Hacker News Reader

Comment by 0x006A | Hacker News Reader

AMP really has to go away, its a MITM attack on the internet. Google discontinues so many services, why is AMP not one of them yet?

View on HN

The worst thing I've seen recently is amp URLs for reddit threads. It's one bad thing (new reddit UI) wrapped in a worse thing (AMP), and getting back to classic reddit takes a lot of gymnastics. The stupid part is that the amp page is indistinguishable from the (new) reddit page (the AMP page comes complete with the "download our app" popup). So I don't see how it's providing any speed/experience benefit.

I can never get the Open In Reddit app button to work. I’m on iOS and have the latest version of the official reddit app. Which btw is painfully filled with ads.

On Android I have a similar problem; I use Reddit is fun, and so it doesn't open that app; it always wants to download the main app.

It never works for me either, but there is a workaround. If you click on the 'x comments' link at the bottom of a post, it will open up in reddit is fun.

May I recommend using any 3rd party app for reddit instead of the official app. I use relay on Android and it is great. There are many other options, all of them are better than the official app.

Make sure to try i.reddit.com in a browser, that's also a good option.

Use the Apollo app. Much better than the official Reddit app. It's more like what Alien Blue was before Reddit killed that.

Does that make the “open in app” button on the AMP pages work? Because I have the same problem and I’m basically willing to try anything.

Unfortunately no. But there's an "Open in Apollo" option from the share sheet which works for me. It's just an extra tap to open the share sheet from the AMP page.

Also an easy JB for iPhones was posted this week. With that you can make Apollo your default reddit application.

No but it looks at the clipboard when it takes focus and offers to take you to the post.

You should really try Apollo.

Boost for reddit has been working good for me some quite some time now https://play.google.com/store/apps/details?id=com.rubenmayay...

Same here, it always sends me to the App Store. I already have the app installed.

reddit already plagues me with their pop-up insistence that I use their app instead of my mobile browser. Literally stops me from using it more.

"The worst thing I've seen recently is amp URLs for reddit threads."

How can I see this very specific example ? I would like to understand exactly what this looks like ...

I am not a reddit user and I don't consume much web content on a phone, which is using Safari on an iPhone ...

Would I need to download google chrome onto my iphone, then do a google search for a reddit thread, then click on that search result ? Or would I see this result in Safari as well ?

Genuinely curious as I would like to recreate this specific result ...

It's something you will routinely see in subreddits. Someone makes a comment wanting to link this thread, and it will say "just have a read of https://google.com/amp/news.ycombinator.com/item?id=23322730....

The madenning part is you will see these links when using Firefox or Safari and you'll see them on a desktop. It is of course, not just Reddit thing. I've seen LinkedIn shares look like this.

You just search for and find any reddit thread, and it is absolutely just as shittastic in any browser (I am using Safari on iOS).

https://www.google.com/amp/s/amp.reddit.com/r/gadgets/commen...

This page is simultaneously encased by AMP, has multiple ways reddit is trying to get me to install an app that isn't going to help me right now as I am hopping between websites--I am going to glance at reddit for ten seconds and then a stackoverflow question and then a bugzilla issue and then a quora thread... the last thing I want right now is to end up in some app--but it also doesn't show me all the comments and is asking me to click through to get them... it used to be I clicked a search result and it showed me the reddit thread, with all the comments and without an app: I liked that :(.

How do you even get amp on reddit urls? I've never come across such a scenario (I use desktop browsers on linux).

I usually get them when I open a Reddit link on Google on iOS.

>getting back to classic reddit takes a lot of gymnastics

http://old.reddit.com still works, though

Hope they are sane enough to keep it forever

This isn’t going to be the site that turns up in results, sadly.

Sounds like a job for a userscript / browser extension!

Exactly. For Reddit the AMP version and the mobile site look almost exactly the same... except the AMP site performs worse due to the AMP restrictions.

So none of the "nice" Reddit mobile site features actually work, and supposed "one-time" annoyances like the "Download the App" pop-up don't get cookied under AMP and continue to annoy on every google search. Insane!

I agree that AMP is a major attack on the internet, not to mention the fact that it makes it way slower [1] and hard to understand what you're browsing. The worst part is that my friends send me AMP links all the time even though I use DDG to avoid this stuff.

[1]: https://news.ycombinator.com/item?id=18893808

For me, this is a new and helpful way of thinking about the relative value of DDG over Google.

AMP keeps people on Google owned properties longer[1], so it's a revenue driver.

[1] Via things like taking over swipe motions and the back button on carousel launched pages, for example.

It also allows for very easy tracking across the internet which is the real long term play.

They will also be able to release "unblockable" advertising to amp pages eventually.

Why would Amp allow the ads to be less blockable? Extensions still run

They can package the ads in band with the content, although DOM based blocking might still work—at some point we’re going to have to write an ad detection AI just to use the internet.

The long term solution is stigmatizing ads—you can never ad block someone in the ear of a newspaper editor.

> Google discontinues so many services, why is AMP not one of them yet?

Because Google only discontinues useful services, and AMP is actively harmful (aka of negative usefulness)?

AMP is MITM attack on the internet.

best and most succinct description that I've heard.

because it's a useful MITM attack on the internet

useful to whom?

To Google, of course :-)

After they took away peoples' ability to MITM their own stuff by forcing HTTPS everywhere under the guise of privacy.

Not everyone joined the https party. The additional overhead on sites isn't justified for sites you don't even log into.

Via http you expose the GET headers, i.e. everyone can see the urls you're browsing, even if you don't login to pornhub.

This gets trotted out a lot, but who is "everyone"? At worst it's a bunch of random people in the cafe whose WiFi you're using - but these people don't have the resources to track your activity once you leave the cafe. Otherwise it's just the same rogue's gallery of large corporations interested in adtech/surveillance money: ISPs, device makers, other online service providers. The thing is, none of them have the reach, data collection, and analytics capability of Google. And Google almost certainly gets all this information too, whether you use HTTPS or not (see reCaptcha, Google Analytics).

To me, this rationale looks an awful lot like a moat to stifle Google's competition. If collecting "the urls you're browsing" is wrong, why is it ok for Google to do it? And if it's not wrong, why is it somehow better that only Google gets to do it?

> At worst it's a bunch of random people in the cafe whose WiFi you're using - but these people don't have the resources to track your activity once you leave the cafe.

Depending on what you're doing, one-time collection may be enough.

Also, many captive portals are provided to businesses by companies whose own business interest is in tracking people, and they'll absolutely correlate the data.

Rather than having to worry about whether the service you're getting internet access from will track you, make it impossible for them to do so.

Isn't this just imparting a false sense of security? The one party who I'm most worried about getting my data, Google, will still get it.

I think you've still failed to answer my basic point - how is this not just a competitive moat that benefits Google? If we care about privacy and data collection, legislation is required because Google and Facebook have no reservations about sucking up everything they can. If it's ok for them to do it, why not $RANDOM_CANADIAN_ISP?

It's not an argument against HTTPS.

If you use HTTPS, you know you're talking to the site you think you're talking to. If that site itself is sharing data in a way you don't want, including by pulling in third-party scripts, you have a problem with the site. That's not an argument against HTTPS; communicating in cleartext doesn't solve that problem, it just means that other people the site doesn't trust can also access that data.

Let's not let the perfect be the enemy of the good here. Universal HTTPS is an improvement.

Everyone on your private network basically.

Pornhub should offer https if it doesn't already. A good example of a site where this would be a feature. Local recipe blog.. maybe

Btw.. Pornhub has it's own google version of ad tracking they sell/share espically when you login.

I disagree. There's no reason to leak things to everyone on the planet, even if what's leaked isn't the most-damaging-to -leak-thing possible. As an example, it annoys me that the Texas Instruments site isn't encrypted, leaking my interest in parts to anybody listening.

I don't understand this point of view. You are either using a vpn or tor if you don't want the planet to leak your info to the world or you are leaking already.

If you are not then sure browsing in an internet cafe or an unsafe network will allow rogue entities to see your interest in parts.

Your browser is fingerprinting you on chrome with an id. You are being fingerprinted with your unique fonts on other browsers. If you have javascript on that opens the floodgates. Logged into facebook still? Browser extension gone rogue? Andriod OS?

I dont think they meant leaking into to TI, they meant leaking more into to ISPs than necessary. Http connections are like a post card, anyone in route can read it. At least with https they have to jump thru more hoops.

Even if Texas Instruments implemented SSL the fact that you went there would not be a secret to anyone who can see your packets due to SNI[0]. HTTPS is really only useful when you want to hide the contents of a message, not the recipient.

[0]https://en.wikipedia.org/wiki/Server_Name_Indication

The "additional overhead" argument against SSL hasn't held water for well over ten years, now.

Especially when you can just sit behind cloudflare and gett for free with very little work on your part.

Granted, you then have to trust cloudflare; but it seems like they have been good actors so far considering their privileged position delivering tons of content across the web.

This is a common misconception. Https also prevents bad actors from injecting content into the page.

If you want to mitm yourself, nobody takes it away from you. Create your own CA, add it to the trusted list, setup your proxy with the keys, and mitm all you want.

You do get the benefit of https even on static sites though. Do you want every network you join to be able to inject any JS they want into pages you're viewing? Https solves that.

This is significantly harder on android which is probably what OP was referring to.

It slows down doing anything that involves it. I end up landing on some jank AMP page, and have to then navigate to the top, and pop up the original link, click it, then wait for the real site to load. Total UX fail

Wikipedia says that Amp first started appearing in search results in February of 2016. Some random websites tell me the average Google product death happens about 4 years after it launches (not counting anything that hasn't been killed at all and with some huge error bars). So we should expect AMP to be abandoned sometime between now and never.

Reply on news.ycombinator.com