate to ease and efficiency of task completion. As a UI engineer, hearing my category of work called "cosmetic changes" can be, quite frankly, exhausting. If someone were to halve the default font sizes on all browsers, would we consider that a mere "cosmetic change" or would it be a change that would have direct and immediate impact on people's ability to accomplish tasks?
You know what else is "a UI space resource hog" on the web ? Advertising. And I'm sorry but "wasted" space is generally much bigger. So, no, I'm not ready to loose my address bar for bigger ads.
Chrome is well into the commodity software scale, and one should assume its UI decisions will lean in the direction of maximum utility for the most users.
https://old.reddit.com/r/space/
Fits fine and tells you at least three useful things that just "reddit.com" doesn't.
https://old.reddit.com/r/space/comments/h8t50n/i_often_get_a...
Doesn't fit, but even truncated it still tells you the same useful things.
In fact, using the URL bar for it assumes that the path has semantic meaning, which is not an assumption that the URL standard actually requires.
The page isn't required by anything to contain that information or to give it accurately. How do you distinguish example.edu/financial-aid/ from example.edu/~some-student/ ?
> In fact, using the URL bar for it assumes that the path has semantic meaning, which is not an assumption that the URL standard actually requires.
It doesn't assume anything, it just shows you the URL. If it has semantic meaning then you can see that -- which it commonly does.
That's an unrealistic example because no website worth its salt is going to let students put arbitrary content in the same domain as the financial aid system. That's a recipe for leaking cookies that contain session tokens, and displaying a full URL won't save a user.
By the time you see the ~some-student in the URL bar, the security game is over.
It could be that example.edu/financial-aid/ is just information and PDFs and doesn't have any sessions or cookies. Or the real financial aid system is on another domain, but a first time user doesn't know that, they're just looking at www.example.edu/~some-student/ which appears to be a financial aid page that Chrome only says is example.edu.
Or any other case where the contents of the URL matters. How about example.edu/~some-student/ vs. example.edu/~a-different-student/ or example.edu/~your-professor/?
The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths.
The attacker may not be able to get ~financial-aid, only ~juan-ramirez, and even if you don't know about home directories, the first thing that strikes you about ~juan-ramirez/financial-aid is that something is wrong because you are not Juan Ramirez. If you do know about home directories then it's a giant red flag which you can't see if the browser is hiding it from you.
It doesn't have to prevent 100% of attacks. Preventing 7% of attacks is still 7% better than nothing.
> The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths.
The most common way things like that happen isn't the actual student who would have to be using their own name, it's that the student uses a weak password or gets their computer infected with malware and then some Russian hacker sets up on their school account.
You also don't need every user to understand them, only one who then reports it. If you don't show the paths to anybody then much more likely that nobody notices, or that it takes longer for somebody to notice and more people get compromised in the meantime.
User studies indicate that the first thing a user notices is... Nothing. The gobbledygook in the path is so much noise for the average user that they don't notice if the path seems off. In fact, it makes sense to hide it from a security standpoint to decrease the odds that users go information blind to the domain, because we already know that improper domain routing to lookalike domains is, by far, the most common vector for credential theft.
There isn't even a guarantee that showing the path to address the 7% case (which really looks like more 0.07%) will on average cause the incidence of users being compromised to go down, if it means users are less likely to notice that the subdomain and domain are off.
I'm sure that for the people who really care, it won't take long to hack together a chrome extension that drops the full URL into the page title or a pop-up box on the page itself.
There are a thousand ways to screw up a user study, but one of the best ways to detect a screw up is if they say that users either always or never do something.
> In fact, it makes sense to hide it from a security standpoint to decrease the odds that users go information blind to the domain, because we already know that improper domain routing to lookalike domains is, by far, the most common vector for credential theft.
Which is why it makes sense to highlight the domain. Make it a different color. Make it a bigger font size. That still doesn't require you to omit the rest of the URL.
> I'm sure that for the people who really care, it won't take long to hack together a chrome extension that drops the full URL into the page title or a pop-up box on the page itself.
Except that the people who actually do that really are the 0.07% and you've still lost the 6.93% who would've noticed if you'd put it in front of them but aren't about actively change the default you gave them ahead of time.
... but probably more importantly, nobody likely needs to hack together an extension after all. Older news story about how Chrome will add an option to show the full URL bar as non-default.
https://www.zdnet.com/article/googles-chrome-will-give-you-a...
Also, "use a real computer" is a pretty elitist attitude that misses Google's goals overall. Google is not targeting exclusively users that have desktop machines with multiple cores and graphics accelerator cards. They want to provide internet services and internet access to people whose only portal to the web is a mobile device.
Oh, I'm not missing that. Google's software offerings are now primarily designed for bad computers with bad UI, bad network, and bad energy storage. Because people love those crappy devices and most use them primarily. We both agree.
>A shorter URL bar in the desktop allows for to take up less horizontal space,
Which really doesn't matter if you're on a desktop computer with an actual monitor. The only reason to do this is more "convergence" BS and thinking phone crutches are required on desktop.
Are you seriously claiming you need all (or even just more than like 10%) of your 1920+ pixels of screen width for your Chrome extensions?
It's still cheaper to build a $450 real desktop computer (that lasts decades+) than it is to buy a $800 4 year life gimped smart phone that can't do any productive work any isn't in my control.
(And my $20 nokia dumb phone has worked perfectly since 2006 for phone calls/text.)
We're talking about the person in small-town India who has a Micromax Black Q385 spark 3, 8GB store, 1GB ram, 5.5" screen, which they bought for $50. They also get their Internet access through the cellular equivalent of a drinking straw.
(Even still, my personal guess is that this URL bar change isn't about them; it's about the desktop experience).
A few months back, people on HN were wondering why creating a new tab in Firefox causes the URL bar to become magnified.
I wonder if this is part of the reason. Perhaps Firefox believes they have to educate users about the URL bar because Chrome is attacking it.
Safari has hidden the full URL since 2014. For the vast majority of users, the full URL is just noise.
If the problem is that showing the whole url might hide the domain, why not make the domain bold? or highlighted some other way? What about separating the domain and path when viewing (but not when editing)? it's a bit hard but quite possible.
It's called "kicking the ladder after climbing the wall".
I guess they forgot what "information software" means. I use Firefox, but this is just bad design.
Desktop and mobile apps somehow survive without them. If URLs are important, why don't developers include their own URL system in those?
There's also an accessibility setting to always force zoomability, even when the site disables it.
Edit: Brain mashed together 1Password and KeyPass.
Now… well, IE11 doesn't even support ES6 properly, and good sites have started relying on that, and Edge is just evil Chrome – unless it's got Firefox installed, Chrome's your only option. But sites that use Chrome-only APIs aren't worth using anyway.
(Oh, wait, Zoom needs either Chrome or a malwarey desktop program.)
And there are alternatives to Zoom, e.g. Jitsi.
...and the malwarey desktop program is also Chrome.
I also don't understand why everyone is up with pitchforks at Google on this when Apple did the same thing to URLs a while ago. I guess engineers are just as susceptible to groupthink as anyone else.
They do kind of do that. Rather than going through the consensus process for getting a web standard added, they implement it in chrome then unilaterally write a standard for themselves. See for example, the SGX (signed exchange) "standard" they pushed out.
Do you think IE6 was bad? Remember how long it took to get rid of it? Imagine a world where the monopoly leader doesn't just walk away from the browser (which is what MS did with IE6) but actively abuses the situation. It will be orders of magnitude worse. Say hi to amp. Say hi to chrome. Say hi to google. Say goodbye to the web.
I suspect a lot of people in this conversation are not old enough to remember, even if they wanted to.
Maybe universities should have an obligation to promote nonprofit tools (i.e. Firefox) rather than shady commercial software that only happens to be gratis.
I think this feature is important enough for me to consider switching this time.
That being said, I admit that staright out of the box Firefox doesn't have the same experience but you can customize every little thing about it to make it suit your needs.
This said, I honestly don’t understand what people mean when they say the experience is “superior” in Chrome. It’s a web browser. It browses. You get passwords saved and synchronised. Everything else is an extension. What’s so bad about FF...?
I just could not live without firefox and being unable to share tabs/links from anywhere in my phone to my desktop and or laptop
I hate the hell out of that. My phone is my phone, my laptop is my laptop, just leave them alone.
It also felt noticeably slower at the time.
Finally, with Chrome's market share, good extensions that Just Work are more common there, in my experience. I use a whole host of plugins on desktop, and when I looked at switching back to FF last year, I did not find equivalents for everything.
I did go back to FF on mobile, because I do remember the nightmare of IE 6 and want to protect the web from total Google control. On mobile, I miss the dev tools and array of extensions less.
As for bookmark, firefox should be able to import chrome bookmark. It can even import saved passwords and cookies so your active session is preserved.
I don't think Mozilla's trying to please Google in any way. Google's keeping Firefox around to try to avoid the appearance of a total monopoly.
But Mozilla's behavior certainly is influenced by trying to find alternative business models, sometimes not perhaps with the best results, (Mr Robot promotion everyone), I still think it's worth using it over Chrome.
Did you know that Apple does in fact get more money from Google than Mozilla does, for keeping their search engine as the default? 12 billion dollars in 2019. Do you think Apple would activate ad blocking by default and risk losing that many billions of dollars? Speaking of which, Safari's ad blocking is the joke of the industry.
You could make the case that Safari might survive if Google cuts its funding, but judging from the history of IExplorer, I have my doubts. One could make the case that Safari is alive just because Apple is making a shit ton of money on it.
Did you know that Microsoft's Bing Ads platform made them 8 billion dollars in 2019? Do you think Microsoft would do anything to jeopardize that ads revenue? Did you know that Windows 10 has an "advertising ID" used to personalize ads, that via Edge is transmitted to Bing?
Did you know that Brave, that leech which is piggybacking on other people's work, that's supposedly blocking ads by default, is effectively replacing publisher ads with their own, then forcing those publishers to enter into deals with them for a piece of the action, while making it really hard to detect and block Brave? All the while pushing shady cryptocurrency affiliate ids straight in their source code?
---
Mozilla might not push for ads blocking by default.
But they do block trackers by default and their browser is afaik the only one that has legitimately supported uBlock Origin on top of Android. And uBlock Origin is the best, most aggresive ads blocker available and given Google deprecating the blocking ability of the WebRequest API, Firefox might remain the only one with a uBlock Origin implementation.
Could Firefox survive without Google?
I don't know, but can any other browser survive without Google or Bing? I have my doubts and you'd be naive to think otherwise. Plus this is just whataboutism.
Brave does not depend on Google, directly or otherwise. They depend on an open source project called Chromium, which is largely developed by Google, but because it is open source anyone can build off of it.
Brave funds their development through the BAT token and through affiliate marketing, both of which are much better for user privacy and security, and much more resilient to Google than where Mozilla is getting its money.
No, I don't think Apple would integrate thorough ad-blocking by default, just as I don't think Mozilla will do this either. Brave has already done it. Brave's ad-blocker works better by default than any ad-blocker I've used, and I've tried them all.
HN's hate-boner for Brave is very strange. They clearly care more about user privacy than any other browser vendor (except maybe Safari, but again they have a conflict of interest), and it is built on a core that is arguably the best at handling the modern web (Chromium).
Microsoft wasn't able to keep developing a browser on their own, I doubt that Brave could. The problem is that a browser nowadays is so complex to develop that you need serious resources to invest in it. Without Google's ongoing development, Brave would not survive. And given Google's changes to undermine ads blockers, it's going to be interesting to see Brave struggling to maintain their fork.
---
> much better for user privacy and security
Right, keep telling yourself that.
Btw, I actually wonder how what Brave is doing isn't copyright infringement, given they are directly profiting from blocking the ads of publishers. I guess they are small enough to not matter, for now.
---
> Brave's ad-blocker works better by default than any ad-blocker I've used, and I've tried them all.
I worked on anti-ad-blocking technology.
Nothing beats uBlock Origin running on top of Firefox, everything else was strictly inferior. Not even blocking JavaScript in the page, because you can easily force the user to enable JS for you by breaking the content on that page. uBlock Origin is so bad that we avoiding it entirely, being useful for people frustrated with AdBlock Plus to turn to, sort of like in the Matrix.
IE was woefully out-of-date. MSFT then tried to build a browser from scratch. That was a lot of effort, so they decided to fork Chromium (like Brave) instead. What exactly do you think would happen in Google dissappeared tomorrow in their case? Do you think they would go back to trying to build their own browser from scratch? No, they'd just keep developing Chromium. Many (most) changes would probably be upstreamed. Forking a browser and maintaining it is orders of magnitude easier than starting from scratch in [current year]. As you point out, there are not multiple parties building on Chromium, so I'm sure slack could be picked up if Google switches gears. But you're right, maybe Brave won't be able to keep up with upstream changes that make ad-blocking harder. In that case, you can always just switch browsers. In the meantime, however, I'll use the browser that does a better job of protecting privacy by default.
> Right, keep telling yourself that.
Luckily, I don't need to. A browser that blocks ads by default is objectively better for user privacy and security than one that doesn't.
---
> Btw, I actually wonder how what Brave is doing isn't copyright infringement, given they are directly profiting from blocking the ads of publishers. I guess they are small enough to not matter, for now.
They aren't directly profiting off of ad-blocking, so maybe that helps.
---
> I worked on anti-ad-blocking technology. Nothing beats uBlock Origin running on top of Firefox, everything else was strictly inferior.
Have you actually tried Brave? Works better for me, and I've tried Firefox with uB0. Have also tried Chrome with uB0. Brave blocks both ads and tracking more consistently across the board. It occasionally breaks a webpage, but I have reported those to Brave and two of them have been fixed (out of like 5). This process is clearly better for users than everyone having to configure their uB0 Matrix and such separately. Brave is creating a web where all the privacy violating / attention grabbing shit is very much blocked by default in a much stricter way than other options. When this breaks the internet, they fix it and because this fix is part of the blocker it fixes it for everyone.
"Updates" may be, large, architectural upgrades? Doubt it. There's a reason they didn't start fresh and I very much doubt they'd muster the resources to maintain development were Google to drop it. Google has invested billions, probably tens of billions into Blink engineering.
What I could see happening is Brave forming some sort of a coalition with KDE and the wider open-source community in the better case or trying to switch to WebKit in the worse case as that is exchanging one corporate overlord for another.
Not to mention Brave's VC funded, so they'd want some form of a meaningful exit at some point.
The bigger concern however is not that Google will not fund Blink development, but that it will increasingly implement features that primarily benefit itself and Brave, as a dependent player, will be spending an increasing amount of resources trying not to get eaten by Google's "direction tax", as all developers depending on a 3rd party corporation they're in some sense competitors with find out eventually.
See also Twitter 3rd party client developers or the many AppStore devs Apple burned and ruined their business overnight.
And its content blocking, speaking both as a user and as somebody that worked on anti-ad-blocking technology, is really easy to circumvent and only useful on websites that haven't adapted yet.
As an iPhone user for me it's bad enough to make me want to switch to Android. What works consistently well has been DNS-level blocking (Pi-hole, NextDNS).
For you it might be OK, but I can tell you Safari is a favorite among the big players in this space [1].
> I never switched away from Firefox.
I switched to Firefox... from Netscape/Mozilla.
Edit - found it: the setting "browser.urlbar.trimURLs" hides the "http://" protocol if it's used. I do a lot of local development and found it annoying that Firefox was hiding it.
I hope I'm just being alarmist.
I don't know if there is a way to "bless" such an authority once it's added to the trust store.
When I wrote the message I wasn't in front of Firefox, now I am. So to summarize:
* The CA's certificate is added to the Firefox store and trusted.
* Visiting a site gets the lock in the address bar.
* Clicking on the lock in bar shows "Connection secure. Connection is verified by a certificate issuer that is not recognized by Mozilla"
Screenshot: https://imgur.com/a/T4rznXK
This list is necessary anyway, because you have top level domains that look like .co.uk, so you can't just split the domain name by dots and take the last component to determine the top level domain.
So, not saying I unconditionally like the fact they are hiding important information in the URL bar, but I would not say their default behavior is that broken.
[1] https://publicsuffix.org - probably the list being mentioned in the video linked by the parent commenter, I guess
You don’t have this issue at all for domains that don’t have a www subdomain.
Furthermore it would be extremely confusing to have different content for www.example.com & example.com.
My company uses DNS load balancing for a root domain, though, so either I'm misunderstanding you or you're mistaken about what's possible here.
We use Constellix's DNS management to have round-robin DNS via multiple A records for 'nxtbook.com'.
If you're thinking of some other form of DNS load balancing, would you please clarify?
Edit: another common use case is hosting your static website on S3 or github pages. Typically it's done by adding a cname entry to s3 or github.io (been a while so hopefully I remember it right). You can't do this on root, unless you're using another server as reverse proxy (e.g. cloudflare's cname flattening service). Again, it's benefits cloud vendors (cloudflare got more potential customers by offering this service for free) but ultimately hurt people that want to host their small websites.
Definitely simpler, and a good argument against using the root domain.
Thanks for clarifying!
But why?
But www.example.com isn't necessarily the same website as example.com.
As a practical example, the website for my current employer had not configured their "bare" domain. When applying for a job I decided to check out their website, and copied only the "bare" domain and pasted it in my browser. Didn't work, just timed out.
I tried a few times and through "huh, website down for a few days, that sure doesn't look good". Then on a whim I figured I might try the "full" domain, and sure enough that loaded up straight away.
One of the first things I got done when I was hired was to ensure the "bare" domain worked.
If I want to be on www.example.com and I'm actually on example.com, then yes I can discover that by looking at the URL.
I feel like I'm going in circles.
They're two different web pages. Possibly with entirely different information. Possibly run by entirely different people. Possibly with entirely different trust levels and threats. It conveys which of the two web pages I'm looking at. How is that not useful information?
The specific of how you've decided to run your site or serve your pages is irrelevant. You may serve a page depending on if the http request came over port 80 or some other port or via http or https or at this time or that time or other.
www.example.com and example.com might be two different websites.
If you want the content at www.example.com and you go to example.com, then may not get the content that you wanted. One might be a shop selling shoes and the other might be a shop selling hats.
If you want a hat and you go to the one selling shoes then you're going to be disappointed.
'www.' doesn't 'mean was HTTP accessible'. You can make any system HTTP accessible, or not if you want to.
It doesn't matter how you or I set up our websites, or whether you or I think it's a good idea to have different websites at these addresses, it matters how other people set up their websites and if they choose to do this or not. Some do! Therefore the user needs the information.
You could send different websites based on what port the request comes from. But doing so would be bad and wrong, and showing the user the outgoing port is definitely not necessary.
But that's you controlling that, as the person running the website.
When it's the user controlling it, by setting which domain to visit, that's in their control, so they need to see it in their UI.
If you're going to reduce to the absurdity of 'anyone could serve anything from anywhere' then why show a domain at all? ebay.com could serve me the content of google.com, so let's not bother with domain names? Is that your argument?
I'm not making an argument about what should be shown right now, I just think your argument, based on what "might be different", is pretty flawed.
But there's no standard that requires this, that I'm aware of.
Chrome are acting like there is, but I believe there isn't.
So yeah, hiding www is annoying and confusing in this situation, because Google just assumed something about the web/domains and forced their assumptions on everyone.
A screenshot of the browser will not show the www, making it more difficult to find the website.
At this point, That's just sloppiness on USFCA's part.
Can I pull that off in FF?
Interesting. Other comments in this thread indicate that the only extension that can do this has its ID hard-coded in the url parsing code to be whitelisted.
1 - Selecting multiple tabs and saving to bookmarks: you can't add to an existing folder without creating a subfolder.
2 - Add keywords to bookmarks: no way to filter bookmarks that have keywords. Also, when typing on the address bar, the keyword doesn't get highlighted or anything
3 - can't add a custom search engine. You have to add its extension, if available. Or add as a bookmark with a keyword, but then you won't be able to see a list of all search engines...
As a full time, happy Firefox user, this annoys me to no end, increasingly so as there are more and more competing search engines that I want to try.
I’m pretty sure that you used to be able to add arbitrary search engines too (by specifying the search URL with %q for the search query). It’s amazing to me that they would remove this.
Not only that, but on Chrome I have Amazon, Youtube, Reddit, all setup as search engines. For reddit, besides 'rdt' for general search, I also added keywords for searching inside /r/anime, /books, /ps4, and a few other subs I occasionally search.
I also think they used to have this, as Chrome still has. But no idea why they changed it.
For example if I were to go to something like https://raw.githubusercontent.com/<user>/<proj>/<path> or
the most relevant parts of the url as far as security/trust is concerned is the domain githubusercontent and <user> not the raw subdomain
What's taken you so long ?
Here the address bar would show "(padlock) [Github Inc] Github.com > Name Of Account > Name Of Project" for example. This is much clearer for end users.
Developers can always toggle an option to always show the URL or something.
Google is an ad-company and will do everything in its power to change the web to fit their business. You the user don't matter anymore.
That being said, if you look at most non-IT persons using a browser, the URL is just visual noise for them: showing the domain prominently is perhaps (and _just_ perhaps) a better way to make them take notice.
Not that I would ever use this for myself though. I already disable FF URL formatting and "trimming".
This is extremely sketchy, just stealing other people's content (as they also did on YouTube for years):
https://www.androidpolice.com/2018/09/21/chrome-tests-hiding...
These are dark patterns, making way for other browsers, such as Firefox.
This sadly will ensure this keeps being the case...
https://bugs.chromium.org/p/chromium/issues/detail?id=108440...
I would like to see some examples of this because that makes zero sense. The only reason I can see is to “dumb down” the browsing experience to reinforce Google’s position as gatekeeper.
I'm glad I've switched back to Firefox when they launched Quantum.
(I actually like Gnome's statement)
Personally, I don’t mind this being the default so long as there is an easy way to change it to see the full URL.
Personally I quite like it. From what I understand the main goal is to make phishing attacks more clear to the user, since this is ultimately only a thing the end-user can protect against. Removing the noise definitely helps for that.
Having had it like this in Safari for a long time, I must say I greatly prefer this over the older behavior---the only time I care about a full URL is when I select it to copy it.
How are they better than those in Firefox? It looks like you did a thorough analysis.
Unless you need to modify the URL often, but it has the hover behavior and if even safari has an option for it, I can't see google removing that option.
DuckDuckGo gets about 75% of my searches nowadays with the rest going to Google. Still using Maps, GSuite and Android... Baby steps!
There will be some VP of Product or Engineering buried deep in the bureaucracy who is pushing this, deciding with no evidence (or, worse, lots of evidence to the contrary; believe me this happens) that it is the "users who are wrong" [1].
It now takes something like 4 taps to get to the point where I can correct or otherwise edit the URL in my mobile browser (Safari) as I have to go through different layers where someone, somewhere has decided I can't possibly mean to edit the URL so I must be wanting to select the entire thing.
I'm sure this same "it's the users who are wrong" from a handful of key stakeholders that is pushing AMP. And for something that supposedly improves the mobile experience, it doesn't fit on my iPhone 11 screen and it's also disabled zoom. This is probably because I've changed the default zoom, something that gives me no end of problems but I can't control how bad my eyesight is and I don't need a company telling me I'm wrong for wanting to zoom. There is never an excuse to disable zoom on a browser and browser makers should remove the ability for sites to do this, period.
I used to love the simplicity and features of Chrome. I once relied a great deal on Chrome Sync. For years I've used a password manager so a lot of the need for that has gone away. Sometimes it's nice to be able to open a page I have open on another device but I can also live without this.
I'm tired of this anti-Web and anti-accessibility SJW nonsense to the point that yeah, I'm ready to ditch Chrome.
> I'm tired of this anti-Web and anti-accessibility SJW nonsense
“SJW” must have a meaning I’m not familiar with, because Social Justice Warriors would be pro-accessibility, not anti.
https://9to5google.com/2020/06/12/google-android-chrome-blac...
Either way though, can't really go wrong with more descriptive/functional names.
Idiocy would be an anecdote my father told me in the mid-90s about his workplace trying to implement the same spirit with a naïve global search-and-replace, leading very quickly to a company-wide invitation to an “African-American tie dinner”.
But even that isn’t anti-accessibility.
Without mentioning other connotations, IMHO the rise of computers have in places supported discriminating (ie. 0 vs 1) culture, because that is simply what computers can do best. If just renaming terms changes changes this can in fact be doubted.
I am actually not so happy about the consequences of hiding URLs to people. This will also change how we will perceive the Internet but IMHO not for the good. And here the motivations are not as clearly communicated here. It might actually hide some of the beautiful heterogenity and complexity of the Internet to the average user also with unforeseeable consequences.
Or maybe offended by the fact that most pages on the web have light/white theme?
This is getting ridiculous (together with github ditching the name "master" - https://twitter.com/natfriedman/status/1271253144442253312), maybe it is the result of too much working from home recently - people create problems where there are none.
What is even more funny is the fact that those changes are proposed by white guys without any complains from the black folks.
Because of its etymology and history [1] for starters:
n.
also black-list, black list, “list of persons who have incurred suspicion,” 1610s, from black (adj.), here indicative of disgrace, censure, punishment (attested from 1590s, in black book) + list (n.). Specifically of employers’ list of workers considered troublesome (usually for union activity) is from 1888. As a verb, from 1718. Related: Blacklisted; blacklisting. [32]
> Or maybe dark mode
Dark mode is not used in a negative way like "blacklist" or "blackballed". And it accurately describes exactly what happens. Unlike "blacklist" which is an inaccurate idiom that relies on "black" being used to mean "bad". So no, I doubt "dark mode" would offend anyone.
> Why would anyone be offended
You could start by learning about microagressions [2]. This one covers "blacklist" specifically. And was presented by a black man if that helps you with credibility.
> This is getting ridiculous
I agree that systemic racism has gone on for far too long. Even conservative four star US generals are starting to say we need big changes in society.
> What is even more funny is the fact that those changes are proposed by white guys without any complains from the black folks.
You are wrong. Just as one small counter-example the presentation I already cited that discusses "blacklist" was made by a black man. Anecdotal, but my black friends have sent me many resources recently about how to become a better anti-racist. Our diversity initiative at my current client is being lead by a black employee. This is coming from oppressed black people who have been very visibly protesting injustice for over two weeks now for the most recent injustice. And for decades actually for anyone who has been listening.
[1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6148600/
[2] https://www.appic.org/Portals/0/2018%20Conference/APPIC%2020...
But “blacklist” is entirely different. “Blacklist” uses a color term to describe the acceptability of something. It relates a value judgment to a color. I don’t know the history of the term, but I can easily see how it could be at least somewhat offensive.
None of this is to say that the term “blacklist” is problematic or should be discouraged, but your argument about it doesn’t hold water.
I don't know how others feel about it, for me connecting blacklist to those is quite racist.
What would you say about Black Friday?
Or white Christmas?
Dark mode doesn't have negative connotations. A 'blacklist' is negative selection, as opposed to a 'whitelist' which is positive selection. I didn't even realise this until I came across, and, on reflection, I agree that this is a simple change in the right direction.
If you can't even stop using black to mean negative in the workplace and substitute it with more accurate words - the new words are clearer - then you likely are not prepared for the real work ahead.
I'll also add the problem is not imaginary. Microagressions are a well documented and well studied category of racism. You can find many studies with supporting evidence. While you might choose to critique the scientific rigour of existing studies, you would have to do that with your own counter evidence, and not with a dismissive "it's imaginary". You could start here: https://journals.sagepub.com/doi/abs/10.1177/174569161982749...
The "black" is not racial but metaphorical, as in "the absence if light". The connection to dark-skinned folks is accidental through the science of optics. Light being good and darkness being bad is part of most (all?) monotheistic culture. To excise them all would include considering much art, culture, and even holy texts insensitive. It's overkill, especially when there are more pressing reforms to pursue.
There's a nice confluence where basically all parties win by eliminating "blacklist" from benign contexts, but the original violence is not racial at all. Religious and political, sure.
In case I am not clear, if we want to be on the side of education, accurate history, and truth, we should not assume racist history and intention everywhere. In this case, it's an entirely different form of tyrrany, violence, and bigotry, but we should be careful about appearing overzealous and under-informed.
> The connection to dark-skinned folks is accidental through the science of optics.
Both of these are an oversimplification that leaves out other context and other history.
The first recorded use of the term "blacklist" occurs at the time of mass enslavement and forced deportation of Africans to work in European-held colonies in the Americas.
> To excise them all would include considering much art, culture, and even holy texts insensitive.
That is a strawman. No one is suggesting to eliminate all historical uses of darkness meaning bad. What we are talking about is very specific: words that are very commonly used in a modern work setting, and that have clearer alternatives.
> The connection to dark-skinned folks is accidental.
It far too convenient that "black" continued to mean evil in the midst of widespread dehumanization and slavery for it to be purely accidental.
Consider also that the Latin word "niger" had many of the same figurative senses ("gloomy; unlucky; bad, wicked, malicious"). Another accident?
But if it were accidental - and I think that would be near impossible to prove - many microagressions are accidental.
> we should not assume racist history and intention everywhere
That's another strawman. Where was that assumption made? Besides the fact that much of modern Western history is racist.
Racism against black people in the US has survived for well over 200 years. Thanks much in part to lack of intention. Clearly, it's not enough to have absence of bad intentions. We tried that, and it is not working.
There is also this quora answer from an apparent Yale linguist specifically saying blacklist does not have racial origins, mentioning other phrases like "black sheep" that are only racial in inference, not especially in implication.
https://www.quora.com/Is-the-term-blacklist-racist
I also disagree that microaggression can be accidental, though I do think reflexive actions can betray racial attitudes. But that lies typically in instinctive actions like purse-clutching, not in formation of artistic or other creative devices like Stevenson's black spot, Tolkein's Black Gate, or the various incarnations of "black swan".
To reiterate, I am actually fine getting rid of the term blacklist given it's very negative history, but it's a stretch, and counterproductive, to racialize the term. That sort of overreach plays into the hands of people like Trump, who are not afraid of portraying these movements as unhinged.
They would be, except blind, simple-minded activism tends to have unintended consequences that make it a net negative for the cause.
What on Earth.
None of whom would know how to change a tyre or what a transistor is.
1. https://www.ribbonfarm.com/2009/10/07/the-gervais-principle-...
Wtf is wrong with you people it's no longer 2016
_citation needed_
It's funny what the final piece of straw is that breaks peoples' metaphorical camels' backs.
Still, better it breaks and people make the move to greener pastures — hopefully Firefox rather than Chrome-with-even-more-questionable-ethics … I don't remember the name, something like Courageous or Fearless or something like that.
(Poor camels, though)
For me, it was their removal a few years ago of the option to use the Backspace key to go back to the previous page.
The comment was entirely reasonable apart from the (accidental?) misuse of the TLA. But it also was anti-management and anti-talker, so lots of parasites here would have downvoted it anyway.
Uh, what? It’s changing the UI to hide parts of the URL.
Look, I’d prefer it the other way too, but we have to choose the right words. The thought process shouldn’t be “I’m mad, what else makes me really mad like this? Oh yeah social justice workers. This UI change is therefore like social justice work.”
EDIT: I was clearly disagreeing with the parent badmouthing SJWs wrt accessibility...
It feels like someone printed out a website to a PDF and decided that was good enough to serve!
"Pushing for accessibility" is a pejorative now? What in the world is going on in this thread?
The parent's point is that someone who would self-identify or otherwise be described as SWJ would more likely push for greater accessibility to a fault rather than reduce it for aesthetic reasons. The attack on “SJWs” in the grandparent is misguided because it misunderstands their motivations so completely that it’s clear that the term is just meant as “people I vaguely don’t like and I feel have it out for me somehow.”
Congratulations on making everything about politics, even if it has zero to do with it.
Just FYI, you can touch once in the URL bar to set focus to it (the whole URL will be selected), then touch and hold down on the keyboard (which will then act like a desktop touchpad) to move the cursor around to edit the URL.
I find this handy, though it took me a while to get used to it.
To be honest, I wouldn't be terribly surprised if this entire subthread was mostly PR firm manufactured and designed to drown discussion and outrage about a topic Google knows is going to be bad for it.
A telltale sign of a manipulation campaign is when someone says something outrageous in a way that doesn't make sense and it gets pushed to the front of the discussion. Especially when that discussion will likely be bad for a major corporation. It's not a 100% accurate detector, but it works a lot better than being a rube.