4 ms·
Facebook creates preview photos that are just 200 Bytes for fast mobile loading
- mtmail 11y agoduplicate of https://news.ycombinator.com/item?id=10020840 https://news.ycombinator.com/item?id=10020840
- slyall 11y agoWeird. the URLs seems to be exactly the same. Wonder why the dup detector didn't complain
- applecore 11y agoGraphQL doesn't transfer raw bytes, so they would save the 33% overhead if they weren't using Base64 binary-to-text encoding.
- laurencerowe 11y agoGzip content encoding recovers most of the overhead.
- imrehg 11y agoExcept they shouldn't really use Gzip if they are also using HTTPS.... See http://stackoverflow.com/a/4063496/171237 http://stackoverflow.com/a/4063496/171237 or look up BREACH and CRIME.
- duskwuff 11y agoBREACH/CRIME aren't a huge concern here. Unlike in a web browser, an attacker can't cause a user's browser to fire off crafted requests (because they're only occurring in the Facebook app, which doesn't let third-party scripts run), and they can't easily observe the size of requests and responses (because they're all happening over a cellular network, which is difficult to sniff).
- imrehg 11y agoRunning inside the app is probably the strongest argument here, though I think that's also kinda assuming that people cannot subvert the app in unexpected ways. The size of requests can still be observed e.g. being on Wifi - people don't just use their Smartphone from the cellular network. My thinking is that while in this case it's "probably safe" to use Gzip + HTTPS, but that's not a good practice to build secure systems. If e.g. here these requests are exempted and run to Gzip, the reasons and circumstances for doing it here will be forgotten, and can end up with other stuff exempted later which shouldn't. Just from experience how things work in large orgs.
- mtgx 11y ago"Good thing" they aren't using HTTPS for Internet.org then.
- caseyf7 11y agoDo they do this on the web too or just the native app?
- nitrogen 11y agoI suppose it could be done on the web by sending the fixed JPEG header in a JS file that would be cached, then crafting data: URLs on the fly.
- deleted 11y ago[deleted]