patrickmeenan

8 ms·

1.
by patrickmeenan 4mo ago
As far as I can tell, the messaging around Mythos is that it takes the expertise of the top security experts and top-level language, protocol and code experts and makes that available to anyone with access. The danger was in giving that acc
2.
by patrickmeenan 2y ago
There is some level of data exposure even if you can't tell which site, specifically, a user has visited. You can tell that "this user has been to at least one page that used X". Depending on what the common resource is, most
3.
by patrickmeenan 2y ago
Even a simple case of loading more than 2-3 pages from a given site over a few weeks could benefit from a dictionary for the HTML content (compressing out all of the common template code). Just about any e-commerce site will involve a few p
4.
by patrickmeenan 2y ago
Sorry, I should provide more context. The language in the IETF draft is a bit generic because it is a HTTP spec intended to be used more broadly than just web content in browsers and each should evaluate the risks for their use case. For b
5.
by patrickmeenan 2y ago
SDCH was removed when SPECTRE became a thing (CRIME/BREACH) because it was open to side-channel attacks. Yes, it had other problems, not the least of which was that it would block the processing of a response while a client fetched the
6.
by patrickmeenan 2y ago
Nope. The dictionaries are partitioned the same way as the caches and cookies (whichever is partitioned more aggressively for a given browser). Usually by site and frame so there are no cross-site vectors that it opens.
7.
by patrickmeenan 2y ago
Which is why they are treated as if they are cookies and are cleared any time the cache or cookies are cleared so that they can not provide an additional tracking vector beyond what cookies can do (and when 3rd party cookies are partitioned
8.
by patrickmeenan 2y ago
FWIW, this addresses the BREACH/CRIME issues that killed SDCH by only operating on CORS-readable content. It also solves the problem that SDCH had where the dictionary would be forced on the response and the client would have to go fet
9.
by patrickmeenan 2y ago
If the proxy is correctly handling the Accept-Encoding (rewriting it with only encodings that it understands), it can either remove the `dcb` and `dcz` encodings or it can check if it knows the announced dictionary and only allow them throu
10.
by patrickmeenan 2y ago
Absolutely, for the use cases where it makes sense. There are some examples here: https://github.com/WICG/compression-dictionary-transport/blo... In the web case, it mostly only makes sense if users are using a si
11.
by patrickmeenan 3y ago
Maybe eventually (as a different spec). We've talked about wanting to support it in the DecompressionStream API or something similar at some point. If you need it to be able to do compression though then it might be a harder sell since
12.
by patrickmeenan 3y ago
How so? SDCH had sidechannel issues which is part of why it was unshipped. I don't know that someone won't find a way to attack it but the CORS requirement already requires that the dictionary and compressed-resource be readable a
13.
by patrickmeenan 3y ago
The brotli repo on github has a dictionary generator: https://github.com/google/brotli/blob/master/research/dictio... I have a hosted version of it on https://use-as-dictionary.com/
14.
by patrickmeenan 3y ago
For a delta update of one version of a resource to the next, the resource itself is the dictionary (i.e. JS file). For stand-alone dictionaries, the brotli code on github has a dictionary_generator that you can use to generate a dictionary.
15.
by patrickmeenan 3y ago
You determine how far back you want to build deltas for. If you build deltas for the last 3 versions then you can send diffs for those users as well (as long as the dictionary hasn't expired). Or, you could just send the full response
16.
by patrickmeenan 3y ago
Even in the "documents" case of the web there can be pretty significant savings if users tend to visit more than one page and they share some amount of structure. On the first entry to the site you trigger the load of an external
17.
by patrickmeenan 3y ago
The dictionaries are partitioned by document and origin so a "tracking" domain will only be able to correlate requests within a given document origin and not across sites. They are also cleared any time cookies are cleared and don
18.
by patrickmeenan 7y ago
It is more site-dependent than browser dependent but by default (unless the dev overrides) most browsers will leave the text blank for 3 seconds after the font is discovered before falling back. In most (all?) of the cases in the blog post,
19.
by patrickmeenan 7y ago
Yep, hopefully a lot of the default improvements will make their way into all of the browsers. Until then, this also evens the field across all of the browsers but for me the really exciting part is exposing it to Workers so sites can custo
20.
by patrickmeenan 8y ago
Functioning HTTP/2 prioritization takes more than just a server that supports priorities. Here's a deep dive into why and how to make sure it's working for your site (and yes, it is broken more often than you might hope).
21.
Optimizing HTTP/2 prioritization with BBR and tcp_notsent_lowat(blog.cloudflare.com)
6 points by patrickmeenan 8y ago|1 comments
22.
by patrickmeenan 14y ago
Completely ignoring TTFB would be a BAD idea. There is no single metric that conveys the user experience (or performance). Certainly optimizing for 1ms because of the overhead for gzip compression isn't where you should be spending your ti