News for hackers. Stuff that matters.
Re:Announcing AMP Real URL by dfabulich on Tuesday April 16, 2019 @10:01PM (#19679045)
> okaying a replay attack

When you permit a proxy to replay your content, it's just caching. It's not an "attack." (If the proxy can replay your content without your permission, that would be an attack.)

Re:Announcing AMP Real URL by tyingq on Tuesday April 16, 2019 @10:16PM (#19679135)
I believe AMP required inserting a piece of Google controlled and hosted JavaScript in your content from the very beginning. So the cat was pretty much out of the bag on this already.
Re:Announcing AMP Real URL by paavoova on Tuesday April 16, 2019 @11:32PM (#19679535)
So if you block this Google JS, you cannot access said AMP page? Does AMP implicitly mandate users subscribe not only to said content provider but the third-party AMP host?
Re:Announcing AMP Real URL by tyingq on Tuesday April 16, 2019 @11:45PM (#19679600)
Yes, you have to include it.

"AMP pages must...Contain a <script async src="https://cdn.ampproject.org/v0.js "></script> tag inside their <head> tag."

https://amp.dev/documentation/guides-and-tutorials/start/cre...

Their special tags[1] won't render without it, and I suspect Google won't include it in their SERPS if it's not valid AMP.

[1] https://amp.dev/documentation/guides-and-tutorials/learn/spe...

Re:Announcing AMP Real URL by themacguffinman on Tuesday April 16, 2019 @11:00PM (#19679393)
They're certainly not doing it without the website owner's permission. It's disingenuous to call it an attack.
Re:Announcing AMP Real URL by tyingq on Tuesday April 16, 2019 @11:15PM (#19679455)
Yes, that's fair. I meant more in terms of ceding control...that's a prerequisite for AMP, and always has been.