M
Mike West
mikewest.org · Personal blog · on HN since 2008
Mike West is a Google Chrome engineer writing about web security, Content Security Policy, IndexedDB, and browser behavior.
What HN saysHN links it for explanations of Chrome's startup behavior, IndexedDB, and JavaScript error reporting; commenters call his IndexedDB intro a great resource.
15HN people shared it
5linked it in comments
15stories submitted
596story points
6 years agolast shared
2008people per year2026
Most-shared posts
- 1Chrome connects to three random domains at startup4 people · 354 points · first shared 2012 · 55 comments on HN
- 2IndexedDB: An Introduction to the JavaScript API3 people · 8 points · first shared 2010 · 1 comments on HN
- 3Solid improvements to 'window.onerror' in Blink.2 people · 2 points · first shared 2013 · discussion on HN
- 4Chrome Privacy1 people · 200 points · first shared 2011 · 99 comments on HN
- 5Content Security Policy: A Primer1 people · 21 points · first shared 2011 · 4 comments on HN
- 6A JavaScript Detection Pattern1 people · 2 points · first shared 2010 · discussion on HN
- 7Google Developer Day Berlin: The HTML5 Demos1 people · 2 points · first shared 2011 · discussion on HN
- 8What is Content-Security-Policy by mikewest1 people · 2 points · first shared 2013 · discussion on HN
- 9Web Platform Security CMS Security Summit 20201 people · 2 points · first shared 2020 · discussion on HN
- 10Content Security Policy: defining policies for an extension1 people · 1 points · first shared 2011 · discussion on HN
- 11The Inspiration of Ownership1 people · 1 points · first shared 2008 · discussion on HN
- 12Scriptless attacks: CSSConfEU presentation on cross-site styling.1 people · 1 points · first shared 2013 · discussion on HN
- 13Generating etags for static content using nginx1 people · first shared 2012
- 14Escaping curly braces in xslt attributes1 people · first shared 2011
What HN people wrote when they linked it
stanleydrew · 2011-03-10
There is some great discussion and excellent examples of using indexedDB in both Chrome and Firefox in this blog post from Mike West, Google evangelist:
http://mikewest.org/2010/12/intro-to-indexeddb
JdeBP · 2017-05-13
It's a fairly regular thing. If you are a Google Chrome user, then your WWW browser has been doing much the same check, for fairly similar reasons (detecting whether it is running inside an environment where DNS service is being generally altered to redirect clients to a special server), for the past half decade.
* https://mikewest.org/2012/02/chrome-connects-to-three-random-domains-a…
jdandrea · 2011-09-16
The Google Search Appliance, with roots in Google proper, generates XML results, which are then (normally) transformed via XSLT. (I'm looking at you, XPath.)
http://mikewest.org/2007/06/escaping-curly-braces-in-xslt-attributes
I s'pose attributes don't enter into it, but still, I wonder if the XSLT pass (if any) has anything to do with this?
paulirish · 2013-09-30
Logging JS errors is quickly becoming easier than you think. :)
On the spec side, we have access to the the column number and… <drumroll>… the stack trace! This took a long time, but it's in now. https://mikewest.org/2013/08/debugging-runtime-errors-with-window-oner…
Chrome already has support and.. if past release schedules are maintained, all users of Chrome should have this feature within the next week. Firefox already has support for the CORS behavior and is working on adding the stack to onerror.
If you want cross-browser stack traces: https://github.com/occ/TraceKit. It's used reliably by many large projects. If you want to track these in a reasonable dashboard: https://getsentry.com/ Sentry even supports sourcemaps, so you can map an error of "e.a is not a function" back to the original unminified JavaScript. Also, open source.
We're turning on CORS for the Google JS Library CDN, too.
masklinn · 2012-04-09
> A common solution to this problem, is to make a 2 stage process, where step 1 is a request of "should I download?", where there are 2 possible replies: "no, check again in N time" and "yes, here is a token". Step 2 is then presenting the token to the api point for download, and getting the file.
You don't even need two steps, just have one step with previously known data. That's how HTTP conditional requests (Last-Modified/If-Modified-Since and ETag/If-None-Match) work: the client states "I want this file, I already have one from such moment with such metadata", and the server replies either "you're good" (304) or "here's your file (200).
Issue is, that only works when the file changes rarely enough, or you need additional server logic to reply that the file is still good when it's not.
> Now that I think of it: it seems that this would be a nice nginx plugin, with a simple client side library to handle it for reference. Anyone want to collaborate on this over the weekend?
I'd be very surprised if nginx didn't support conditional requests already.
edit: according to [0] and [1] — which may be outdated — Nginx provides built-in support for last-modified on static files, it does not provide ETag support (the developer believes this is not useful for static files — which is usually correct[2]) but [1] has apparently written a module to do so [3]. The module being 4 years old, it might be way out of date.
[0]…