Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I am a fast webpage

varvy.com

Post reply on HN
Print view View original

191–200 of 292 posts

Re: I am a fast webpage

#191

Post by always_good »

ajmurmann wrote: post #165
bigiain wrote: post #153

Earlier quoted context omitted.

So if I'm reading that page correctly, the basic gist of the claim is: If we only do a half assed job of sanitising user input by attempting to blacklist whatever javascript we can think of, we'll still be open to XSS attacks from people smarter than us who put css into our user supplied data, so the answer is to prohibit inline CSS - not to properly sanitise user supplied data. I think there are better pieces of sec…

Why not do both and be safe if your sensitization has a bug?

I still don't understand what it accomplishes. Why does inline matter?

The vulnerability means they can inject arbitrary markup including or that load offsite sources.

You can use CSP to whitelist allowed offsite domains. But if you're not careful, "you never know" and "you might as well" are more likely to waste your time chasing low value things.

For instance, inline CSS is valuable as an intermittent developer convenience, and disabling it takes that away while protecting your from an unlikely event.

Also, you generally should be escaping-by-default and not sanitizing. A templating system should escape by default and make it obvious when you opt out.

Re: I am a fast webpage

#193

Post by dredmorbius »

quinndupont wrote: post #12

Is this image inlining thing something new? Am I reading it correctly that the images are encoded in base64 and delivered as html? Surely this is a bad idea... no?

Keep in mind that you can inline images as SVG as well, which often results in smaller images, included with your HTML or CSS requests.

Not all browsers support SVG, and not all support all properties, but those that do give some pretty good results.

Re: I am a fast webpage

#194

Post by RubyPinch »

ajmurmann wrote: post #128
jlmorton wrote: post #77

I hate to be negative, but what really is the point of this? That a simple webpage without any content can be fast? Of course it can. Is it desirable to inline your CSS, "like a boss?" Maybe if you have one single web page. What if you have dynamic content and your users intend to browse more than one page? With externalized CSS, that is all cached. Same with images. If I'm building a web application, I certainly do…

It's also a security issue and you should set up CSP to prohibit online CSS. See a random Google search result http://dontkry.com/posts/code/disable-inline-styles.html or like I did read "The Tangled Web" Edit: that's obviously a non-issue in this particular case since everything is static. But as a best practice this needs to be considered and inline CSS doesn't make you a boss.

so, hoster doesn't escape anything the users provide, and is more concerned about CSS instead of JS?

And then their site broke as soon as I clicked a link

Re: I am a fast webpage

#195

Post by philip1209 »

I'm curious - would this page see any speed improvement with HTTP2? I ask because the new protocol seems optimized for the exact opposite of this - many asynchronous fetches.

Re: I am a fast webpage

#198

Post by devonkim »

niftich wrote: post #70
zackbloom wrote: post #4

Just to point out, there's no particular reason to host a page like this on a VPS at all. You could just throw it on S3. Even better, you could put it behind a CDN like Cloudfront and the total cost would be a dollar or two a month, not $25+ and it would be significantly faster.

How do you prevent S3 from slashdotting your wallet if your site suddenly gets really popular?

You can setup jobs to run that fire when CloudWatch alerts fire noting that your bill is going up or that your hit rate for certain objects is going way up. I think there's a way to setup billing such that you can't exceed a certain amount in a month but that's a weird situation to try to hard stop charges without deleting everything in your account.

Re: I am a fast webpage

#199

Post by twhb »

jlmorton wrote: post #77

I hate to be negative, but what really is the point of this? That a simple webpage without any content can be fast? Of course it can. Is it desirable to inline your CSS, "like a boss?" Maybe if you have one single web page. What if you have dynamic content and your users intend to browse more than one page? With externalized CSS, that is all cached. Same with images. If I'm building a web application, I certainly do…

This guy's advice is exactly what Google advises you to do, and exactly what Google does.

You say this website is only fast because it's "without any content". If there's no content then tell me how it communicated its point so clearly. If it's inherently fast then tell me why the same thing posted to Medium is so slow.

A hallmark of a great solution is that people who see it decide the problem must not have been very hard.

http://www.csd.uwo.ca/~magi/personal/humour/Computer_Audienc...

Re: I am a fast webpage

#200

Post by meowface »

mikepurvis wrote: post #150
simbalion wrote: post #126

Earlier quoted context omitted.

the guy says he's not an idiot then brags about spending $30 per month on a VPS (idiot), for a single-page static HTML website with all inline-code (idiot+1). It's not being negative to point out the glaring flaws in a person's statements. My assumption is the entire thing is an advertisement for that hosting service.

Also, whether the VPS has an SSD or not is totally irrelevant— if you really were serving a single page it would be cached in the memory of your webserver. (Or better yet, serve the thing off S3 and let Amazon be your CDN.)

Hell, I'd just use my Dropbox account.
Post reply on HN