Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Not Reciprocating On IFrame Usage?

Posted by timothy on from the embedded-wars dept.

theodp writes "Over at the Google Web Search Community, posters are questioning why Google feels free to IFrame others' web pages, yet blocks attempts to IFrame pages on its own sites. 'Google has so much contradiction in what it wants for itself and what it does with other websites [e.g., Google frames Slashdot],' quipped one poster. 'Do no evil, right?' And over at the Google Maps Help Forum, developers are also begging for Google to allow them to IFrame entire pages again. 'I know there are other options (&embed etc.),' explains a poster, 'but then there is no sidebar which is useless. I really need the functionality like it was before.' Can any Googlers out there explain The Mystery of 'This content cannot be displayed in a frame'?"

115 comments

  1. XSRF by Anonymous Coward · · Score: 5, Informative

    It's to prevent XF clickjacking, XSS and XSRF attacks. Please see recent web security papers. Many other major sites with valuable login credentials do the same thing.

    1. Re:XSRF by Anonymous Coward · · Score: 0

      This. Allowing other pages to embed your full page in an iframe is borderline negligent. It sucks Google has to make things harder for third party developers, but the Internet isn't exactly Hello Kitty Island.

    2. Re:XSRF by moderatorrater · · Score: 1

      Exactly. I'm over security for part of a fairly major website and our customers are starting to get after us for not disallowing iframes of our site.

    3. Re:XSRF by Samantha+Wright · · Score: 0

      No. The real reason Oracle is doing all the Evil in the world now because Bill Dead Gates said so. This is just another shill post on Oracle here, one of many I have seen in last few days.

      --
      Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
    4. Re:XSRF by hairyfeet · · Score: 1

      Bets on how long until they are busted for antitrust? although frankly after Intel got away with bribery AND compiler rigging (which they are still doing BTW) frankly I think our DoJ is as worthless as tits on a boar hog.

      But between double standards for themselves and the rumor they are looking at buying Yahoo which would give them pretty much the entire webmail market (FYI Yahoo email has over 300 million unique users, about double what Gmail has in the US as well, its the one thing Yahoo is #1 on) frankly Google is starting to scare me. they have more info on everyone than most spook factories could ever dream of, thanks to their tax dodging they have huge amounts of capital they can wave around, and frankly their RDF makes the one the late Jobs had look like a tinker toy.

      Frankly apple? Really doesn't scare me. Their desire for crazy high margins makes sure they stay at the top end and never really venture below the mid to high price range but Google? Android is showing up on everything from low rent tablets and TVs to the latest high end stuff, all that data...yeah MSFT will end up IBM, big in business but not really going much past their core markets, Apple will continue to be the boutique high end brand, but Google could easily become another "ultrasupermegacorp' like MSFT was in the 90s and we all know how nice they turned out to be for competition. Ballmer can throw chairs and want to fucking kill Google but Google is the 8000 pound gorilla and can fucking kill anybody it wants now. that much power in ANY hands i find a little scary.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    5. Re:XSRF by PopeRatzo · · Score: 2

      The real reason Google is doing all the Evil in the world now because Steve Dead Jobs said so.

      Just so everyone knows, I've got a copyright AND patent on the Zombie Steve Jobs halloween costume.

      I tried to trademark Zombie Steve Jobs, but Apple already did that sometime in 2007. Being a step ahead of everyone else is part of their corporate culture.

      --
      You are welcome on my lawn.
    6. Re:XSRF by msobkow · · Score: 2

      People have been demanding that security holes be plugged, including these web attacks.

      Now they're complaining that Google fixed the problem.

      Hopefully they'll stop screaming about Google taking over the world long enough to hear that it's a security fix. Sometimes fixes break existing code.

      --
      I do not fail; I succeed at finding out what does not work.
    7. Re:XSRF by dankney · · Score: 1

      Exactly. I'm over security for part of a fairly major website and our customers are starting to get after us for not disallowing iframes of our site.

      Any authenticated site should be doing this -- it's only a couple of lines of Javascript to reasonably cover your bases.

      Why aren't you? Is there some sort of crazy business blocker?

    8. Re:XSRF by mldi · · Score: 1

      Antitrust, at least in the U.S., means you're using your market position to influence the market unfairly.

      Antitrust != monopoly.

      --
      If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
  2. Clickjacking by Anonymous Coward · · Score: 4, Informative

    http://en.wikipedia.org/wiki/Clickjacking may be related.

  3. Security by Anonymous Coward · · Score: 1

    'Clickjacking' UI-Redressing and assorted other attacks rely on framing the target page.

  4. It's a business by ex-googler · · Score: 1, Troll

    Get over it, it's a multi billion dollar multi national business. Not your local charity, nor grandma's coffee shop.

    Those who cling to the "don't be evil" meme say more about themselves and their naiveté, than it does about Google.

    1. Re:It's a business by luke923 · · Score: 2

      I think the reason people are upset that Google isn't living up to their own mantra of "Don't be evil" is the fact that they fail to meet the standard they set for themselves. On the other hand, if Google had the phrase, "Let's make lots of money off of others' content and technology," then no one would be upset with some of Google's questionable tactics. It goes back to basic symbolic logic p=>q. If p is false, no matter what q is, the statement is true; however, if p is true and q is false, the whole statement is false. In other words, if Google never implied that they were never gonna be evil, they would be logically consistent, but since they tried to make that implication and failed, people that care about such things are thusly upset.

      --
      "Good, Fast, Cheap: Pick any two" -- RFC 1925
    2. Re:It's a business by hedwards · · Score: 1

      That's only true if q and only q follows from p. If there is any time when q doesn't logically follow from p then the whole thing breaks down immediately.

      In this case there is the alternate explanation that Google is now defaulting to SSL for it's searches and perhaps they don't want to be a party to clickjacking and various other hijinks that could result.

    3. Re:It's a business by dave420 · · Score: 1, Insightful

      Hint: There is a perfectly reasonable technical explanation for Google not allowing other sites to host their sites in iframes. Think about it for a minute. Seriously. It's rather easy to figure out. "Good" and "Evil" don't even feature in their reasoning.

    4. Re:It's a business by epine · · Score: 2

      Google's motto is "Let's make lots of money off of others' content and technology". Did anyone ever doubt that? It goes without saying.

      Where Google comes close to evil is booting people off the Google services without making it possible for the booted user to collect his or her belongings before the door slams their ass. There's effectively no recourse if Google makes an error in their determination. I think this pushes fairly deep into caprice, and with no real upside that I can see. At least your jilted GF has the decency to pitch your possessions out the window. It can't be that hard for Google to implement a "data export only" authentication level.

      The problem with inference from evil is that first you need to define evil, and if you elect to paint evil as "everything you don't approve of" you're left pretty much speechless by some of the things other companies do, if you're paying attention.

    5. Re:It's a business by crutchy · · Score: 1

      On SEO pages there shouldn't be any reason to bitch as Google is doing you a service (exposing your site to potential customers). On intranet pages or pages requiring credentials to access, just ban any user agent with "google", "facebook", "bot", etc. That's what I do and I think it would be prudent for any other corporate website management.

    6. Re:It's a business by Anonymous Coward · · Score: 0

      At this point, Google and Facebook are effectively in the race for who can become the digital rebirth of the former Soviet Union. They want everyone's information, to arrange as they see fit and make money off of it. They also want to mess around with people's privacy until the end result is everything is fully open to the public.

      The funny thing is, the quickest way to shut them both down is simply not to use them. If they can't make money off the content they try to archive or scrape from the web, inevitably, they'll shut down and go away.

      I block Google anything (*.google.com, *.google-syndication.com, *.googlesyndication.com, *.googleadsyndication.com, *.gstatic.com, *.googleusercontent.com, *.doubleclick.com, *.blogger.com, *.blogspot.com, *.picasa.com, *.youtube.com... and the same domains for .net and .org just in case they use a secondary domain) and I don't ever search Google until after I've tried Bing, Blekko, DuckDuckGo, and Gigablast.

      (I also block *.facebook.com, *.fbcdn.com, *.fbkcdn.com, *.opengraphprotocal.com, *.opengraph.com... and the associated .net and .org extensions as well.)

      Google alienated me once already, and those information hungry vultures who are all too willing to open up information to ruin people's lives whenever possible won't ever get a second chance from me ever again.

    7. Re:It's a business by shentino · · Score: 1

      I trust facebook less than I trust google, because facebook consistently tries to update its TOS behind people's backs to allow them to whore you out to advertisers.

      Whereas google goes out of its way to make your privacy settings easy to manage.

    8. Re:It's a business by mldi · · Score: 1

      OK, trying to apply the "don't be evil" mantra to this situation is really reaching. The issue of blocking iframes is security-related, end of story. Second, if a website doesn't like people iframing their shit, they can block it too. It's only a double-standard if Google complains.

      --
      If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
    9. Re:It's a business by mldi · · Score: 1

      Not to mention they make it easy to re-claim/export your data.

      --
      If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
  5. Clickjacking by Anonymous Coward · · Score: 1

    Preventing other sites from displaying a page from within a frame is a common defense against a web application vulnerability known as Clickjacking.

  6. iframes are evil. by Anonymous Coward · · Score: 0

    google is evil.

    1. Re:iframes are evil. by Anonymous Coward · · Score: 0

      iframes are awesome and you're a retard

  7. There is no contradiction by houghi · · Score: 3, Insightful

    Google has so much contradiction in what it wants for itself and what it does with other websites

    For them it already is theirs.
    As long as nobody clearly states that it isn't their data, they will treat it as theirs. And nobody is saying that the personal data belongs to the person, so companies can keep confusing you and telling that as soon as it is somehow online, it is not yours anymore.

    --
    Don't fight for your country, if your country does not fight for you.
    1. Re:There is no contradiction by dave420 · · Score: 1, Insightful

      Christ. There is no contradiction as they don't penalise other sites for not allowing themselves to be rendered in an iframe. If you have a site where clickjacking is a real threat to operations (as Google does, what with them being the #1 search engine, and having a very popular single-sign-on mechanism), you should have the option to disable the site being rendered in a frame. How the fuck is allowing others to do exactly what you do a contradiction?

    2. Re:There is no contradiction by williamhb · · Score: 1

      Google has so much contradiction in what it wants for itself and what it does with other websites

      For them it already is theirs.
      As long as nobody clearly states that it isn't their data, they will treat it as theirs. And nobody is saying that the personal data belongs to the person, so companies can keep confusing you and telling that as soon as it is somehow online, it is not yours anymore.

      Are you suggesting Google is a toddler?. They're supposed to be 13 years old now. Someone send them a note to grow up and start grunting and concentrating on their music like any other teenager!

    3. Re:There is no contradiction by gumbi+west · · Score: 1

      As long as nobody clearly states that it isn't their data, they will treat it as theirs.

      Funny, even if your book had that text about not putting it in an automated storage and retrieval system in any format... still got scanned. I think they want you to say not just everyone, but also google in particular.

  8. WTF? by Mathinker · · Score: 5, Insightful

    The summary seems to imply that Google has "magical powers" which enable it to block displaying its pages in IFrames, which no one else has?

    The reality, AFAICT, is that everyone could block Google from displaying their pages in that way, also. They largely just don't (either want, bother or know how to do it), but I fail to see how that makes Google "evil".

    1. Re:WTF? by D'Sphitz · · Score: 2

      Exactly. No conspiracy here, if you want to prevent google from displaying your pages in frames you are certainly able to.

    2. Re:WTF? by nightfell · · Score: 2, Interesting

      The summary seems to imply that Google has "magical powers" which enable it to block displaying its pages in IFrames, which no one else has?

      Really? I never saw the term "magical powers" anywhere in the summary, nor was it implied in any way. What was implied, and in fact outright stated, is that Google is being hypocritical. They are doing to others what they disallow being done to them.

      The reality, AFAICT, is that everyone could block Google from displaying their pages in that way, also. They largely just don't (either want, bother or know how to do it), but I fail to see how that makes Google "evil".

      They are taking without giving in kind. The whole "evil" thing is stupid to begin with, but if you're going to use a term like that so loosely (like Google does, so fuck them, they deserve it right back), then this is a good example of just that.

    3. Re:WTF? by lostmongoose · · Score: 1

      Really? I never saw the term "magical powers" anywhere in the summary, nor was it implied in any way. What was implied, and in fact outright stated, is that Google is being hypocritical. They are doing to others what they disallow being done to them.

      And what's stopping other from disallowing the same thing? Nothing, that's what. All Google is doing is *dramatic gasp* protecting its users! They may not be doing it out of any altruistic motives, but it is what it is. If web devs are too damn lazy to use the Google APIs for accessing and displaying this data, too damn bad. There's nothing hypocritical about this story.

    4. Re:WTF? by Anonymous Coward · · Score: 0

      Google has so much contradiction in what it wants for itself and what it does with other websites [e.g., Google frames Slashdot],' quipped one poster. 'Do no evil, right?'

      Look, really, a Slashdotter could hear a rumor that some lowly engineer at Google could flush a toilet wrong (according to that Slashdotter) and Slashdot would be abuzz with smartass "ZOMG TEHY DID EVIL Y U SAY DO NO EVIL GOOGGLEZ?" remarks. What Slashdot says really doesn't matter anymore.

    5. Re:WTF? by icebraining · · Score: 1

      They're not being hypocritical. Some pages can be safely IFRAMEd, others can't. It's up to the website developers to decide, like Google has for their website(s).

      --
      Dilbert RSS feed
    6. Re:WTF? by Mathinker · · Score: 2

      > They are taking without giving in kind.

      Your comment is, well, bizarre. As I pointed out. Thinking of various real-life analogies makes this clear.

      For example, if someone puts up "No Trespassing" signs anywhere on his property, in your opinion he is being hypocritical if he then doesn't continually check, wherever he goes, that he is not on unsigned private land? And what if the country where he is currently visiting doesn't have a central registry for doing this kind of checking --- do you have any idea the amount of effort it would then take for him to merely move around without being hypocritical in your eyes (or at least, in the eyes of the summary based on your interpretation)?

      Does someone who picks up a penny off the public street then have the obligation, for the rest of his life, to intentionally drop coins so others will have equal opportunity to pick up coins? Or is it enough that he doesn't take special steps not to drop coins? Exactly how many coins might he obliged to drop in order to not be hypocritical, one for every other human on the Earth?

      > The whole "evil" thing is stupid to begin with,

      Well, in some ways I can agree with that part of your comment. A non-evil advertising company? Oxymoron if you ever thought of one. But, it's actually genius marketing --- to the extent that I'm not even totally convinced that the story of the "Don't be evil" origin (that it was originated by an idealistic/ethical Google engineer, not a marketing droid) is 100% true and unembellished.

    7. Re:WTF? by manu0601 · · Score: 1

      This is no magic, this is the result of the X-Frame-Options HTTP header, sent by Google servers, and honoured by browsers. That avoids a bunch of security vulnerabilities and anyone should do it. The weird thing is that Google still promotes the use of frames when displaying search results.

    8. Re:WTF? by D'Sphitz · · Score: 1

      They are taking without giving in kind.

      I noticed Google also disallows crawlers to certain url's on google.com, yet they will happily crawl every url on your site if you don't take similar action to prevent it. We need to put a stop to this madness at once!

    9. Re:WTF? by nightfell · · Score: 1

      Who is talking about putting a stop to anything? We're just pointing out hypocrisy. That is all. Why do so many people need to turn things into black-and-white extremes?

    10. Re:WTF? by nightfell · · Score: 1

      Does someone who picks up a penny off the public street then have the obligation, for the rest of his life, to intentionally drop coins so others will have equal opportunity to pick up coins?

      What sort of nonsense is this?

      Google is taking without giving, as a matter of policy. They are free to do this. No one is saying they have to do anything. We are just pointing out that this doesn't exactly sound like the sort of thing that fits with "do no evil" (as childish as that phrase is to begin with).

      If Mother Theresa were to walk around picking up every coin that wasn't nailed down, and never gave a cent away, while admonishing others to give away their money, it would be worthy of pointing out this hypocrisy. If Bill Gates were to walk around picking up every coin that wasn't nailed down, but told others they should do the same, hypocrisy would not come into it.

      Google is one of the most hypocritical companies on the planet. No one is saying they shouldn't be doing the things they are doing so much as we are saying that they sure seem to not be living up to their supposed ideals all that well.

    11. Re:WTF? by Mathinker · · Score: 1

      > What sort of nonsense is this?

      What it seemed to me to be what you were proposing? I didn't quite understand how he Mother Theresa analogy in your rebuttal fits the Google situation. You claim that Google is "admonishing others" to not use standard technology which would prevent them from displaying web pages in IFrames? Have any evidence there?

      > Google is taking without giving

      I don't know about you, but I find them kind of useful, sometimes. Others seem to concur.

      > as we are saying that they sure seem to not be living up to their supposed ideals all that well.

      Which seems to be because you prefer to interpret their supposed ideals in an exaggerated way? If you would interpret the "evil" in "Don't be evil" as "intentionally trying to increase physical violence against helpless innocents" then you wouldn't have much of a case here, correct? So you kind of have to admit that it all turns into a matter of how you relate to the "Don't be evil" phrase. You prefer to misquote it (was that a Freudian slip, there?) as "Do No Evil" and get irritated by every little thing Google does which you disagree with. That is your right. Others don't relate to the "Don't be evil" shtik so seriously, and don't see your point of view as valid.

      Think about "Don't be evil" as "Be as good as you can be while ensuring that we still make good profits", and you could perhaps see it more like I do.

  9. Congratulations by Anonymous Coward · · Score: 3, Insightful

    The threads you linked to have 18, 2, and no comments respectively.
    While this is mildly interesting, it appears all the links you could find have trivial numbers of people participating.

    Nobody cares, this is non-news. Oh wait, Google was mentioned?
    There's even a comment about DRM! Everyone loves DRM articles!
    Nevermind, proceed with the company-bashing.

    Congratulations on spamming your private battle to thousands of people via Slashdot editors.

  10. Re:DRM for webpages by rivetgeek · · Score: 4, Informative

    Any person who modded this up needs a refresher in basic application security. The ability to iframe in a page allows for attacks like clickjacking.

  11. What? by xstonedogx · · Score: 3, Insightful

    'Google has so much contradiction in what it wants for itself and what it does with other websites [e.g., Google frames Slashdot],' quipped one poster. 'Do no evil, right?'

    I don't see the contradiction. Everyone is allowed to decide whether or not they allow their content to be displayed in iframes. If Google chooses no for itself but takes advantage of the fact that others have chosen yes, that is not hypocrisy. (If Google was forcing yes on others, the poster might have a point.)

    There is plenty to complain about here, I'm sure, but that's not it.

    1. Re:What? by OeLeWaPpErKe · · Score: 1

      I guess the hypocrisy accusation comes from the fact that your argument applies equally well to just about any evil organisation. The problem is simple. If everybody is allowed to shoot and kill, those with guns have the obvious advantage. Since google >>>>>>>>>>> other websites, a similar principle applies here.

    2. Re:What? by blackraven14250 · · Score: 1

      Everyone else has exactly the number of guns that Google does, in that disabling IFrames is a single gun, and any website can use it free of charge. Your argument is bunk.

    3. Re:What? by OeLeWaPpErKe · · Score: 1

      Everyone else has exactly the number of guns that Google does,

      Riiiiight ... you sound like the Iraqi information minister here.

      1) Does google have the same technical options as everybody else ? No, they have more (e.g. they use undocumented, or badly documented features of their own software, but it doesn't quite end there)
      2) Does google have the same clout as everybody else ? Definitely not.

  12. Re:DRM for webpages by pentadecagon · · Score: 3

    They do it for security. It's OK if you don't understand it. You apparently don't like Google. That's OK as well. But neither is a good reason for posting hate-speech.

  13. Browser script? by Anonymous Coward · · Score: 1

    Couldn't you write a browser script that modifies JavaScript's window object and such to make frame-breaking impossible?
    And if you were a browser developer, couldn't you restrict frame-breaking to pages within the same website?

  14. For many more examples, just Google! by theodp · · Score: 1

    For more examples, Google for 'This content cannot be displayed in a frame' google.

  15. Come to the dark side - feel the anger - by h00manist · · Score: 1

    The dark side has it's own gravity.

    --
    Build your own energy sources from scratch. http://otherpower.com/
    1. Re:Come to the dark side - feel the anger - by Anonymous Coward · · Score: 1

      Learn your grammar please. It's "its" not "it's".

    2. Re:Come to the dark side - feel the anger - by Anonymous Coward · · Score: 0

      Yore missing a comma after "grammar".

  16. Re:DRM for webpages by Urkki · · Score: 1

    Showing a page in an IFRAME is really no different from viewing it in, say, an ad-supported webbrowser (like older versions of Opera).

    Yes, it's quite different. It's same only if you have the habit of downloading random web browsers, the way you browse random web pages. You have to trust web browser much more than you have to trust a random web page, since web browser has access to everything you do online with it. Clickjacking, XSS & co are real.

  17. Re:DRM for webpages by Anonymous Coward · · Score: 0

    So you are saying that clickjacking is OK as long as you are Google?

    I can understand and agree with Google's approach to it, but it sure is a double standard. Google trusts itself not to abuse it. But what about the invasion of IP for revenue?

  18. Who gives a rat's ass about iframes... by Anonymous Coward · · Score: 0

    Frames are responsible for so many hidden viruses, exploits, and malware... Good riddance.

  19. Denied by Anonymous Coward · · Score: 0

    I'm an asshole.
    X-FRAME-OPTIONS: DENY

    (Filter error: Don't use so many caps)

  20. Re:DRM for webpages by dave420 · · Score: 1

    There is *nothing* stopping anyone from implementing iframe-busting on their sites. It won't hurt their search ranking. They are merely showing that if a site is a large target for malicious scripts, it makes incredible sense to stop it from being ran in an iframe.

  21. Do no evil? Hah by Anonymous Coward · · Score: 0

    Google management is so desperate for growth, they will do anything to achieve it. The company is run by high-tech "mafiosos" who don't know how to make money except through advertising fed by intellectual property infringement and privacy invasion.

  22. Google is an advertising company, get over it! by ad454 · · Score: 1, Informative

    Google is an advertising company. Nearly all of their sites and services are focused to drive ad revenue.

    Please note: 2011-Q3: Total Ad Revenue $9.335B (96%), Other Revenue $0.385M (4%)
    Source: Google Financial Results

    If Google did allow 3rd party frames of its websites, than that creates the situation that someone else can add their own advertising onto Google's pages/services, and prevents them from completing controlling the entire ad experience and ad revenue.

    Personally I don't fault Google for this, since they are behaving exactly as one would expect from an advertising company. I think that other websites sites also need to use JavaScript and web tags to prevent Google using them in frames.

    1. Re:Google is an advertising company, get over it! by MimeticLie · · Score: 1

      So you're arguing that Google is unwilling to tolerate the existence of other ad networks? That's odd, especially considering how many you can find using Google itself. Someone using ads on a service that used a Google IFrame wouldn't stop Google from making money on its own ads.

      The other posters have hit the nail on the head. When you're dealing with as much personal data as Google, it would be irresponsible to allow IFrames. The fact that clickjacking isn't on the security radar of most users makes the problem all the more significant.

    2. Re:Google is an advertising company, get over it! by flimflammer · · Score: 2

      This isn't why they're doing it. It's an issue of security, not protecting revenue by blocking sites from injecting their own ads into a framed google...

    3. Re:Google is an advertising company, get over it! by OeLeWaPpErKe · · Score: 1

      The argument is that google is perfectly willing to add it's own adds to views of other people's webpages, yet refused the reverse (e.g. someone showing google with an add on top).

    4. Re:Google is an advertising company, get over it! by Anonymous Coward · · Score: 0

      if $9.335B is 96% then I fear that $0.385M isn't 4%. You probably meant $0.385B.

    5. Re:Google is an advertising company, get over it! by MimeticLie · · Score: 2

      Is Google adding ads to other people's sites? I just checked some search results and didn't see that happening. If you look at the image linked in the summary, there are no Google ads on the page.

      Anyway, Google putting other pages in IFrames isn't an issue, so long as you can block the use of IFrames and still be listed by Google. That's entirely equitable: they're able to opt-out and you're able to opt-out. And, unless I'm very much mistaken, that's how it works.

    6. Re:Google is an advertising company, get over it! by OeLeWaPpErKe · · Score: 1

      Okay, search for a term which has ads. Don't make it complicated, make it "car". There you go : content from external sites, google's ads. But this is quite tame, right ?

      Now hover your mouse over one of the results. Boom. All content of the external site, rendered. Google's ads still visible (and more prominent than those on the external site).

      Alternatively, click on the ">>" icon to the right of a result entry.

    7. Re:Google is an advertising company, get over it! by MimeticLie · · Score: 1

      So you're complaining that the ads on Google's search page are more prominent then the ads in a thumbnail? How is that comparable to your "showing google with an add on top" example from above? Regardless of the content of the story, you'd find something to complain about, wouldn't you?

    8. Re:Google is an advertising company, get over it! by OeLeWaPpErKe · · Score: 1

      I'm not complaining, I like the thumbnails. But they do constitute exactly the situation you asked me to demonstrate :
      1) they're showing the site's content, often with the sites' advertisements downplayed
      2) google's ads, by contrast, are superimposed on that

  23. use the APIs by Gravis+Zero · · Score: 5, Insightful

    Google has lots of APIs to let you do most anything. If you need to embed an entire page from google then you are doing it wrong. This is a security issue and frankly I'm glad they are acting responsible.

    DOING IT WRONG:

    I am designing a web site and I wish to make extensive use of google.com via iframing.

    --
    Anons need not reply. Questions end with a question mark.
    1. Re:use the APIs by Civil_Disobedient · · Score: 1

      Well, yeah, but some of their APIs are "doing it wrong." Just one example (one that recently burned us): the Google Image Charts API has a neat feature that allows you to fetch the image data to construct an image map of a chart. Just append "&chof=json" to any image request and viola! a nice, handy JSON object.

      Except... wait a second! That's totally useless! Why? Because there's no way to actually fetch the JSON object. If you put the URL as the SRC attribute of a script block, it doesn't return an instantiated object. If you try fetching the object through an async request, you'll fail because you violate same-origin policies.

      What you really need is a JSONP object, as this fellow complained about earlier. Notice how many responses he's gotten? ZILCH.

      Basically the only way you can actually use their handy JSON hook is to set up your own proxy that passes requests along as generated POSTs to Google's server, then returns the results wrapped in an execution block. It's completely asinine.

    2. Re:use the APIs by Anonymous Coward · · Score: 0

      Not sure if you're trolling, since if you ever actually tried it, you'd see that fetching via XHR works just fine because they use the "access-control-allow-origin:*" header. Google engineers aren't idiots.

  24. property law in the cloud era by epine · · Score: 2

    To follow up on my last post:

    I wouldn't be unhappy to see property law evolve in the cloud era so that blocking a user from recovering those possessions in a reasonable process and time frame would constitute actual theft.

    Property is a social construct and it changes as the embodiment of property changes (wives, children, slaves, agricultural boundaries, water, mineral rights, design, copyright, and in the ridiculous fullness of time as practiced by the legislature and legal profession ... personal cloudwares).

  25. fundamental problem by StripedCow · · Score: 1

    The fundamental problem here is that google's services are ones you'd expect a government to run. But of course, google is not the government and the free market model in which google operates does not force them to work as a government. In other words, they do not need to serve the needs of all of their clients, but instead, to make a profit, they need to serve the needs of most of their clients. And that's the fundamental problem, and it isn't going away until either the government takes over google, special regulations are put in place, or our market model is fundamentally changed. This whole iframe thing is just symptomatic of this problem.

    --
    If Pandora's box is destined to be opened, *I* want to be the one to open it.
    1. Re:fundamental problem by canajin56 · · Score: 2

      So you are proposing government mandated elimination of security measures? Do you by chance make a living by phishing?

      --
      ASCII stupid question, get a stupid ANSI
    2. Re:fundamental problem by Anonymous Coward · · Score: 0

      Uh..... no? I would say that there is pretty much nothing google does that I expect a government to do for the populace. But I would be wrong to say such a thing. Because there is not pretty much nothing.. there is truly nothing that google does that a government should/does do for its citizens.

      Its also hard to argue that you need to frame google pages. If you need content from google pages, there are APIs for quite a lot of it. How true is this for pages that Google displays in frames?

      The fundamental problem is that people like you don't get that google's pages are valuable to attack and iframes are but one way to attack them. So google don't allow it. Your careless, thoughtless dumbfuck blog page can't make nearly the same claim. But if you were concerned about it, you too could prevent anybody (including google) from iframing your pages.

    3. Re:fundamental problem by Anonymous Coward · · Score: 0

      If you see that statement in the OP you must have been smoking something good.

    4. Re:fundamental problem by flimflammer · · Score: 2

      ...what google services are ones you would expect a government to run? I can't think of a single one.

    5. Re:fundamental problem by Anonymous Coward · · Score: 0

      Free maps of all those roads the government builds with public money for public use. Over here you have to pay for government maps.

    6. Re:fundamental problem by flimflammer · · Score: 1

      Does Google even provide such maps? I don't think there's anything in Google maps to differentiate such roads.

  26. Internet vampire by Anonymous Coward · · Score: 0

    Is this news? Google is an internet vampire. Vampires feel free to suck blood as they will but are usually a little more picky about their own life force.

  27. Re:DRM for webpages by Anonymous Coward · · Score: 0

    They do it for security. It's OK if you don't understand it. You apparently don't like Google. That's OK as well. But neither is a good reason for posting hate-speech.

    I think you're mistaken, Not liking something is the best reason for posting hate speech about it.

  28. Use Google Custom Search by Anonymous Coward · · Score: 0

    Google Search contains "potentially clickjackable" Google+ widgets, so it's protected by this header. Google Custom search doesn't have this problem, so it's easily embeddable.

    http://www.google.com/custom

  29. Keep your motto amoral by Anonymous Coward · · Score: 0

    This is why the phrase "Don't be evil" never should have been associated with Google. It was basically a challenge to the world to find and shout about anything Google does which could be considered "immoral" (via an obvious association with the word "evil"). Since morality is different for different people, there will always be people feeling completely justified in saying "so now Google is evil. Ha!"

    "Don't break the law" is a much better motto, imo.

    1. Re:Keep your motto amoral by Anonymous Coward · · Score: 2, Insightful

      Don't break the law complete defeats the purpose of a motto. The idea of having and sharing the "don't be evil" motto is to show intent to be good citizens beyond simple regulatory requirements to abide by the rules the state hands down. Everything else you say is true it will be used against them but they believe, wrongly or rightly, that it is important to show intent to act in a moral/ethical way beyond what is simply required of them. This may just be simple advertising or it may be a genuine belief that this type of corporate cultural artifact is vital to being the company they want to be but either way it's not as simple as don't do things that can be used against you because it's not a simple tactics exercise but a philosophical one instead.

    2. Re:Keep your motto amoral by utkonos · · Score: 1

      Wow, you just used the Cultural Differences argument as if it is the only possibility in ethics. The Cultural Differences argument and Cultural Relativity in general is based on flawed logic. And besides that, there are other alternative philosophical theories. One is that the perception of morality is different for different people, but that the truth of morality is set in stone like the other constants that govern physics and chemistry. There are other philosophical arguments as well. But if you are going to use one, at least don't make it sound like its a fact of life or something when it is not.

  30. Re:Text goes here by Anonymous Coward · · Score: 0

    Why isn't Usain Bolt isn't allowed to participate in the special olympics?

  31. Frames are horrible anyway by Anonymous Coward · · Score: 0

    I hope all the non-google people now "retaliate" by blocking frames too, with X-Frame-Options on the server. Then we can be free of frames.

  32. Their business, their rules by kikito · · Score: 2

    You can ask them to give you your money back if you are not satisfied.

  33. Re:Text goes here by Anonymous Coward · · Score: 0

    You mean the one standard where Slashdot picks on everything Apple does?

  34. Re:DRM for webpages by flimflammer · · Score: 1

    ...what? How the hell do you even come to that conclusion?

    iframing a website doesn't automatically make you a clickjacker, but google owes it to its users to prevent that possibility from others who would abuse it.

  35. YouTube uses iframes by trawg · · Score: 1

    I found it interesting a couple months back when YouTube changed to using iframes by default for their embed code.

    You can check 'use old embed code' to use the original object code, but I haven't seen anyone do this since they made the change.

    I was massively surprised when they made this move because of the security side of things; I'm completely unsurprised that they're blocking iframes, but I'm just as surprised they're using them by default in Youtube.

  36. Aren't iframes part of the HTML standard? by dpbsmith · · Score: 1

    I'm not a Web standards maven, but I thought that whereever iframes originally came from, they were now a completely legitimate part of the W3C HTML standard. If so, then they ought to work with anything. The description in the HTML 4.01 standard seems to be here, and as a non-language-lawyer it seems to me that it is supposed to work unless your "user agent" (browser) does not support frames.

    If Google is intentionally doing something makes properly formed, Web-standard HTML not work properly, then shame on them. This isn't a question of "reciprocating" or "not reciprocating," it's a question of following Web standards or not. It's bad enough when a company is just too lazy or careless to follow them, but if a company intentionally makes proper HTML not work, I think that qualifies as "evil."

    --

    "How to Do Nothing," kids activities, back in print!

    1. Re:Aren't iframes part of the HTML standard? by Intropy · · Score: 1

      It's standard HTML to use IFrames on a page. It's also standard to be able to flag a page with "don't load me in an IFrame." Google is raising that flag.

    2. Re:Aren't iframes part of the HTML standard? by ace123 · · Score: 1

      Yes, and the original standard allowed any site to frame any other site and access any data from it... This isn't 1999, and you shouldn't be quoting a 12-year-old spec to talk about security issues that weren't even known at the time. Read the HTML5 spec and maybe you will start to see just how many nuances there are in keeping things working while having security on top. Not even the HTML5 spec explains all the complicated shit that browsers have to do... Mozilla's documentation is the best resource for this stuff because they describe what a real browser does. Here you go, first google result:
      https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header

      X-Frame-Options is a standard header (despite the "X-" part, it is a standard security feature built into *all* modern web browsers, including IE), and it is up to a site owner to choose to use it. This is the only guaranteed way to solve clickjacking attacks. Other methods require javascript enabled and some nasty hacks. See this page if you don't believe me:
      http://stackoverflow.com/questions/958997/frame-buster-buster-buster-code-needed

      That said, it's like using a hammer to put in a staple, way overkill. Problem is, there is no way to guarantee that your page is not being clickjacked -- there are so many ways to do a clickjacking attack that browsers simply can't guard against all of them, for example, plugins, opacity, ...

      Yes, users shouldn't be stupid enough to input confidential information when the address bar has an untrusted URL... but the clickjacking attack works by showing users confidential information that only a trusted site could possibly know and giving them a familiar login form... It's very difficult for all but the most trained user to distinguish this type of site from the real thing.

      Not all sites use this, but Google decided it was worth adding the header to protect themselves. That's their decision to make. For my web page, I'm considering the javascript-based solution because it allows a more clear message and lets users override the check if necessary, but this may compromise security in one or two cases, so it's a tradeoff.

    3. Re:Aren't iframes part of the HTML standard? by Anonymous Coward · · Score: 0

      When you make judgements like that without actually understanding the whole situation, I think that qualifies as "ignorant".

  37. Restrict frame-breaking or restrict framing by tepples · · Score: 1

    And if you were a browser developer, couldn't you restrict frame-breaking to pages within the same website?

    Browser developers would be more likely to restrict framing itself to documents within the same origin.

  38. What's wrong with writing the proxy? by tepples · · Score: 1

    What's wrong with writing the proxy, as you suggested? Is it that you'd run into rate limits per IP address that are far too low for a site that gets as much traffic as you reasonably plan to get?

    1. Re:What's wrong with writing the proxy? by Civil_Disobedient · · Score: 1

      Is it that you'd run into rate limits per IP address that are far too low for a site that gets as much traffic as you reasonably plan to get?

      This, plus the concern that we might be violating Google's ToS by using one (they can be very picky about that kind of thing). We don't want to run afoul of the Goog.

  39. MDBG by Pinky3 · · Score: 0

    When translating from Chinese to English at http://www.mdbg.net/chindict/chindict.php?page=translate , the explanation is money.

    October 14, 2011

    Please note: This only affects the translation of text from Chinese to English and vice versa. The functionality to look up individual words or the dictionary definitions of any Chinese word in a text remains unchanged!

    The translation page of this website uses (now and before) Google Translate to perform text translation. Google recently changed their previously freely available website integration APIs to a paid service. This has forced us to change the way translation results are presented.
    from http://www.mdbg.net/chindict/chindict.php?page=20111014_newtranslatepage

    I actually don't even know what iframes are, but this seems related. All I know is that the translations are full of google, and that two weeks ago they weren't. You need to paste or write some Chinese text in the box and click go to see the new output. Of course it won't mean as much if you never saw the old output without the word google plastered all over it.

  40. Don't be evil, not do no evil! by ArtemaOne · · Score: 1

    Stop misquoting. These are hugely different slogans. A non-evil person can do evil, and it does not make him evil.

  41. Ok... look... by Anonymous Coward · · Score: 0

    There is NOTHING on google you need to be using an iframe for. NOTHING! And they are right for blocking you from doing it.

  42. Re:Text goes here by Hognoxious · · Score: 2

    This isn't a hivemind, it's a forum.

    I agree.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  43. I can't use it for unblocking anymore by mshenrick · · Score: 1

    at school, they proxy through EMBC, who block stuff. If they want to block something themselves, at one time they had an inhouse smoothwall (dansguardian/squid) server, but they now block it by using the remote administration tool, by looking at the window title. eg notdoppler.com, which is unblocked at school, is closed automatically when a window with 'notdoppler' in it opens. I used to have a HTML page in my documents with 2 frames, a 1 pixel blank one, and Google. Now since google blocks frames (it seems to be IE that complies with that request, and I can't use Firefox, as since they upgraded to Windows 7 you can't run EXE's of removable media) so I have to put in the URL in the source directly everytime. I hope no more sites doing this, or since as I said it seems to be IE that complies with that request to block framed Google, I find a way to override this 'safety'

  44. stop filtering by referrer by mshenrick · · Score: 1

    I hate it when websites filter by referrer and claim you are stealing their bandwidth. Really? It's just a hyperlink. If you're going to complain don't put it on the web! I use a Firefox add-on to spoof the referrer, to the wikipedia article on referrer spoofing, and sometimes sites claim I'm stealing their bandwidth, and recaptcha doesn't work, but luckily the extension has an exceptions list

  45. Google doesn't allow their content in iframes? by Anonymous Coward · · Score: 0

    *cough* Google's YouTube switched to iframe embedding to allow HTML5 video http://apiblog.youtube.com/2010/07/new-way-to-embed-youtube-videos.html *cough*

  46. JSON is for server-to-server, unlike JSONP by tepples · · Score: 1

    I see a web API that uses JSON (as opposed to JSONP) as an implicit statement that the API is intended for server-to-server communication, as opposed to communication directly with a user agent. If Google disagrees, consider it the same as discontinuing the service, which I'm pretty sure the TOS says Google can do at any time for any reason. If you think this is something Google is likely to disable for you specifically before it discontinues the service for the world, is it that the API allows the server to access a user's private information?