Viewing profile — patrickmeenan

As far as I can tell, the messaging around Mythos is that it takes the expertise of the top security experts and top-level language, protocol and code experts and makes that availa…

There is some level of data exposure even if you can't tell which site, specifically, a user has visited. You can tell that "this user has been to at least one page that used X". D…

Even a simple case of loading more than 2-3 pages from a given site over a few weeks could benefit from a dictionary for the HTML content (compressing out all of the common templat…

Sorry, I should provide more context. The language in the IETF draft is a bit generic because it is a HTTP spec intended to be used more broadly than just web content in browsers a…

SDCH was removed when SPECTRE became a thing (CRIME/BREACH) because it was open to side-channel attacks. Yes, it had other problems, not the least of which was that it would block …

Nope. The dictionaries are partitioned the same way as the caches and cookies (whichever is partitioned more aggressively for a given browser). Usually by site and frame so there a…

Which is why they are treated as if they are cookies and are cleared any time the cache or cookies are cleared so that they can not provide an additional tracking vector beyond wha…

FWIW, this addresses the BREACH/CRIME issues that killed SDCH by only operating on CORS-readable content. It also solves the problem that SDCH had where the dictionary would be for…

If the proxy is correctly handling the Accept-Encoding (rewriting it with only encodings that it understands), it can either remove the `dcb` and `dcz` encodings or it can check if…

Absolutely, for the use cases where it makes sense. There are some examples here: https://github.com/WICG/compression-dictionary-transport/blo... In the web case, it mostly only ma…

Maybe eventually (as a different spec). We've talked about wanting to support it in the DecompressionStream API or something similar at some point. If you need it to be able to do …

How so? SDCH had sidechannel issues which is part of why it was unshipped. I don't know that someone won't find a way to attack it but the CORS requirement already requires that th…

The brotli repo on github has a dictionary generator: https://github.com/google/brotli/blob/master/research/dictio... I have a hosted version of it on https://use-as-dictionary.com…

For a delta update of one version of a resource to the next, the resource itself is the dictionary (i.e. JS file). For stand-alone dictionaries, the brotli code on github has a dic…

You determine how far back you want to build deltas for. If you build deltas for the last 3 versions then you can send diffs for those users as well (as long as the dictionary hasn…

Even in the "documents" case of the web there can be pretty significant savings if users tend to visit more than one page and they share some amount of structure. On the first entr…

The dictionaries are partitioned by document and origin so a "tracking" domain will only be able to correlate requests within a given document origin and not across sites. They are…

It is more site-dependent than browser dependent but by default (unless the dev overrides) most browsers will leave the text blank for 3 seconds after the font is discovered before…

Yep, hopefully a lot of the default improvements will make their way into all of the browsers. Until then, this also evens the field across all of the browsers but for me the reall…

Functioning HTTP/2 prioritization takes more than just a server that supports priorities. Here's a deep dive into why and how to make sure it's working for your site (and yes, it i…

Completely ignoring TTFB would be a BAD idea. There is no single metric that conveys the user experience (or performance). Certainly optimizing for 1ms because of the overhead for …