Now, what about the extra DNS lookups? That adds 1x roundtrip time for the user, plus 20-40 bytes of IP header (v4/v6), plus 8 bytes UDP header, plus ~25 bytes for the query and ~100 bytes for the reply.
Wouldn't that be cached after the first load?
Small things add up: 4chan's migration to a cookieless domain
61–70 of 139 posts
Re: Small things add up: 4chan's migration to a cookieless domain
#62We wanted to do this at a news site I worked for (since we had way too many cookies) but the problem was Google news. On Google news thumbnails would not be shown unless they came from the same domain as the other page. So our content was on "www.example.com" and pictures were on "media.example.com" but the cookies were for "example.com" so got sent with every image request.
Set cookie for www.example.com?
Re: Small things add up: 4chan's migration to a cookieless domain
#63Hey moot, why don't you let pass users bypass individual IP blocks?
I refuse to disable my VPN, so it means I can't post any more. A shame 4chan has no way for privacy conscious users to post, especially given your support of StopWatching.us and such.
Re: Small things add up: 4chan's migration to a cookieless domain
#64> If you’ve been linked directly to a Facebook photo, you may have noticed the domain wasn’t facebook.com, but instead something like fbcdn-x-x.akamaihd.net. Large sites load static content from special domains for a few reasons, but primarily to reduce request overhead, and sometimes security. This works for 4chan, but in case of Facebook, it actually reduces security - since cookies cannot be checked for photos on…
I kind of like it for FB. It's nice to be able to easily show a friend a photo, whether or not they are friends with the person who posted that photo and sometimes even whether or not the friend has a FB account.
Re: Small things add up: 4chan's migration to a cookieless domain
#65Earlier quoted context omitted.
They don't. You could serve your site off of www.domain.com and your CDN off of cdn.domain.com easily.
But then you still have to remain vigilant against a clueless dev or random JS lib on www.domain.com setting a cookie for .domain.com, which your browser will helpfully include with requests to cdn.domain.com. With the completely separate root you're protected from that. http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path
So basically it doesn't have to be that way, but to protect yourself from cluelessness/stupidity, you do it.
Kind of like Unix permissions vs. jails/virtual machines. Both are secure, but one is more secure against incompetence than the other.
Re: Small things add up: 4chan's migration to a cookieless domain
#66> If you’ve been linked directly to a Facebook photo, you may have noticed the domain wasn’t facebook.com, but instead something like fbcdn-x-x.akamaihd.net. Large sites load static content from special domains for a few reasons, but primarily to reduce request overhead, and sometimes security. This works for 4chan, but in case of Facebook, it actually reduces security - since cookies cannot be checked for photos on…
I kind of like it for FB. It's nice to be able to easily show a friend a photo, whether or not they are friends with the person who posted that photo and sometimes even whether or not the friend has a FB account.
Nice for you, but potentially not so nice for the poster of the photo who thinks that only his or her friends can access it.
Re: Small things add up: 4chan's migration to a cookieless domain
#67I'm a bit paranoid, don't trust google and never really liked the idea of recaptcha on 4chan because of the illusion of anonymity found there. The cherry on the top is finding out uses Google analytics (mind you I haven't been there in a while. Back then I wasn't nearly this concerned with privacy)
Switching from google analytics to piwik would be nice.
Re: Small things add up: 4chan's migration to a cookieless domain
#68Earlier quoted context omitted.
I kind of like it for FB. It's nice to be able to easily show a friend a photo, whether or not they are friends with the person who posted that photo and sometimes even whether or not the friend has a FB account.
Nice for you, but potentially not so nice for the poster of the photo who thinks that only his or her friends can access it.
Yeah, I acknowledge it has some less ideal traits as well. Of course, if I can see it, I can show it to anyone, whether or not I can direct-link.
Re: Small things add up: 4chan's migration to a cookieless domain
#69Earlier quoted context omitted.
But then you still have to remain vigilant against a clueless dev or random JS lib on www.domain.com setting a cookie for .domain.com, which your browser will helpfully include with requests to cdn.domain.com. With the completely separate root you're protected from that. http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path
So basically it doesn't have to be that way, but to protect yourself from cluelessness/stupidity, you do it. Kind of like Unix permissions vs. jails/virtual machines. Both are secure, but one is more secure against incompetence than the other.
I wouldn't agree. There are completely legitimate reasons to set cookies on *.domain.com -- it isn't "clueless/stupid" to do so, just less ideal.
Re: Small things add up: 4chan's migration to a cookieless domain
#70Earlier quoted context omitted.
Kind of off-topic, but how do you feel about doing a conscious MITM to your users(by using Cloudflare), being 4chan home of Anonymous and all that?
4chan logs IPs and provides them to the cops if the ask, so it's not like users who want to remain completely anonymous can do so without being behind seven proxies anyway.
Yeah... people shouldn't ever assume that "anonymous" means "anything goes"