Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Sunday December 15 2019, @03:53PM   Printer-friendly
from the making-it-easy-for-fake-sites dept.

Google Achieves Its Goal of Erasing the WWW Subdomain From Chrome

With the release of Chrome 79, Google completes its goal of erasing www from the browser by no longer allowing Chrome users to automatically show the www trivial subdomain in the address bar.

When Chrome 76 was released, Google decided to no longer show the www "trivial subdomain" in the address bar when visiting a web site. This means, that if you are visiting www.bleepingcomputer.com, Chrome would only show bleepingcomputer.com in the address bar...

[...] According to a Google engineer, www is considered a trivial subdomain because "this isn't information that most users need to concern themselves with in most cases".

Many users, though, felt that this was a security issue, could be confusing for users, and is technically incorrect because www.domain.com is not always the same host as domain.com.

So is this a distinction without a difference or a real issue?


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Sunday December 15 2019, @04:27PM (6 children)

    by Anonymous Coward on Sunday December 15 2019, @04:27PM (#932403)

    This seems like fixing something that wasn't broken. It's not like they've gained more space or anything by removing www. It, in fact, does absolutely nothing except remove potentially usable information. It's like seeing that 99.999% of your users never created a custom audio equalizer using the built-in tools in Windows (probably an accurate statement), so then deciding to remove that functionality or make it even harder to access. I mean who is gaining from that? It's idiotic.

    I've already found it somewhat annoying having to fidget around with the address bar when going to Reddit (the SpaceX sub there is decent.. what I can say?) which is only made usable by changing 'www.reddit....' to 'old.reddit....'

  • (Score: 3, Funny) by FatPhil on Sunday December 15 2019, @04:41PM (4 children)

    by FatPhil (863) <reversethis-{if.fdsa} {ta} {tnelyos-cp}> on Sunday December 15 2019, @04:41PM (#932409) Homepage
    Didn't they remove the "secure site" padlock a year or so ago, because they realised that "the site owner gave money to Honest Akhmed" was not a actually an indicator of trustworthiness, after all, in complete contradiction of what they were saying 5 years prior?
    --
    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
    • (Score: 2) by AndyTheAbsurd on Sunday December 15 2019, @08:58PM (3 children)

      by AndyTheAbsurd (3958) on Sunday December 15 2019, @08:58PM (#932466) Journal

      They removed the "secure site" closed padlock, but kept the "Not secure" marker (although I just tried in in Chrome and apparently it's not a padlock anymore, just text; Firefox uses a closed padlock for https and a padlock with a strikeout line through it for insecure).

      Apparently, giving $5 to Honest Akhmed (or $0 to Let's Encrypt) suddenly makes you trustworthy in Google's eyes.

      --
      Please note my username before responding. You may have been trolled.
      • (Score: 2) by driverless on Monday December 16 2019, @12:33AM (2 children)

        by driverless (4770) on Monday December 16 2019, @12:33AM (#932563)

        Just a minor nitpick here, its actually Honest Achmed, not Honest Akhmed. Achmed is, as the name implies, a completely honest CA who will sell you only the best-quality certificates at very reasonable prices. Akhmed is an imposter in Indonesia who defrauds his customers with marked-up certificates resold from GoDaddy.

        • (Score: 1, Informative) by Anonymous Coward on Monday December 16 2019, @04:56AM (1 child)

          by Anonymous Coward on Monday December 16 2019, @04:56AM (#932696)

          For those out of the loop: https://bugzilla.mozilla.org/show_bug.cgi?id=647959 [mozilla.org]

          It has such ringing endorsements. Two of the best being, "Honest Achmed is at least more honest than Comodo." and "Considering the problems at DigiNotar I vote for giving Honest Achmed a second chance!"

          • (Score: 2) by driverless on Monday December 16 2019, @06:07AM

            by driverless (4770) on Monday December 16 2019, @06:07AM (#932707)

            I particularly liked the Pratchett-inspired CA policy "nil certificati sine lucre". That, in a nutshell, is the policy of every commercial CA on the planet, only they hide it behind a mountain of legalese.

  • (Score: 0) by Anonymous Coward on Sunday December 15 2019, @05:28PM

    by Anonymous Coward on Sunday December 15 2019, @05:28PM (#932420)

    Observed behavior just now--I'm not normally a Chrome user, but have a copy for occasional use.

    1. Copied a full url of one of the pages of my company website from Firefox. This page is very simple read-only, HTML-only:
        http://www.mycompany.com/book.html [mycompany.com]

    Pasted into Chrome and it displays:
        mycompany.com/book.html

    I selected that URL (mycompany.com/book.html) and then hit the left arrow, thinking that I would try to add back in the "www." in front to see what happened. Surprise, the "www." is already there, just hiding to the left of the "left margin" of the address bar. However, the original http:// is nowhere to be found.

    2. This time I copied the URL from a different page, from Firefox, not copying this part "http://www."
        mycompany.com/program.html

    Pasted into Chrome and it goes to the correct page. Then selected the full address bar, hit left arrow and it added the "www." back on.

    3. A big company we work with sometimes distributes data files to a group of their customers by emailing out a URL that looks like this:
    ftp://ftp.bigcorp.com/dropfile/Identfier_random-text.zip [bigcorp.com]
    The data isn't super secret and they only leave the file up for a day or two (have to be quick to get it). Opening this in Firefox in a new tab starts the download automagically.

    4. Pasted that same URL ftp://ftp.bigcorp.com/dropfile/Identfier_random-text.zip [bigcorp.com] into Chrome and now the whole thing displays, starting correctly with "ftp://", nothing removed or hidden. I couldn't actually test for file download (there aren't any files posted at this time), but it looks like it should work.

    5. ???

    6. Profit!!