Hacker News Reader

Comment by zackbloom | Hacker News Reader

The reason it has to be prefetched from not-you is to protect the users privacy. Until they click a link it is not considered acceptable to leak their search to the potential destination. Links have to be fetched from a third-party who the search engine trusts not to share the data, that at the moment is Google but will hopefully expand.

View on HN

Google already can do this by preloading a cached page from its own domain. So this specification is unnecessary.

I think the real reason is that Google wants to build a walled garden, but doesn't want the walls to be noticeable. Even with AMP, they display a header that looks like a browser's address bar [1]

Also, on that page Google admits that it uses AMP Viewer to collect information about users:

> Data collection by Google is governed by Google’s privacy policy.

Which is probably their real motication for creating AMP.

[1] https://developers.google.com/search/docs/guides/about-amp

> Google already can do this by preloading a cached page from its own domain.

That's what AMP already did. This spec is better because it ensures publishers retain control over their own content, and doesn't confuse users by showing "www.google.com" in the URL bar for content that didn't originate from Google.

Publisher might want to display their URL in the address bar. But as a user I want to see the actual URL, not what Google or publisher want to show me. I don't want to see "example.com" in the address bar while I am actually connected to Google via a TLS connection signed by Google's key and my IP address is collected according to Google's privacy policy.

What confuses users is Google displaying a fake address bar [1] or browser displaying the wrong URL.

[1] https://developers.google.com/search/docs/guides/images/amp0...

The URL you see _is_ the actual URL. It doesn't matter where the content was initially loaded from because the page is signed by the publisher's private key (the publisher has full control over the page contents, Google can't alter it).

The content is served from Google's servers according to Google's (not publisher's) privacy policy. While Google cannot alter the content, it sees the unencrypted HTTP request. I don't want neither Google nor publisher to control contents of my address bar.

Google already knows the unencrypted contents of the page, and they know you clicked on a link to it (from their search results page). The signed exchanges system doesn't reveal any information to Google _or_ the publisher that they don't already know.

Your browser controls the contents of the URL bar, not Google or the publisher.

But Google controls my browser.

Have you tried changing browser? -- Written from my Chromium browser installed from the Fedora Linux package repository.

I actually use Firefox and avoid Google products where possible, but for the majority of users Google is controlling their browser.

I copy your post, but make it available further up the thread. Even though I sync your comment’s edits to mine several times a day, I also control Hacker News so I get them to display your username in place of mine, as to not confuse readers.

Page and DNS prefetching exists, HTML exists, why not just link to the page on the original domain?

> I think the real reason is that Google wants to build a walled garden

Exactly, this is the real reason why this abomination came into existence - all of this is masked as work for greater good all for those poor kids with limited network speed. As end effect everyone will suffer - user will never leave google ecosystem, he will remain on search page without even knowing about it, creator will lose control over his own content

Exactly: Google built a walled garden and now replaces the fence by glass, because people don't like the view from inside their cage. The worst thing is, that it'll get away with it.

„Considered acceptable“ by whom?

Why should the user‘s privacy be protected toward the content provider instead of the search provider? The search provider already knows more about me.

Edit: I completely misread the comment, but can't delete it anymore a minute later because someone already commented. So oops.

Reply on news.ycombinator.com