Mark Nottingham

I am surprised this doesn't list two major resources for learning how caching works: - https://www.mnot.net/cache_docs/ for a long time this was the best online resource - https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching is extremely detailed, and based on the previous link too from what I can tell

It requires a more modern browser to operate securely; it says nothing about whether it is perfectly secure against all threat models, and this particular website is hosted on the same IP as at least one other so requires SNI to operate securely indeed, and will hopefully in future support ESNI as the software implements it. BTW - if this site did not use SNI, and only served one website at https://www.mnot.net, then connecting to www.mnot.net's IP address at port 443 would be plenty good evidence that you're accessing https://www.mnot.net. The SNI privacy leak only really comes into play when you're accessing something behind a CDN or a shared hosting provider, which put enough sites behind each IP that simply accessing that IP isn't a privacy leak in itself.

The comments on this post are worth reading. It's impossible to construct a meaningful synthetic benchmark without more rigor about what client is being used, how it's configured, how the OS is tuned, testing against actual files (rather than a "Hello World" 100 byte file), details on default tuning for each webserver, and finally what exactly is intended to be tested and what is in fact being tested. A great post on the subject from mnot: http://www.mnot.net/blog/2011/05/18/http_benchmark_rules

This is surprisingly hard to get right on your first try, I ran into a similar issue not too long ago with a framework I had built myself. This page has a great synopses on how it should be done: http://www.mnot.net/cache_docs/

First, there is a major difference between the component (e.g. the software package) and the connectors (e.g. APIs). It makes sense to talk about versioning at the component level, but it should rarely apply at the API level. See this excellent article for further clarification: https://www.mnot.net/blog/2011/10/25/web_api_versioning_smackdown. Versioning an API is a decision by the API provider to let the consumer deal with forward and backward compatibility issues. I prefer the approach of focusing on the link relations or media type vice URI or some other technique of versioning because it is consistent in the direction (wrt Hypermedia-based APIs) of the link relations as the point-of-coupling for your API, which makes managing and reasoning about changes to your API less complicated. Whenever possible, hypermedia-based media type designers should use the technique of extending to make modifications to a media type design. Extending a media type design means supporting compatibility. In other words, changes in the media type can be accomplished without causing crashes or misbehavior in existing client or server implementations. There are two forms of compatibility to consider when extending a media type: forward and backward. Forward-compatible design changes are ones that are safe to add to the media type without adversely affecting previously existing implementations. Backward-compatible changes are ones that are safe to add to the media type design without…

> Strange then that they routinely don't wait for and ignore any and all input from other browser vendors It's not strange when you consider that other browser vendors sometimes flat out refuse or delay. The only option, then, is to just go ahead, spec, build and launch it, and let the market decide whether to push those vendors to reconsider. "The Power of 'No' in Internet Standards" https://www.mnot.net/blog/2026/02/13/no "How Do Committees Fail To Invent?" https://infrequently.org/2025/08/how-do-committees-fail-to-invent/

Fetch came in around 2015, and XMLHttpRequest wasn't consistent in the way different verbs were handled, like redirects, as this blog post[0] from 2006 points out: > Basic redirect support is pretty universal, but things quickly fall apart on most browsers when you do tricky things like use non-GET/POST methods on redirecting resources. There were other things too, I'm not sure CORS supported anything but GET and POST early on either. Wanting consistency and then sticking to it isn't an inherently bad thing, there's a lot to know, and people don't update knowledge about everything (I'm speaking generally as well as including my self here). [0] https://www.mnot.net/blog/2006/01/23/test_xmlhttprequest

I think the concern here is that, as a practical matter, vendors wouldn't be free to make arbitrary changes within their own forks; some parts of the system would have to remain interoperable. And technical decisions regarding what those parts should do and how they should work would still have to be made somehow, and it's not clear that "open source project" type governance would be better than the W3C process that we have today, especially when it comes to interfacing with governments. Good blog post about this: https://www.mnot.net/blog/2022/06/22/chromium-only

That happened already, no? https://www.mnot.net/blog/2014/06/07/rfc2616_is_dead

This[1] might be what you're looking for. [1]: https://www.mnot.net/blog/2022/06/06/http-core

No need to wait; HTTP got a similar full overhaul across several RFCs. Read all about it from one of the editors: - https://www.mnot.net/blog/2022/06/06/http-core - https://www.mnot.net/blog/2022/06/08/http-extensions

It's so cool to have this split. QUIC is so capable, such a neat set of ideas for a transport. That HTTP can express itself in terms of another spec is one of the most compelling, longest-hardest won & best victories for "abstraction" that computing has seen. That we'll be able to iterate on HTTP in new ways, by having a common semantic base, keeps the future open & iterable. Huge wins. Obligatory link to Mark Nottingham's "A New Definition of HTTP3"[1], which talks about the split of HTTP into a semantic definition in RFC9110[2] & the creation of HTTP2/RFC9113 and HTTP3 (over QUIC, this document). [1] https://www.mnot.net/blog/2022/06/06/http-core https://news.ycombinator.com/item?id=31647149 (3 points, 26m ago, 0 comments) [2] "HTTP Semantics" https://www.rfc-editor.org/rfc/rfc9110 [3] "HTTP2" https://www.rfc-editor.org/rfc/rfc9113

It's actually a relic of when I was testing to see how broad SNI adoption was -- see https://www.mnot.net/blog/2014/05/09/if_you_can_read_this_youre_sniing

Also notice how the plan is to push not only DNS entries but also TLS certificates: "Right now, people are really keen to get HTTP/2 “out the door,” so a few more advanced (and experimental) features have been left out, such as pushing TLS certificates and DNS entries to the client — both to improve performance. HTTP/3 might include these, if experiments go well." https://www.mnot.net/blog/2014/01/30/http2_expectations Some of those things could be used for bootstrapping SNI encryption as well: https://www.ietf.org/mail-archive/web/tls/current/msg17474.html

Something like this says "keep this cached for 100 days": Last-Modified: Fri, 19 Feb 2016 12:54:49 +0100 Expires: Sun, 29 May 2016 12:54:49 +0200 Cache-Control: max-age=8640000, must-revalidate See also: https://www.mnot.net/cache_docs/#CONTROL

451 is "approved for publication". It is not yet an RFC. Source: https://www.mnot.net/blog/2015/12/18/451

From the screening arranger's words: https://www.mnot.net/blog/2015/07/20/snowden_meets_the_ietf It’s important to point out that this was NOT an official IETF event, and neither was it giving external advocacy organisations a stage (as some have intimated); rather, it was entirely an effort of individuals, working within the rules for requesting a room at IETF meetings.

Roy says[1] that to be truly RESTful, your resources (documents) need to be linked between each other, just like HTML pages. There are no definite standards yet (that I'm aware of), but JSON HAL[1] seems to be on the IETF standards track to be the one solution we settle on (just like we "settled on" <a href> in HTML). See also [3] for a broader overview on links in JSON and [4] for more information on resource linking and stuff in general. [1] http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext-driven [2] http://stateless.co/hal_specification.html [3] https://www.mnot.net/blog/2011/11/25/linking_in_json [4] http://en.wikipedia.org/wiki/HATEOAS

I found the presentation deck very disjointed; presumably his speaking notes would have drawn it together. Here's an alternative deck by Mark Nottingham http://www.mnot.net/talks/http2-wtf/#/

Of course "you don't implement caching". I think it was clear that I was talking about designing a cache-aware application. Cf. http://www.mnot.net/cache_docs/.

Here's one opinion on that: http://www.mnot.net/blog/2012/10/29/NO_OPTIONS

Whilst a nice little article, I need to point out a factual error. The problem with consuming a REST API with client-side Javascript with AJAX is that most browsers only give access to two HTTP request methods - GET and POST All modern-ish browsers as far back as Firefox 3 and IE 6 support other HTTP methods when called via JavaScript [1]. It's HTML forms where support for different methods is not present. If you have an app that relies on JS you can just use the relevant methods in your .ajax() call. You can check what methods your browser supports here [2] (JS heavy page, may slow down your browser) [1] http://www.mnot.net/javascript/xmlhttprequest/ [2] http://annevankesteren.nl/2007/10/http-method-support

That's not true xmlhttprequest should support all methods but there are some quirks eg see http://www.mnot.net/javascript/xmlhttprequest/ to test though that does not cover PATCH.

It doesn't mention Varnish because it didn't exist back then. But he mentions reverse proxies: http://www.mnot.net/cache_docs/#GATEWAY

Identifiers like URIs are persistent, but the representations it provides you are not persistent over time. So, if I provide a URI that means "a list of links to various resources with interesting data", those linked URIs can be bookmarked (they're persistent), but the original URI has every right to change the links later on if it thinks there are more relevant ones (e.g. newer, more relevant, etc.). Think of how a news site's main page changes with "Top News Stories", for example. That doesn't mean the older URIs it pointed yesterday to are necessarily bad. For a RESTful machine-to-machine interface, this HATEOS approach is arguably one of the more effective ways to do extensibility and versioning: http://www.mnot.net/blog/2011/10/25/web_api_versioning_smackdown

This is the same position Mark Nottingham (http://www.mnot.net/personal/) takes and expresses in his talk "Leveraging the Web for Services at Yahoo!"(http://www.infoq.com/presentations/services-without-soap-yahoo). However, Mark created a service called "Is It RESTful?" (http://isitrestful.com/) to deal with all the engineers asking him that question :)

I think you are over simplying. Look at http://www.mnot.net/cache_docs/ for the nuances involved.

I like Mark's introduction to caching, a bit more detailed, without pictures: http://www.mnot.net/cache_docs/

> CDNs are an architectural misfeature that only exist because Fly.io wasn't around 20 years ago. I'm being extreme, but I think that's fundamentally true. ;) Spicy take :) Although building for a dynamic CDN (I'm thinking Varnish here) feels like building inside-out, I can't see a way to deliver pageviews as efficiently (in terms of CPU or Watts per view) without using a CDN and a lot of caching. With Fly I guess you flip the architecture around and run code but cache a lot of partials that you assemble together. Nicer than working with ESI and its "cache it all but punch holes in the page and render those bits again" approach, but does the efficiency hold up? My architectural misfeature would be ESI [1,2]. So useful and so painful to use. And that's before we get to varying support in different proxies and caches... 1. https://www.mnot.net/blog/2011/10/21/why_esi_is_still_important_and_ho… 2. https://twitter.com/peterbowyer/status/1366324396026118149

Right, my spidey senses were tingling, too. So I looked into the RFC's author, and noted his position as one of the champions of QUIC as HTTP/3, and his promotion of encrypted DNS (specifically DoH), and then an interesting article that on the surface sounds like it advocates for ensuring end users retain control of their DNS requests, but which actually advocates for burying the implementation of DNS in the OS and only exposing a control layer to the end user (e.g. an on/off toggle). [0] I can't pretend to have enumerated all the possible ramifications of this, but without more than a couple of paragraphs in an RFC which is essentially one particular example use case, I consider this a fairly suspicious addition to the URI spec specifically, when viewed in the context of how this might be used to obscure URLs (a subset of URI) from end users (and software running on end user machines). [0] https://www.mnot.net/blog/2019/06/11/endpoint_control