Zoompf Blog

Cool! There are a bunch of external monitoring services that are worth checking out in addition to this.. - http://www.yottaa.com (shameless plug for my own company) - http://www.webpagetest.org - http://www.zoompf.com - http://www.showslow.com

It's for the best. Cache partitioning solves a browser history leak described in Timing Attacks on Web Privacy[0] The permutations of different CDNs and asset versions meant the cache hit rate was low anyway.[1][2] [0] https://www.cs.umd.edu/~jkatz/TEACHING/comp_sec_F04/downloads/web-timi… (PDF) [1] https://zoompf.com/blog/2010/01/should-you-use-javascript-library-cdns… [2] https://web.archive.org/web/20111123170325/http://statichtml.com/2011/…

They are generally recommended, though are also the occasional arguments against the use of CDNs http://zoompf.com/blog/2010/01/should-you-use-javascript-library-cdns

> I'm going to guess that, on average, it'll download faster from Google CDN than from my server. Not really a safe assumption, it turns out. http://zoompf.com/blog/2010/01/should-you-use-javascript-library-cdns has one of the best discussions of the topic. > I see a chicken and egg thing here, to be on Google CDN you need millions of hits, yet being on Google CDN might help you reach that goal. I don't think that's legit.. If one of your primary criteria on whether to use a given javascript library is it's CDN availability.. you're probably not choosing your tools well. At the same time, I know I prefer to grab a CDN hosted script when starting a project then the downloading rigamarole. But that is like just general development momentum issue rather than a tooling decision.

There are 2 huge problems with this blog post. First, the source image is a photograph, saved as a PNG24 file! They then show how JPEG XR and WebP file sizes compare. This is a worthless comparison. Spoiler alert: the lossless PNG24 isn't very good are storing photographic data, because its not designed to. Had imgix known how to do a proper image comparison study, they would haved used a PNG24, generate a normal, non-progressive JPEG, at the "Save for web" quality setting of 70. That's you baseline. They should then generate the JPEG XR, WebP, and Progressive JPEG off the source PNG24, and compare those sizes to the size of the baseline, regular quality 70 JPEG. I have seen great performance benefits from using WebP where it makes sense, and I discuss them in this video about Warby Parker [0]. But the imgix guys are going about this the wrong way to explain the benefits. Second, the use of Content Negotiation is a terrible idea as well. You don't want to serve different file types from the same URL. Because then, the web server uses the Accept header, and potentially the User-Agent header, to determine the response. This means it must send a Vary: Accept or Vary:Accept, User-Agent header in this response, which renders the response essentially uncachable for shared cached. I discuss this problem here [1], but in the context of the User-Agent header. Its clear the imgix is trying to help people, which is awesome. But its also clear from their advice and analysis they…

The problem with hosting JS libraries on CDNs is that the cache has a network effect. You only gain performance if the browser already has a cached version of this specific version on this specific CDN. If you don't - you end up losing performance, because now an additional DNS lookup needs to be performed, and an additional TCP connection needs to be opened. Here are a few reasons people choose to avoid CDNized versions of JS libraries. http://www.sitepoint.com/7-reasons-not-to-use-a-cdn/ This is a 6 year old post, but it raises some valid concerns: https://zoompf.com/blog/2010/01/should-you-use-javascript-library-cdns

This approach requires iOS 8 specifically because previously apps using WebView used a different, slower JavaScript engine, with iOS 8, apps using the embedded web browser control, WKWebView, will gain full access to the powerful Nitro JavaScript engine https://zoompf.com/blog/2014/06/apples-nitro-javascript-engine-availab… Looks like Android KitKat did the same with a similar performance boost, Since Android 4.4 the WebView is backed by Chromium and not by it’s own rendering engine anymore https://www.timroes.de/2013/11/23/old-webview-vs-chromium-webview/

The attack builds on the CRIME attack, which is discussed in more technical detail here: http://zoompf.com/2012/09/explaining-the-crime-weakness-in-spdy-and-ss… That page suggests that guessing known text like an SSN or email address contained in the body would give them an opening to break the encryption entirely, but I don't know enough about crypto to know if that's actually a possibility.