Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some analysis of the 1M most popular sites on the web

jacquesmattheij.com

Post reply on HN
Print view View original

91–100 of 130 posts

Re: Some analysis of the 1M most popular sites on the web

#91

Post by larrys »

andrewljohnson wrote: post #66
jacquesm wrote: post #57

Earlier quoted context omitted.

Explain to me like I'm five what features a website that hosts it's own javascript can't have versus one that loads those same javascripts from remote source?

It can't have the features that would have been built, in the time spent learning about and implementing security. I regard nearly all security for startup-class, low-user, and low-value companies to be premature optimization, which is deadly to a new project's potential.

One thing that I have seen over many many years in business is the need to decide where and when to cut corners and take chances. I have definitely seen that after the fact you could feel "geez I should have done that how stupid" but before something actually happens things aren't so clear that resources and time and money should be spent preventing something from happening.

I have noted that if I did everything perfectly (and I am not talking specifically about money) I would never have made any money at all. (Exaggeration for effect.) There are always things that you can think of that seem like a good idea and you can't do all of them. I take the time and put in the money and effort to rotate and store offsite backups. However in all of these years that has never been needed. But God knows we all are aware of a ton of small businesses living on the edge who probably don't have good onsite backups, let alone offsite and they do have information that they need.

Re: Some analysis of the 1M most popular sites on the web

#92

Post by rufugee »

puredemo wrote: post #86
rufugee wrote: post #85

Evercookies sound terrifying. Not that I'm doing anything that I really worry about hiding, but I can't stand invasion of privacy like this. Are there effective protections against them? If not, I wonder why the EFF hasn't taken up the charge to fight them?

Too many battles to wage for one fairly small organization

Then should the rest of us not step up? Or is it that there's no effective way to combat it without making major changes to browsers we have little control over? At the very least, someone could have a website which listed steps you can take to protect yourself.

Re: Some analysis of the 1M most popular sites on the web

#93

Post by schoen »

rufugee wrote: post #85

Evercookies sound terrifying. Not that I'm doing anything that I really worry about hiding, but I can't stand invasion of privacy like this. Are there effective protections against them? If not, I wonder why the EFF hasn't taken up the charge to fight them?

EFF is interested in this issue. It's one of the motivations behind our work on Panopticlick and Privacy Badger, for instance.

https://panopticlick.eff.org/

https://www.eff.org/privacybadger

We have also participated in meetings and discussions on tracking protection and lobbied browser developers about it.

The Panopticlick research shows that it's potentially difficult to impossible to detect and prevent persistent cross-site tracking in the current web platform by technical means. Even if we fixed every cookie-like mechanism so that no site can set and query state except through official HTTP cookies and subject to the user's cookie preferences, the sites might still be able to recognize the browsers by querying other navigator (and OS and plugin) properties. Tor Browser has been able to do a great job on that issue -- but at the cost of disabling a lot of web platform features that sites might expect.

Re: Some analysis of the 1M most popular sites on the web

#94

Post by euroclydon »

cbhl wrote: post #26
jacquesm wrote: post #17

Earlier quoted context omitted.

How would the closure compiler figure out what bits and pieces of the library are triggered from the html portion of the site? (I can see how it can track the javascript bits but unless your site is entirely generated from js you'd have to start with the html)

You annotate methods in Google-JS-Closure with @public, @protected, and @private in comments. Public methods get unmangled symbols. Everything else gets renamed to a short name to save bandwidth. Dependencies are specified with goog.require. Anything that doesn't get required with goog.require or isn't called by a public function gets culled.

While your integrating Closure Compiler's Advanced Mode, you might as well re-write your entire client side code... Because you'll likely have to.

Re: Some analysis of the 1M most popular sites on the web

#95

Post by schoen »

rufugee wrote: post #92
puredemo wrote: post #86

Earlier quoted context omitted.

Too many battles to wage for one fairly small organization

Then should the rest of us not step up? Or is it that there's no effective way to combat it without making major changes to browsers we have little control over? At the very least, someone could have a website which listed steps you can take to protect yourself.

You can get some benefits from EFF's Privacy Badger and from Mozilla's Tracking Protection feature.

https://support.mozilla.org/en-US/kb/tracking-protection-fir...

https://www.eff.org/privacybadger

Both of these tools are focused on cross-site ("third-party") tracking, rather than cross-session tracking by an individual site ("first-party"). Third-party tracking is technically easier to try to detect, and some people regard it as more intrusive.

As I mentioned upthread, EFF's own research on browser fingerprinting shows that it's hard to stop all user tracking (because your browser and OS and device might be different enough from others to be unique in a population in ways that could be observable by a remote site). Tor Browser is doing great work on this

https://www.torproject.org/projects/torbrowser/design/#finge...

and I think they've made concrete progress. (I think the Tor Browser developers might say that the privacy benefits of using their changes without Tor are unclear because you could also so easily be tracked by IP address. But it's possible that some of their changes will find their way into mainline Firefox, at least as options.)

Re: Some analysis of the 1M most popular sites on the web

#96

Post by larrys »

jacquesm wrote: post #90
larrys wrote: post #89

Earlier quoted context omitted.

Machines: Yes this was the 80's (sorry I didn't point that out my mistake) and things have changed. However to that point if you have your golden machine operator turning out good work (and he is only 1 of 2 on a particular line) and it's not easy to hire a replacement, let alone a good replacement, you tend to get a bit lax. Security: I am primarily a business guy (who does some light programming and knows Unix sinc…

The motto is 'trust but verify', and indeed that goes for your backups as well. And incidentally that's one of the most failed items during the dd's I've done and after verification several companies turned out to have lived without backups at all. It usually takes two things to go wrong for a disaster to happen: some $0.05 part that fails and a procedural error. And the consequences can be just about anything.

One of the first books that I read talked about the story of the backup tapes on the car seat that were erased when someone in Sweden (?) with heated seats drove home. (urban legend iirc).

Re: Some analysis of the 1M most popular sites on the web

#97

Post by Paul-ish »

jwr wrote: post #13

Likely culprits are "performance analyzers" that grade a website and report an "F" (failing) grade for not using CDN-hosted common libraries. This is a red herring: this idea that the user will already have a cached copy of CDN-hosted jQuery is bogus. Even for a common library like jQuery: the number of versions of jQuery that are in use is likely above 50, and the number of popular CDNs that host jQuery is surely ab…

>This is a red herring: this idea that the user will already have a cached copy of CDN-hosted jQuery is bogus. Even for a common library like jQuery: the number of versions of jQuery that are in use is likely above 50, and the number of popular CDNs that host jQuery is surely above 10. So we are hoping that the user will have a cached copy of that exact jQuery version from that exact CDN.

I wonder if it might be a good idea to have a hash attribute for external resources. For example, I might include jquery by including
I calculate the hash on my end. This ensures that if code.jquery.com/jquery-1.11.3.min.js is changed, the browser can know that the resource was tampered with or the developer made a mistake, and not load that resource. Also, if the browser sees a hash for a resource it has cached, it can load that cached resource, even if it is hosted at a different location. This seems better for both security and performance, but does put a slightly higher burden on the developers.

EDIT: This seems to cover what I am talking about: http://www.w3.org/TR/SRI/

Re: Some analysis of the 1M most popular sites on the web

#98

Post by jacquesm »

larrys wrote: post #96
jacquesm wrote: post #90

Earlier quoted context omitted.

The motto is 'trust but verify', and indeed that goes for your backups as well. And incidentally that's one of the most failed items during the dd's I've done and after verification several companies turned out to have lived without backups at all. It usually takes two things to go wrong for a disaster to happen: some $0.05 part that fails and a procedural error. And the consequences can be just about anything.

One of the first books that I read talked about the story of the backup tapes on the car seat that were erased when someone in Sweden (?) with heated seats drove home. (urban legend iirc).

Iirc Saab pioneered heated seats because one of their engineers had colon cancer and Saabs are pretty common in Sweden, but I'd still wager that's an urban legend because the heating is done with DC current and to reliably alter the contents of a tape you'd need a lot more of magnetic field to overcome the resistance of the magnetic particles to change direction (remanence) and you'd want that field to alternate.

Re: Some analysis of the 1M most popular sites on the web

#99

Post by cbsmith »

jwr wrote: post #13

Likely culprits are "performance analyzers" that grade a website and report an "F" (failing) grade for not using CDN-hosted common libraries. This is a red herring: this idea that the user will already have a cached copy of CDN-hosted jQuery is bogus. Even for a common library like jQuery: the number of versions of jQuery that are in use is likely above 50, and the number of popular CDNs that host jQuery is surely ab…

Check your browser cache sometime. You no doubt have most of the CDN-hosted jQuery's in your cache. You also probably have hundreds of copies of Closure compiled jQuery. ;-)

Re: Some analysis of the 1M most popular sites on the web

#100

Post by cbsmith »

xorcist wrote: post #77
pyre wrote: post #60

Earlier quoted context omitted.

> These days using them is pretty much pointless and incurs a performance penalty, yet everybody still uses them. Would you rather than when (e.g.) there is a security patch for OpenSSL, that you have to wait for all software using OpenSSL to deploy updates? Or would you rather that one update to OpenSSL (likely from your OS vendor) fixes all of the software depending on it? Edit: People seem to be commenting to this…

Google doesn't back-port fixes to JQuery. You can link without specifying the version number, but then you don't get full caching, so it's not common in practice.

You get pretty close to full caching... often better than using your own copy. The reason it isn't a common practice is more about potential bugs caused by newer versions.
Post reply on HN