That's a valid point, but as an internet user the domain is the only attribute visible to me that can determine a site's identity. So, I am pretty happy that the W3C insisted on setting the privacy rule based on plainly visible attributes, not on hidden predetermined or site informed data.

You call the current policy ambiguous, but the proposal wouldn't even ensure that all browsers block or allow the same sets of domains.

Anyway, I am aware that people use multiple domains on the most diverse ways. But it's important to have the technical behavior simple and predictable, and if Google doesn't like the consequences of the way they decided to organize their domains, well, it's their problem for them to fix, not a reason to push complicated unreliable standards on everybody.

>in a way that we shouldn't assume any ownership only based on the domain itself.

I probably have a naive understanding of this, but why not? In your Shopify example, users should certainly be taught that Shopify does have ownership of mystore.shopify.com (in at least the 'security' and 'privacy' areas of concern from the write-up). Likewise, entities proxying resources controlled by others through their own domains (e.g. CNAME cloaking) should take responsibility for what they are serving and how they are exposing their clients.

mystore.shopify.com is definitely hosted by Shopify but it's content is a totally isolated entity. You can trust laptops.shopify.com but this trust should not automatically transfer to fakestore.shopify.com. In the same way if you have a valid account on laptops.shopify.com, the browser shouldn't allow fakestore.shopify.com to emit a request and buy something on laptops.shopify.com with your valid session on your behalf, even though they're on the base domain.

You have also the parallel problem of how do you transfer the trust you have on google.co.uk to youtube.co.jp only based on the domain info you have.

This all to say that using only domain names to resolve ownership is a hard problem, since ages browsers use a crowdsourced list [1] to get around this issue but recently it proved not to scale very well, specially after Apple's move to use this list as part of their "Limit Ad Tracking" solution.

[1] https://publicsuffix.org/

If the proposal was limited to opting into strict origin scope (instead of eTLD+1/registerable domain scope) for cookies and other privacy-related things, it would be an improvement.

But it also allows things like specifying that laptops.shopify.com, laptops.com, laptops.social.com, desktops.com and calculators.com are the same party and therefore tracking may happen across them. There's no obvious good way to put the user on notice of this, and the Explainer totally punts on addressing this problem, instead leaving it to each browser to figure out.

>Sometimes I wonder how the web got here with the amount of kludge that we have to carry.

Really? Um, MS led the way with IE6 and all of the baggage they brought. Google took the mantle with Chrome. Ultimately, it is the browser vendors and their "interpretations" on how to handle things. Rather than working with the governing bodies (yes, they are slow), they forged ahead with their own implementations and forced everyone to follow. No browser is perfect, but the travesty that IE left us with should have been the glaring example of what not to do, but yet Google went and did it again.

The internet is nothing without the browsers. If the browsers didn't do bad things, we'd be in a lot better situation.

IE6 also brought us AJAX, so there is something to be said for browser vendors implementing experimental features on their own.

The difference between nice and awful, of course, is when developers and vendors treat such features as a given without providing graceful degradation (or progressive enhancement, if you prefer) for users of other browsers.

Sure, AJAX is cool. However, devs would not be allowed to release into the wild if the experimental features were not availalable in released browsers. That whole -strict, -transitional type stuff is just another example. Extreme specific personal reco would be to only allow experimental features available to devs that must compile their own browser from source. this would prevent the vast majority of users from ever seeing those experimental features in the wild. Devs could still dev against and find the bugs, but they would also be less willing to make the experimental features requirements on their product.

That isn't remotely the case. Plenty of experimental / one-vendor features have been released and later received wider adoption without fundamentally breaking the user's experience.

I.e. before we had indexeddb, there was websql. The whole PWA slew of features (I.e. service workers) can and are used without breaking user experience.

There can be bad implementations too- youtube's awful performance due to their early version of the web component spec comes to mind- but these features arent really akin to the olden days of ActivX / IE dominance, since they are single purpose and not opening up an entire foreign interface.

The standard and governing bodies has no right to demand anything. The internet is not a democracy. If they want something put the money where their mouth is. Until W3C ships their own browser engine and gets it into the hands of customers, relevance is nothing more than a nice-to-have.

There are no members of the W3C other than browser (and web-server) manufacturers. When the members of the W3C decide on something, that’s the browser manufacturers deciding on that thing.

The real question, I suppose, is whether the people who interact with the W3C/WHATWG/etc. have decision-making power within the organizations they nominally represent. If not, then these bodies are kind of like the UN: nominally a place for treaties to be made, but in practice a place for ambassadors to glad-hand one-another while their leaders ignore the decisions they make.

You seriously want google to be defining what the internet is given their current and past activities and abuses? There is no way that could ever be a good thing. If they ever do expect a 50% carve out for targeted ad technologies.

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

That's an infrastructure problem. Sure you can solve it with domains, but you can also easily use other current technologies for it with no issues as well and never change the domain name at all.

NCSA was using regional DNS for load balancing in '95. I don't know who invented it but it's at least 25 years old.

How is this faster?

More DNS requests, more TCP connections. At first this is purely slower.

Browsers used to/still do max number of connections per domain. Adding more domains allows you to do more concurrent requests.

With HTTPS you have to handshake for the first connection on each domain.

Yes and it still outweighed that especially if you were loading a lot of images or a stupid amount of different JS/CSS files

Upstreams were very limited, and HTTP requests send cookie data in each GET.

For instance, if you had a 128kbps DSL upstream and each request was 2KB (loaded up with cookies), you're already limited to 8 requests/second. A cookie-less domain for small resources helped this a lot.

Pretty sure in HTTP 1.1, there was a max amount of concurrent requests per server/proxy. So using different domains allowed more rq/s.

A separate domain name for static assets would not receive any cookies of the actual site. This means less data transferred and in theory a proxy closer to the user could more easily cache these requests, even for multiple clients.

More connections = better parallelism = faster downloads

The DNS is cached.

Before HTTP2 this was common

It spreads out the load on disks and outbound bandwidth.

You are making the assumption that the domain pointed to different physical servers. To get the benefits of what everyone else is describing it does not matter what the domains actually are pointing to.

>you can have a number of sites that use separate domains but are owned by the same entity

Why is this even a thing? There's nothing wrong with storeA.shopify.com, storeB.shopify.com... The only valid use case is if you're somehow trying to hide the shared ownership/platform, in which case it's up to you to deal with the downsides.

AFAIK there are big security risks on hosting user generated content on the same domain of your parent website. That was the main reason github.com migrated individual repo pages to github.io [1]. Also shopify doesn't serve their shops on the domain of their main website, they use *.myshopify.com, I suppose for the same reason.

[1] https://github.blog/2013-04-05-new-github-pages-domain-githu...

Even when multiple domains are controlled by the same party, there is often no good way for users to be aware that seemingly unrelated sites with unrelated-looking brands are the same, and therefore (under this proposal) you can be tracked across them.

In my opinion that's something the website owner should handle and it's a tractable problem. It shouldn't be pushed to the browser other than as you mentioned through capabilities like SOP and cookies. The way it is is fine.

Nothing's stopping you from using the one domain as it was initially intended.

That's a good point, the domain should have to match exactly.