Design Review 2019-12-18 16:30 UTC (remove amphtml ad signing, amp-next-page, amp-script mutation)

[mrjoro]

Time: 2019-12-18 16:30 UTC (add to Google Calendar)
Location: Video conference via Google Meet

The AMP community holds weekly engineering design reviews. We encourage everyone in the community to participate in these design reviews.

If you are interested in bringing your design to design review, read the design review documentation and add a link to your design doc or issue by the Monday before your design review.

When attending a design review please read through the designs before the design review starts. This allows us to spend more time on discussion of the design.

We rotate our design review between times that work better for different parts of the world as described in our design review documentation, but you are welcome to attend any design review. If you cannot make any of the design reviews but have a design to discuss please let mrjoro@ know on Slack and we will find a time that works for you.

[mrjoro]

The Outreach Working Group will be presenting their periodic updates at this Design Review (10-15 minutes).

/cc @ampproject/wg-outreach @sebastianbenz

[mrjoro]

@wassgha will present amp-next-page v2 #25826 , design doc available here.

[lannka]

@calebcordry will present "removing signing requirements for AMPHTML ads". design doc coming soon.

[lannka]

@wassgha do you mind we go first? Some of the attendees can only join for the first 30min.

[wassgha]

No worries

On Mon, Dec 16, 2019 at 1:26 PM Hongfei Ding ***@***.***> wrote: @wassgha <https://github.com/wassgha> do you mind we go first? Some of the attendees can only join for the first 30min. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#25449?email_source=notifications&email_token=AAEQOJ3RU5S5BWH74FV6WBTQY7W7ZA5CNFSM4JJKDCVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEHAE2PQ#issuecomment-566250814>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEQOJYD5AL52PMVSSXSZ4TQY7W7ZANCNFSM4JJKDCVA> .

-- -- Wassim Gharbi, Portfolio <http://gharbi.me/> - LinkedIn <https://linkedin.com/in/wassimgharbi/> - Youtube <https://www.youtube.com/user/wassgha/videos> Software Engineer @ Google, Inc.

[dreamofabear]

I'd like to discuss #26047 if time permits.

[calebcordry]

Design doc for Removing AMPHTML Ads Signing

[dreamofabear]

Notes

Remove amphtml ad signing

• There's a lot of work for ad networks to serve amphtml ads e.g. transformation, metadata creative, crypto signing. Goal is to make the process easier by removing these requirements.

• Operating premise: security concerns can be solved client-side with CSP and iframe APIs etc, - needs to go through security review.

• Q: Can we trim down the AMP4ADS spec to avoid scenario where invalid ads are faster than valid ads?

  • A: We can probably do this over time.

• Q: Are there problematic native HTML elements? e.g. autoplaying video. No whitelist means we have no control over new capabilities added to HTML spec.

  • May be mostly solved by disallowing default CSP directives e.g. default-src. AMP considered this originally.

• Q: Should we have a less restrictive style-src whitelist? Why only allow a handful of font CDNs?

  • In practice, styles should be inlined in ads so this is useful as an encoded best practice.

amp-next-page

• Problem 1: Not actually infinite scrolling list. Current API uses a static page array with max length of 3, with recommendation list after the third article.

• Problem 2: Bundling bug causing very large binary size, but was fixed recently.

• First decision: what API? e.g. add a "next article" URL pointer.

• Second decision: "next page" suggestion loading. e.g. one doc provides suggestions for the next, plus a buffer. loading order for suggestions (append or insert).

  • "Pointer" approach where each page suggests another page is ergonomic to current partners.

• Third decision: versioning? 0.2 or 1.0.

  • The latter.

amp-script mutation

• We should solicit opinions from partner devrel on potential for abuse.

[mrjoro]

@sebastianbenz did y'all put together the Outreach WG update for this design review? Can you add a link to it here?