News for hackers. Stuff that matters.
Re:Google no longer providing original URL in AMP for image ... by tyingq on Wednesday May 27, 2020 @03:43PM (#23328876)
>>what kind of nefarious thing do you fear Google will do

Well, the headline is one good example. That google controlled JS is EXACTLY how they removed access to the original URL...on somebody else's page that isn't theirs. "Signed exchanges" doesn't fix that either. It's also how they hijack the back button and swipe events for carousel navigated pages.

Re:Google no longer providing original URL in AMP for image ... by joshuamorton on Wednesday May 27, 2020 @03:52PM (#23329016)
> That google controlled JS is EXACTLY how they removed access to the original URL...on somebody else's page that isn't theirs.

No, the Google AMP cache adds the header bar. That isn't added by the Google controlled AMP js. Let me repeat this: The AMP js didn't change. Google's AMP cache implementation changed. (if you disagree with this, please post the diff of the AMP js that removed the url bar, the js is opensource at [0])

> "Signed exchanges" doesn't fix that either.

Yes it does, in two ways:

1. It would prevent Google from mucking with the embedded page at all, like they do now.

2. It would remove the need for me to have the url redirect, since the url bar would point to the original site.

[0]: https://github.com/ampproject/amphtml/commits/master

Re:Google no longer providing original URL in AMP for image ... by tyingq on Wednesday May 27, 2020 @04:35PM (#23329604)
Apologies, you're right in that they aren't using it that way. They could, and the examples of the top bar, swipes, and back button hijacking seem to indicate they aren't averse to it. Those things caused me to lose trust in AMP. That they chose to do it via a "proxy" instead of their hosted javascript doesn't make me trust them more.