TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Google proposed Web Bundles could threaten the Web as we know it

147 点作者 maproot超过 4 年前

17 条评论

jasode超过 4 年前
Fyi... Web Bundles and Signed HTTP Exchanges are confusing topics so I think it&#x27;s worth reading 2 previous threads with comments from 2 Google employees (spankalee, jefftk) [1].<p>One may still choose to discount their explanations because they may be biased sources but I still think everyone should try to <i>understand</i> what they&#x27;re saying. Hopefully, being familiar with the technical details will <i>elevate the discussion</i> so people who disagree can point out <i>specific and concrete technical flaws</i> of those explanations rather than just restating a generalized version of <i>&quot;Google is trying to take over the whole web.&quot;</i><p>[1] previous threads:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24275752" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24275752</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24278068" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24278068</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24324120" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24324120</a>
评论 #24391909 未加载
评论 #24394632 未加载
TekMol超过 4 年前
I think their idea is to combine that with signing the bundles, so a page from www.someserver.com can be served by anyone, aka Google. I guess this would mean Google can serve all content on the web.<p>There seems to be a strong urge in Google to cut the connection between then endpoints of the web and become the central authority. Make all traffic flow through their machines. Let no information arrive at the endpoints.<p>Right now, requests on the web are kind of p2p. A user requests a website, the publisher serves it any way they see fit. Directly via their servers or via a CDN of their choice.<p>Google seems to have a strong focus on ending this. Turning the web into Googlebook &#x2F; AOLoogle.<p>I wonder why. Do they see their business model threatened on the open web? Or do they see a chance to increase their profit with a closed web?
评论 #24391061 未加载
评论 #24391374 未加载
评论 #24395385 未加载
评论 #24399061 未加载
cflat超过 4 年前
Let’s call a spade a spade. The only real world problem that WebBundles (and Signed Exchanges) really solve is to allow AMP to impersonate your website.<p>Google wants all the click data and the click through navigation data about users (by way of passive logs) so they can sell more ads.<p>There are no other real world problems that web bundles solve.
评论 #24391884 未加载
评论 #24391786 未加载
tmd83超过 4 年前
I am really curious what&#x27;s the general opinion on Googler&#x27;s as a web developer. I have seen a long while ago some nice articles from Google about site optimization.<p>Do they even follow any of their original advice or Google basically keep doing over engineered stuff fixed by adding another set of over engineered staff?<p>Let&#x27;s talk gmail. I just refreshed the window and it did close to 400 request, ~8MB download which translates to nearly 40MB resource. And it keeps making more requests even when I&#x27;m not doing anything.<p>And a refresh of Google.com the search page did 33 request and nearly a MB download.<p>And they are preaching the world about optimizing the web?
评论 #24391367 未加载
评论 #24391800 未加载
评论 #24391781 未加载
评论 #24391028 未加载
评论 #24391335 未加载
ffpip超过 4 年前
Yet another thing Google wants to fix by serving everything through their servers instead of asking devs to fix their owns sites.<p>Same problem with AMP. Instead of asking news sites to fix their slow pages, it forced them through AMP by promising better result ranking.<p>Ask them to make their sites faster within a month or say they&#x27;ll get booted off search. You&#x27;ll be surprised at how fast they comply
评论 #24392066 未加载
jmull超过 4 年前
I think this line of criticism of web bundles misses the mark. It looks to me like the issues raised are perfectly possible and just as easy without web bundles -- that is, these may be legitimate issues, but are independent of web bundles.<p>My issue with web bundles is that it&#x27;s yet another pile of complexity with very little incremental value over things that already exist. A poor tradeoff.<p>There&#x27;s a substantial on-going cost to each web standard added so each one needs to &quot;pay&quot; for itself with broad or deep usefulness. Web bundles are just another way to skin a cat.
maple3142超过 4 年前
I don&#x27;t understand why can&#x27;t this be blocked by content blockers. I tried open a .wbn in the original article, and tried to inspect the resources using devtool, it still have files listed there. So content blockers can still block something like xxx.wbn:&#x2F;js&#x2F;ads.js if browser have such api.<p>Also, I think web bundle can be a Electron replacement too for some use cases, so that some totally offline JavaScript webapp don&#x27;t have to use Electron.
jakelazaroff超过 4 年前
I was hoping this would be more than a rehash of the article on the Brave blog about the same topic, but alas. Link to that discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24274968" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24274968</a>
jeroenhd超过 4 年前
Is there anything in the web bundle standard that forces outdated pages to be refreshed? The spec seems to say little more than &quot;detecting stolen keys is not our problem&quot;.<p>I can imagine this being a problem when news stories turn out to be false alarm and Google happily keeps serving the original content instead of the corrected content.<p>There&#x27;s also a risk of vulnerability here, as getting a signed package might very well be used to host phishing pages on web caches.
bogwog超过 4 年前
Google should just fork the web already. Let them create their own private platform and do whatever they want.<p>The massive control Chrome and Android gives them means they can do whatever they want already, but at least with a private platform they won’t have to fight people and deal with the negative PR of doing evil stuff. And then the rest of us who like privacy and competition and ad blockers can use the “legacy” web.
评论 #24392884 未加载
dimitrios1超过 4 年前
Interestingly the main quotation in the article is from a Brave team member -- what does Brave do when this is rolled out? Fork Chromium?
jimbobimbo超过 4 年前
Web bundles look like a great thing for Electron and PWA like scenarios, specifically due to signature support. We had to drop service workers and reinvent the wheel with APPX (basically a signed ZIP file) in one of our apps, to ensure code integrity.
tormeh超过 4 年前
So it&#x27;s a signed executable, running in a sandbox, served from a federated app store... Isn&#x27;t the whole JS&#x2F;CSS&#x2F;HTML web crap a bit overcomplicated for this purpose?
azangru超过 4 年前
The missing hyphen in the title is really confusing.
rektide超过 4 年前
I for one believe in the specified use cases of Web Bundles, &amp; believe they are worthy.<p><a href="https:&#x2F;&#x2F;wicg.github.io&#x2F;webpackage&#x2F;draft-yasskin-wpack-use-cases.html" rel="nofollow">https:&#x2F;&#x2F;wicg.github.io&#x2F;webpackage&#x2F;draft-yasskin-wpack-use-ca...</a><p>What we have here is a budding conspiracy theory, not even a theory, just gesticulation. Consensual Delusion, a belief that we are persecuted by secret forces that must be held off, held at bay.<p>This started months ago with an incoherent rambling ticket by the Brave author that is being cited. He spent months going back &amp; forth with wild accusations &amp; unspecified concerns. After dozens and dozens of exchanges, he finally named one single scenario, that people might &quot;hide&quot; their tracking malware by renaming files as they put them into the bundle.<p>Color me extremely unimpressed &amp; unscared. Enormous sound &amp; fury, for a capability that is in no way different from the web we already have today. It&#x27;s not hard to setup a.webserver to randomize asset names. Nothing about webbundles is new or changes that.<p>Consensual Delusions like this hacked up hoax of a story threaten reality as we know it. As the old civic videos say: DONT BE A SUCKER. Anyone selling fear, uncertainty, &amp; doubt is to be met with skepticism. Increasingly, FUD is how Apple&#x2F;Mozilla&#x2F;Brave are selling their anti-feature policy. &quot;Trust us, we won&#x27;t let the web work with midi&quot; doesn&#x27;t sound that great, but is much more honest than what we get, which is &quot;these engineers &amp; standards groups working on these specs are secretly trying to undermine this treasured web which we must protect &amp; keep as is at all costs&quot;. the involved engineer&#x27;s histories indicates they obviously care enormously about bettering the web, &amp; in this case are combatting sizable transpiling tool bloat for devs, &amp; enabling offline sharing &amp; offline capable web, and literally fighting censorship, which are truly worthy goals all that will vastly help the web.<p>This is all super hard to work through. Yes, google used the web to reap enormous profit by means of enormous information control &amp; inventory systems for ads &amp; eyeballs. But Google also would not exist without the web, &amp; historically the web was a small toy that couldn&#x27;t do much compared to apps. The tables have turned, &amp; the web is clearly ascendant, much safer, &amp; increasingly we understand that the limitations of ux were largely from lack of will to explore &amp; test what limits there really were, so the situation is no longer so obviously tense. But Google Chrome &amp; Chromium &amp; the spec work Google does are, imo, designed to improve a communal shared resource for all humanity, designed to greaten the web, not subvert it. We can see that here, as the engineers working on webbundle have shown a thousand times over their commitment to honest above board clear integrity as they have tried &amp; tried &amp; tried to work with Peter Snyder as he fumbled &amp; plodded his way to a scenario where WebBundles pose any real danger, &amp; Peter has imo failed at presenting anything. We can see the engineers take Peter seriously, try to work with him. And so I feel it is in general. It is intimating as hell that the web is so big, has so many capabilities, that so much keeps getting added, and so much of that comes from gigantic unimaginably huge pools of capital derived from eyeballs-on-screen. But somehow it has been working out, the engineers have genuinely cared about doing the right thing, &amp; usually the standards bodies &amp; TAG can eventually come to harmony &amp; agree, &amp; the web improves.<p>Peters dissent thread:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;WICG&#x2F;webpackage&#x2F;issues&#x2F;551" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WICG&#x2F;webpackage&#x2F;issues&#x2F;551</a><p>Personally I greatly look forward to WebBundles. It will radically improve the JS module situation, yay, a thousand times yay, &amp; giving people the ability to share content directly with one another, without relying on centralized infrastructure, is one of the most genuine pure &amp; true new expanses for the web &amp; one I am greatly looking forward to.
评论 #24398607 未加载
评论 #24391455 未加载
noisy_boy超过 4 年前
The only answer is to not click on ads. Do your research via review videos&#x2F;amazon etc (I know that they are&#x2F;could be indirect advertisements but atleast the creators get some sponsorship money). Then go to the brick and mortar shop, check it out and then, here is the kicker, pay the extra $5 bucks to buy from them.
samsquire超过 4 年前
This is an idea I had, an alternative to web bundles and solves the same issues.<p>Inside a HTML file, we introduce an attribute for embedded resources called cache=”identifier”. Script tags, style tags will have this attribute defined. There would also need to be an embedded image introduced. Inline all your resources. The browser will fetch the HTML and add whatever has the cache=”identifier” to its cache.<p>Then when the browser fetches a page, it will send a Cache-Got header, this is a bloom filter serialized of identifiers cached.<p>The server will check the bloomfilter to see if an item needs to be sent to the client and exclude the contents of those embedded resources with an empty script tag or empty style tag.<p>EDIT: Why is this being downvoted?