KeyCDN Blog

I believe it's still worth it. Using a CDN will definitely help speed up the delivery of your static assets especially to those who are further away from your origin server. They're also quite simple to set up as there are many Wordpress plugins out there that allow you to simply enter your CDN url which will rewrite your current static asset URLs (e.g. CDN Enabler). Using a pay-as-you-go CDN service would likely be the way you would want to go just so that you aren't tied down to any monthly commitment that you may not end up fully using. I would suggest taking a look at KeyCDN (https://www.keycdn.com/) which is quite affordable.

It's a combination of different headers that's hard to sum up in a short comment. A good article on the subject should talk about all these headers: Expires, Cache-control, Etag, Pragma, Vary, Last-Modified Key CDN has an article on it. They certainly would have experience and expertise there. I didn't read the whole thing, but it seems to have it covered: https://www.keycdn.com/blog/http-cache-headers There's also some interesting exceptions where rules aren't followed. Like browsers typically have a completely separate cache for favicons. I suppose because they use the icons in funny/different ways, like bookmarks. There are also sometimes proxies (especially corporate MITM ones) that don't follow the rules. Hence the popularity of cache-busting parameters like you described.

There are a ton, ones I've used personally are: https://fastly.com https://www.stackpath.com https://www.keycdn.com along with the AWS offering

Its a vue.js site that I host statically on Netlify, with django backend on heroku that pulls all the data. The trick to get things to load quickly is caching the data on https://www.keycdn.com/ (with the right headers you can set it up that the CDN queries the slow pages in the background and serves the cached ones meanwhile to keep things near real-time). I might do a writeup about that it took me a while to figure out.

so who was the DNS hosting provider? one of these? https://www.keycdn.com/blog/best-free-dns-hosting-providers/ DNS is REALLY a weak link. Another one is the border gateway protocol. I recently read about all GOOGLE, FB, Apple,etc traffic being redirected through a single Russian address for a few minutes. So how does a third party get access to the creds to allow messing with your DNS hosting account? Social engineering? Or are there holes we need to know about?

Your page is Wordpress based, uses a cache (based on HTML comments), all resources are already minified and there isn't much content on the front page. I'd say use http://www.webpagetest.org/ and look at the time-to-first-byte metric. It may be that your hoster is slow or a hardware upgrade (different cache service, SSD) gets the highest speed boost. Are you using shared hosting and could another 100 websites be on the same server? Update: asked a friend who works at a Wordpress hosting company. He recommended this guide: https://www.keycdn.com/blog/speed-up-wordpress

He mentioned CDN's not supporting HTTP/2. I am pretty sure a few them do. Including https://keycdn.com, https://sucuri.net, Akamai and likely a few more.

One thing to watch out for with some CDNs (cloudfront & fastly for ex) is per request pricing. it was the biggest component of our cloudfront bill because we have lot of small resources (js/css files) which had to be served with short expiry times. We moved to edgecast and it was cheaper & faster but recently they seem to be having ISP/PoP level outages which we are not able to pinpoint. So we are on the lookout for good CDN. Came across https://www.keycdn.com/ which checks a lot of boxes but I can't find any reviews of it. Has anyone here used it?

PHP 5.4..? I'd recommend setting up WP Super Cache (which you're using now) to serve static HTML files (not sure what caching method you are using). Then you need to configure Apache (or switch to nginx) to actually look for those files, otherwise the plugin won't do much (it generates PHP files by default which are taxing on the server). Another option would be to switch to the Cache Enabler plugin (along with Apache or nginx configuration) - static HTML page caching as simple as it gets. Oh and upgrade PHP. Edit: For Cache Enabler, check suggested advanced configs at https://www.keycdn.com/support/wordpress-cache-enabler-plugin Edit2: CF would just by default cache your CSS/JS, wouldn't really solve the issues you're experiencing (most likely heavy PHP/MySQL load due to poorly configured caching). That said I haven't looked into the site that much, might be that you have a lot of portions of the site that can't be properly cached but then again most users shouldn't need to be logged in so doubt it.

I use https://www.keycdn.com which has free letsencrypt

The saying has been in use since at least 2018, so I think "someone" is accurate. https://www.keycdn.com/support/difference-between-java-and-javascript

True, but if you compare to AWS, the S3 "First 10 TB / Month" tier is $0.09 per GB [1], and the Cloudfront "First 10TB" north America tier is $0.085 per GB and more for other regions [2] - or if you look at KeyCDN [3] for America that's $0.04 per GB, and again more for other regions. So HillRat's $0.05/GB figure isn't the most expensive out there :) [1] https://aws.amazon.com/s3/pricing/ [2] https://aws.amazon.com/cloudfront/pricing/ [3] https://www.keycdn.com/pricing

https://www.keycdn.com/support/png-to-webp WebP could be a good option.

Why do you think that is a bad header compression scheme for a static protocol where the majority of traffic contains those headers/values repeated over and over? That indexed table shaves about 30% off header size. https://www.keycdn.com/blog/http2-hpack-compression

No JS is needed to prefetch resources that might be needed by the user in the future (e.g. the next navigation) because prefetch it's an HTML5 standard so let the browser handle it, see https://www.keycdn.com/blog/resource-hints

From googling: https://www.keycdn.com/blog/web-font-performance/ Skip to "Here is a comparison of hosting Open Sans locally vs Google CDN." They found it was faster to use a Google CDN. One of the things this article suspects is that CDNs will have better world-wide coverage, and therefore overall latency, than hosting your font yourself. I'd like to see a comprehensive study of your counter point, though.

Your quip here ignores the original conversation, which is about "dev tools for designers." You also conflate the "bygone days" of slower connections with the "bygone days" of monolithic rich media binaries/downloads. Average web page size has increased dramatically over the last decade [1][2], suggesting "massive sites" are more of a today-problem than a bygone one. I understand "Flash" was the trigger-word here, and it is for a lot of people. "Flash Player" the consumer experience was fundamentally different from "Flash," the creation environment. Flash the "dev tool for designers" was the baby thrown out with the bath water. [1] https://www.keycdn.com/support/the-growth-of-web-page-size/ [2] https://www.yottaa.com/a-brief-history-of-web-page-size/

Well, just start, eventually everything will cascade into your mastery of the style sheets. On a serious note; look at the CSS preprocessor projects, they are trying to address some of the pain points you are feeling. (https://www.keycdn.com/blog/sass-vs-less/)

Yes, but that is all the CSS you will ever need to have. If you assume an average of 2.3MB[0] on the common page, that is about 3% of your project size for CSS that will not grow past that (atomic approach implies that you won't change it as we add more styles to your page(s)). [0] https://www.keycdn.com/support/the-growth-of-web-page-size/

KeyCDN also offers Let's Encrypt in combination with HTTP/2 https://www.keycdn.com/blog/free-ssl-certificates/

Its better performance/availability to use a CDN and you have the same problem with any CDN, not just Amazon. https://www.keycdn.com/pricing $.04/GB is pretty cost effective. But yes, on a pure cost-basis, publishing it via a single $5 DO node is cheaper.

I'm going to attempt to give some fact- & data- based answers, as there seems to be too much ideological axe-grinding in (many of) the existing responses (as is, unfortunately typical on HN it seems, when discussing Front End Development). Even if my attempt seems...boring? (And sorry for the length; hopefully it makes up for that a bit in quality...?) HN: "Why did Frontend development explode in complexity?" Answers: 0) It's not ONE thing--it's a combination for forces/trends/factors... 1) The underlying technologies have become more complex (at least CSS and JavaScript have, but much less so w.r.t. HTML). For example: Flex layout, Grid layout, calc(), variables, etc., in CSS. Async/await, destructuring assignment, import(), optional chaining, spread operator, yield, ...more in JavaScript. 2) Customers and Users 'see' something that looks complex (whether inherently or accidentally), using Web technologies, so they are increasingly conditioned to expect that any application (regardless of complexity) can be build/delivered using Web technologies. A few examples, off the top of my head: https://www.figma.com/ https://docs.google.com/ https://www.onshape.com/en/ 3) HTML is--egregiously--impoverished! Quick, when was that last time you saw a non-trivial LOB application (or even most CRUD applications) that did NOT need some sort of data-grid style presentation? Well, luckily we have the HTML5 data grid control for that...oh wait, F** me! And then there's less common…

It's hit-and-miss per LB/server and I have not seen this become a priority since it's not a super popular feature. Here [1] [2] are a couple articles on the topic. My experience has been with HAproxy and F5 load balancers. HAProxy uses an out-of-band process to lay down a .ocsp file and load it via the API. This in effect acts like a cache assuming the script creating the .ocsp file has error handing to avoid clobbering the file if the upstream OCSP endpoint can not be reached. F5 load balancers will cache the response in memory. I have not tested Apache with OCSP stapling/caching recently so I can only assume based on feedback from others here that they have not improved it. I would expect nginx to improve now that they are owned by F5, maybe, eventually. I am a fan of OCSP stapling/caching for the privacy aspect. No need for browsers to leak to the OCSP end-point what domain you are visiting. There are enough nosy people sniffing our traffic already. [1] - https://www.keycdn.com/support/ocsp-stapling [2] - https://blog.cloudflare.com/high-reliability-ocsp-stapling/

> How are GET requests a crutch? They were not in the original spec IIRC. URL's are limited in legth (it's not in the spec, but most clients have a limit) etc. > Which is what any caching proxy must do anyway? Nope. A caching proxy can benefit from HTTP Cache Headers [1]. But cache headers don't work well with GraphQL's GET requests, and don't work at all with the default, which is POST. > This problem is not limited to GraphQL, it's a generic authorization problem. GraphQL makes it significantly more complex though. Because your requests are ad-hoc. > You don't have to build a complexity analyzer or figure out recursion levels, there are already tools that do that for you. Indeed. By adding more and more complexity. And no, tools only solve a part of the problem. Simply a dataloader on a server doesn't entirely solve the N+1 problem. > But you can go another way and just create a list of approved queries. Turning it into REST with none of the benefits of REST. > Usually? That's just speculation. And that's entirely on the implementation of that service It's not speculation. That's the main use case for GraphQL. But even if you just slap it on top of a single database, you still have the problem of ad-hoc queries hammering your database. [1] https://www.keycdn.com/blog/http-cache-headers

1. Keyloggers written entirely in CSS have been demonstrated for some time now [a] 2. Malicious Javascript could have been embedded into their CI/CD pipeline and made it onto the site. 3. Somehow stealing SSH keys from a developer and simply logging into the box to change things at the OS level. In fact, it looks like at least one subdomain of theirs is hosted on GoDaddy. SSH keys for some of their customers were recently compromised. Note that I don't think this actually happened, but wanted to list. [b] 4. Smashing Magazine could also improve security by adding the Expect-CT, Feature Policy, and especially a Content Security Policy. Ironically a Smashing Magazine article from 2017 mentions at least having a CSP. [c,d] 5. I recall some speech by the NSA at DEFCON, I think in 2012 or something. One of their speakers said that for all the cool stuff they do...95% of this time it's just password reuse that gets people or phishing for credentials. This would seem to me the most likely way and the best investment of a hackers time. [a] - https://css-tricks.com/css-keylogger/ [b] - https://www.theregister.co.uk/2020/05/05/godaddy_ssh_login_details_com… [c] - https://www.smashingmagazine.com/2017/04/secure-web-app-http-headers/ [d] - https://www.keycdn.com/blog/http-security-headers

> manufacturing cars is so cheap these days, even General Motors can do it... Short answer: empirically, there's no question: HTTPS CPU overheads simply aren't a problem [0]. Long answer: that's disanalogous. Manufacturing works with economy of scale. Netflix have it worse than the rest of us. They have to deliver tens of gigabytes per month per customer, using roughly the same hardware as the rest of us. According to that Ars Technica article, they did their usual Netflix-ey software optimisations with FreeBSD, but their hardware isn't customised for the job. Their scale doesn't much help them. If HTTPS overheads would put anyone out of business, it would be Netflix, but here we are: they voluntarily added HTTPS for their streams. Again, as I think it bears stressing: these guys are transmitting about 15% of all data-flow across the Internet. Out of all the HTTPS traffic in the entire world (measured by gigabytes, admittedly discounting number of connections established), Netflix handles at least 15% of it. They do so voluntarily. Same goes for YouTube. If you can think of a business model where HTTPS overheads would cause more trouble than they do for Netflix and YouTube, I'd like to hear it. > That's not the case. HTTP uses SNI (for now) Thanks, I wasn't aware of SNI. I don't think it gives much more away though, does it? Someone spying on my line can already see the IP address I'm connecting to. They already know I'm connecting to Wikipedia. They still can't see…

"Obviously, performance was a big win. The website felt like it was running on local machines, bringing a dramatic increase to speed and lower latency across the board. After the switch, at first the load on our cloud servers was so low that we thought the website was down! Switching from PHP to D meant we could cut in half the instance size of each Amazon AWS machine in our cloud. And these machines are still underloaded. Our database cloud was highly affected by this too. We now use one quarter of its original computational power. All of this brought an instantaneous and dramatic cost savings, down to more than half of what our costs used to be." I'm willing to bet they didn't even try a single one of the many possibly optimizations they could have used and actually stay either in PHP or a subset of PHP. It's so much easier to win your argument with a strawman, not to say there aren't cases where D is, in fact, better. https://stackoverflow.com/questions/1408417/can-you-compile-php-code-a… https://www.keycdn.com/blog/php-performance

I think the core of the problem is that CSS is applied to the whole page, so it makes thinking about local changes hard. CSS Modules[1] tries to help by introducing "local" CSS, then there are other approaches like BEM[2] that bake a namespace system into the class names, then there's OOCSS[3] that tries to break it down into separate .foo and .bar "objects" a bit like your example, then others going in the opposite direction like Atomic CSS[4] that try to make all the CSS rules so narrow that it is OK that they are global, then have multiple class names used on each HTML element to make the usage local. Really, it is quite hard, lots of smart people trying to make it work. Personally I've found the approach of CSS-in-TypeScript the easiest to work with, since I'm very familiar with TypeScript and it allow re-using the same tools to solve different problems (and my usecase wouldn't be a good fit for static HTML in the first place, so depending on JS for rendering is OK), but I can see how people not familiar with TypeScript might prefer a different approach to handling the complexity. [1] https://medium.com/front-end-developers/css-modules-solving-the-challe… [2] http://getbem.com/introduction/ [3] https://www.keycdn.com/blog/oocss [4] https://acss.io/

Good question MVorlm, thanks! 1) Static CDNs We live in a wonderful time where CDNs are essentially free for small projects. I use CloudFlare for almost everything, simply because it’s so easy to set up, it gives you a free SSL endpoint, it allows you to use naked domain names (faviconkit.com instead of www.faviconkit.com) and it just works well. The HTML is hosted on Github Pages, which is also free. 1a) Number of edge servers CloudFlare: 151 https://www.cloudflare.com/network/ CloudFront: 117 https://aws.amazon.com/cloudfront/details/ KeyCDN: 30+ https://www.keycdn.com/global-cdn Google Cloud CDN: 90+ https://cloud.google.com/cdn/ There are a few unique aspects of Favicon Kit specifically - the setup here is a tiny little bit more "sophisticated", which is why I chose Key CDN for the API itself. 2) Money spent on infrastructure (at least in the beginning) + Favicon Kit used to run on Heroku until recently, so I spent a few bucks on their hosting and CI plan. (It now runs on AWS Lambda) + I have a paid Github account. + CloudFlare is free. + KeyCDN so far cost me < 100€

Nah. $.04/GB is practical. https://www.keycdn.com/pricing