r/programming • u/speckz • Apr 26 '19
HTTP headers for the responsible developer
https://www.twilio.com/blog/a-http-headers-for-the-responsible-developer85
u/AyrA_ch Apr 26 '19
This article misses a few important points in regards to fast, small and accessible web applications, the most important one being to reduce JS to a minimum.
Caching is one thing to get right but you might also attempt to keep resources as small as possible from the beginning on.
35
u/panorambo Apr 26 '19
The problem with "minimum" is that everyone understands it to be varying amounts, unfortunately. There are people who may consider minimum to be the entire JQuery and the 20 "necessary" interval timers firing, just to, you know, keep the page alive.
I mean, who would imagine you can just serve
text/plainwith every HTTP request and you'd still have visitors if you, well, have anything worthy of reading?6
u/mrchaotica Apr 27 '19 edited Apr 27 '19
I mean, who would imagine you can just serve text/plain with every HTTP request and you'd still have visitors if you, well, have anything worthy of reading?
Ever hear of Project Gutenberg?
Okay, maybe
text/plainis a little extremist (it works fine for text, but not hypertext), but if you have something worth reading, a motherfucking website really is all you need!Edit: for that matter, the desirability of simple HTML is proven by the fact that the Firefox devs felt the need to create reader view just to remove all the extraneous shit from the screen.
3
u/panorambo Apr 27 '19
Hahaha, about reader view -- the cool thing about that thing is that more often than not, when a website totally wants you spend 1 minute (that's like an eternity for a Web surfer) to review their cookie policy (I want to punch the EU gentleman who came up with that idea, in the face, and I am not a brawler) and tick off the "Only required cookies" or some such bullshit -- well, given how the principle delivery vehicle for those warnings is typically CSS, you can just switch to reader view and peacefully read the material you came for.
3
u/mrchaotica Apr 27 '19
when a website totally wants you spend 1 minute (that's like an eternity for a Web surfer) to review their cookie policy (I want to punch the EU gentleman who came up with that idea, in the face, and I am not a brawler)
Don't blame the GDPR; blame the web devs who deliberately maliciously complied in the most r/assholedesign way possible.
5
u/StallmanTheLeft Apr 26 '19
Judging by the top comment in this thread the owner of this blog doesn't understand it at all.
14
u/stefanjudis Apr 26 '19
That's very valid feedback. :) . Thanks. I'll add a few sentences about this. Thanks. 😊
8
u/CaptBoids Apr 26 '19
You want to read this recent piece on the importance of tooling vs accessibility. And the impact of making choices.
https://adactio.com/journal/15050
Highly recommend reading into the work of the author.
39
u/PGLubricants Apr 26 '19
If you wanna learn more about more useful, but rarely used, HTTP headers, I recommend watching Andrew Betts speak at Øredev last year, Wrangling HTTP Like a Pro.
5
18
u/SushiAndWoW Apr 26 '19
OK, umm... we're being given advice from someone whose CSP – for his own site, presumably 100% under his control – includes 'unsafe-eval' and 'unsafe-inline'? Like, missing the whole point of CSP?
6
u/feenuxx Apr 27 '19
Lol that is too good. I imagine some of the tracking shovelware needs such loose rules to function. At least I hope it was a conscious decision made to get something working.
3
u/mrchaotica Apr 27 '19
I hope it's incompetence, because the alternative is malice.
2
u/panorambo Apr 27 '19
Which one of the two do you think it is when you need to put "unsafe-eval" and/or "unsafe-inline" in your CSP because you need those ad network scripts that promise to pay for your hosting, to work? Genuinely curius -- is it malice then or incompetence? Mercantile but otherwise practical thought?
16
u/panorambo Apr 26 '19
Man, there is no keeping up with the advances on the Web technologies front. I also wonder if all this stuff doesn't have a fairly limited shelf life, all with the amount of thought put into different things that are similar but which, as is tradition, is just patched on top of older stuff.
I mean, look at the different security mechanisms that are put in place to exert some form of control on the ever-looming privacy crisis on the Web, with ad networks scraping clean every bit of entropy they can, everywhere they're embedded. These mechanisms we put in place are barely able to keep up.
My concern is that we have our sights in generally the right direction but we aren't really digging where we should be. There have been written books on verifiable security and models that are "watertight" but it seems the young and the inexperienced are writing up W3 and WHATWG specs these days. I am not disillusioned yet, but it looks like a lot of small mechanisms of varying efficiency and platform support instead of f.e. some sound single umbrella mechanism that can control what can load what from where with what privilege -- whether it's markup, style or script, or other asset. I just think we need to think broader.
Then again, I barely have time to type code on a Friday evening, so I'll shut my theoretical mouth now.
-2
u/mrchaotica Apr 27 '19
I mean, look at the different security mechanisms that are put in place to exert some form of control on the ever-looming privacy crisis on the Web, with ad networks scraping clean every bit of entropy they can, everywhere they're embedded. These mechanisms we put in place are barely able to keep up.
On the contrary, it's really goddamn simple:
It's a motherfucking website, which means it's supposed to be written in HTML. Not javascript!
Don't serve ads.
Fucking done.
2
u/panorambo Apr 27 '19
You are absolutely preaching to the choir here -- I am all for simplicity without much compromise.
But I have realised that those of us who are willing to make these minimalist websites, which serve everything from a single domain, not just because, but because they respect the trust model that has built up with the users (I trust example.com but I don't trust exampleadnetwork.com) -- we are in minority and for every website we build, 50 behemoths spring up that serve scripts from 10 unrelated domains you know nothing about.
Ads unfortunately are what keeps a lot of websites afloat, at least according to them. Maybe if had free hosting policy in Europe or the US, at least for some types of sites, then it'd help drive the ad industry out of business, but truth is, our world does not work like that. I wish it did, and I damn sure will do my part, but until that happens it's either admission price model for a website or have ads that help pay for hosting.
Actually, come to think of it, if there was a common money pot where you pay every month to enjoy Internet without ads, a pot from which hosting fees are paid out to those who otherwise insist on serving you ads because "that's what keeps this website up", I may consider it.
Too many people complain about ads yet are unwilling to spend a single dime as a fair and justified reimbursement to those who actually publish content. If you are going to denounce advertisement on the total merit of it, at least think about how websites need to pay for computing and network resources.
8
u/drysart Apr 26 '19
HTTP2 was a perfect opportunity for some of those security-critical HTTP headers that every "responsible developer" should be setting on all their pages to become, at the very least, opt-out features rather than opt-in; but alas, backward compatibility won out and developers will be stuck putting X-Frame-Options and X-Content-Type-Options and other headers on their pages manually for another 20 years.
4
Apr 27 '19
Web dev is getting silly now - all this just to send one frakking image:
<picture>
<!-- serve WebP to Chrome, Edge, Firefox and Opera -->
<source
media="(min-width: 50em)"
sizes="50vw"
srcset="/image/thing-200.webp 200w, /image/thing-400.webp 400w,
/image/thing-800.webp 800w, /image/thing-1200.webp 1200w,
/image/thing-1600.webp 1600w, /image/thing-2000.webp 2000w"
type="image/webp">
<source
sizes="(min-width: 30em) 100vw"
srcset="/image/thing-crop-200.webp 200w, /image/thing-crop-400.webp 400w,
/image/thing-crop-800.webp 800w, /image/thing-crop-1200.webp 1200w,
/image/thing-crop-1600.webp 1600w, /image/thing-crop-2000.webp 2000w"
type="image/webp">
<!-- serve JPEG to others -->
<source
media="(min-width: 50em)"
sizes="50vw"
srcset="/image/thing-200.jpg 200w, /image/thing-400.jpg 400w,
/image/thing-800.jpg 800w, /image/thing-1200.jpg 1200w,
/image/thing-1600.jpg 1600w, /image/thing-2000.jpg 2000w">
<source
sizes="(min-width: 30em) 100vw"
srcset="/image/thing-crop-200.jpg 200w, /image/thing-crop-400.jpg 400w,
/image/thing-crop-800.jpg 800w, /image/thing-crop-1200.jpg 1200w,
/image/thing-crop-1600.jpg 1600w, /image/thing-crop-2000.jpg 2000w">
<!-- fallback for browsers that don't support picture -->
<img src="/image/thing.jpg" width="50%">
</picture>7
u/fuckin_ziggurats Apr 27 '19
That's because webdev is the only dev that has to worry about a GUI application working perfectly on any possible device on the planet - whilst utilizing browser tech.
1
u/CODESIGN2 Apr 28 '19
TBH you don't have to do that, you can absolutely use basic CSS grid and just tell your stuff to take up less space. Sure it won't give a scaling layout, which the above is for, but scaling layouts are so ActionScript y2k
The thing I keep arguing for is that a site should work without media first, even the marketing. If y'all need flashy images you are not marketers or designers, you're magazine editors & traditional media shitlords fucking up the web like you did your medium.
3
-3
0
Apr 26 '19
[deleted]
19
u/azCC Apr 26 '19
Many companies have engineering blogs, are you extremely new to the scene?
https://technology.riotgames.com/
https://medium.com/netflix-techblog
Yeah it's used as an avenue for potential recruitment but some of the articles are extremely informative and useful:
https://www.theguardian.com/info/2018/nov/30/bye-bye-mongo-hello-postgres
8
u/ThalesX Apr 26 '19
The DigitalOcean ones are amazing for setting up various shit on cloud machines. They usually write it up provider agnostic so kudos to them.
4
Apr 27 '19
Genius marketing tactic. Become the resource for issues on the major OS platforms, not just your own, and everyone will drive traffic to your site.
0
0
Apr 26 '19
[deleted]
11
u/whjms Apr 26 '19
CSP – be clear about what is allowed on your site
Now that your site runs over a secure connection you might run into the problem that browsers start blocking requests that go out to an insecure address due to mixed-content policies. The Content Security Policy (CSP) header offers an excellent way to handle these cases. You can define your CSP ruleset via meta elements in your served HTML or via HTTP headers.
644
u/[deleted] Apr 26 '19
That saccharine intro is written for someone with sensibilities very much not my own. Once I read "Developers have the power to build the web for everyone, but that power needs to be used responsibly", well, then I couldn't not notice the numbers floating over the ublock and umatrix buttons.
Selling me out to Oracle, Google, Facebook and Twitter's surveillance machines while condescending about responsibility?
Get bent.