Hacker News Reader

Comment by gub09 | Hacker News Reader

Please, web developers, as a minimum, set up your websites so that they do not depend on Google, Facebook, Microsoft, Amazon or Apple for their functionality. That means, for example, use DoubleClick or AdSense or GoogleAnalytics if you like, but please do not use jquery from Google's CDNs. If you do that, and the site is dependent on that functionality to work (i.e. for text to be displayed), those of us who don't allow Google CDNs will not be able to use the site. The same for WebAssembly: use it if you like, but please don't make your actual content unnecessarily dependent on the use of services from these multinationals. It makes the Web less free.

View on HN

Thing is, if you're a news site, your news isn't going to show up on Google's news platforms if it doesn't support AMP.

As a customer, I don't like this behavior at all. I do not like AMP, mostly for the small issue that it's very difficult to link to the base page. Minor consistent inconvenience, major feature rage.

But I can't imagine what it's like for a web developer. You need to support a whole other platform just to maintain your audience, which is also your lifeblood. Also, that audience won't actually see your page; just the text with some Googly UI. Avoiding it would be fantastic, but it also wouldn't be a realistic option.

One of the comments in Alex Kras's linked page asks "Can’t you make a direct link to your site’s page auto generated on your article templates?" [0] which seems a very reasonable, though perhaps not ideal, solution that doesn't require Google to make AMP optional, something I think Google is very unlikely to do.

[0] https://www.alexkras.com/please-make-google-amp-optional/#co...

It's really strange to me that Google just decided to remove the option to not use AMP. I personally hate that part of it the most. It's like someone made the decision to not even fight the take-rate battle. "AB test it? Hah! They'll use it if they want to get to the result!". It seems to be getting them tons of ill will which they could easily fix by just putting a non-amp link on results. Then again, "tons" on HN equates to basically nothing across their whole user base, so I doubt they really care too much, but damn, what an awful idea/decision to take away the choice.

I was under the impression that WebAssembly had reached cross-browser consensus and isn't a service from any individual multinational.

How would using WebAssembly make the web less free any more than using other new features like Async/Await?

It depends on what you do with that blob; if you use it to request some required encrypted content, for example, users won't be able to do much about that.

> That means, for example, use DoubleClick or AdSense or GoogleAnalytics if you like, but please do not use jquery from Google's CDNs.

Why is Google Analytics ok and not their CDN?

A website still functions without Google Analytics.

99% of websites won't function if they lose a key library.

maybe this means Google Analytics isn't a key library?

That's what the person you are responding to is saying.

Yes that's what people in this thread have been saying. I'm not sure what your point is.

My point is that anyone can use an adblocker or Squid proxy filtering to block GoogleAnalytics, but if the site uses jquery from a Google CDN to render content, that cannot be blocked without making the site unusable. It's even worse if the Google CDN request is made with https, because then a redirection needs to be made inside the browser.

Can't you whitelist the specific jQuery library on Google's CDN though?

Serving widely used libraries out of a CDN is a best practice for a reason. Most visitors will already have it in cache. What alternative are you supposing? Local hosting? That has drawbacks, including more cache misses and increased bandwidth costs for the website provider.

Right, but then Google can leverage their CDN to track you, whether or not you also let them show you ads through normal channels. Ideally people would use a CDN not built to track people around.

Presumably once Google traps you into an unblockable ad channel (on mobile or whatever) they will unleash the tracking they've been doing on you.

No doubt Google considers it a best practice, because they are in the business of knowing what people do on the internet. How often will a browser get the jquery for a particular website or check with the CDN? There are a lot of jquery versions in use, the cache gets deleted (often on browser close) or expires, cache-age=0, etc. Almost always?

Besides providing jquery themselves, websites can use a CDN from another provider. OK, that might cost an extra 20 ms.

It's really not as beneficial as it sounds in theory. Sites uses different versions of these libraries. You would be better serving a single minified asset that is cached for your users.

It's not always the user doing the blocking. A lot of sites broke for me when I was in China because they were trying to fetch resources from Google's CDN, which is/was blocked there.

Surely the primary blame there lies in China's censorship of the Internet, no? Isn't it just assumed that if you're traveling to China you need to be using a VPN in order to have the web as you're used to it work normally?

Websites using cdns should always use a server hosted backup, it's not that hard

  <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
  <script>
  if (typeof jQuery == 'undefined')
  {
     document.write(unescape("%3Cscript src='/serverHostedJquery.js' %3E%3C/script%3E"));
  }
  </script>

It's annoying to test though. You'd be better self hosting everything and putting a CDN in front of your site.

Is not it better to serve scripts from your server? It gives you more control and you don't have to share your visitors data with Google. With external hosting you get more downtime, and in some countries Google servers are blocked so you get less visitors.

>The same for WebAssembly: use it if you like, but please don't make your actual content unnecessarily dependent on the use of services from these multinationals.

WebAssembly is an open-standard.

It's EXEs and JARs for the Internet.

Sure, it has a text format, but it's the equivalent of Lispified Java bytecode. (https://developer.mozilla.org/en-US/docs/WebAssembly/Underst... (uninformative but current), http://loyc.net/2016/lesv3-and-wasm.html (2016, from when wasm wasn't finalized, but has some good concrete examples that look like the wasm in the first link))

With this being said, it may actually be easier to figure out wasm than frameworkified JS since you can apply IDA-style reversing to it.

Open question: what existing tools and research are good at inferring the high-level behavior of stack machines? Eg, research papers, or (preferably open source) tools for reversing eg Java code. I want links I can throw at Ph.Ds.

Obviously not open-source, but IntelliJ's decompiler is excellent.

>It's EXEs and JARs for the Internet.

It's bytecode. I'm not sure if it is a big downgrade from 100,000 lines of minified JS code.

>With this being said, it may actually be easier to figure out wasm than frameworkified JS since you can apply IDA-style reversing to it.

It may.

> those of us who don't allow Google CDNs will not be able to use the site

I can't imagine this accounts for more than a tiny number of visitors and people technical enough to do this will know what to reenable.

Reply on news.ycombinator.com