13 ms·

So basically Twitter wasn't setting its Cache-Control directive correctly? Why is this behavior different from Safari and Chrome? It looks like "no-store" is i

So basically Twitter wasn't setting its Cache-Control directive correctly? Why is this behavior different from Safari and Chrome? It looks like "no-store" is in this IETF RFC: https://tools.ietf.org/html/rfc7234#section-5.2.2 https://tools.ietf.org/html/rfc7234#section-5.2.2 EDIT - Ah, I see, it's in the original post: > Testing from Twitter showed that the request was not being cached in other browsers. This is because some other browsers disable heuristic caching if an unrelated HTTP header, Content-Disposition, is present. Content-Disposition is a feature that allows sites to identify content for download and to suggest a name for the file to save that content to. > In comparison, Firefox legitimately treats Content-Disposition as unrelated and so does not disable heuristic caching when it is present. It looks like Twitter only tested this in Safari and Chrome and called it a day. Their wording implies that it's Firefox's fault, which is misleading.

saagarjha 7y ago
> This is because some other browsers disable heuristic caching if an unrelated HTTP header, Content-Disposition, is present.
badrabbit 7y ago
I have fuming anger over the whole world deciding Google will set the standard for browsers. I wonder if EFF and similar orgs are doing anything legally, perhaps EU can armtwist again?
- cortesoft 7y ago
  What would the legal issue be, exactly? Twitter is the one deciding to code against chrome’s features, not google.
  - badrabbit 7y ago
    Regulating browser standards so that a commercial org can't publish browsers that don't comply. Much like how cars are regulated to be "road legal".
    - detaro 7y ago
      Both Chrome and Firefox behave correctly according to the relevant standard.
    - scarface74 7y ago
      So now we want the government to define what can be defined as a browser? So what is this government agency that has the technical wherewithal to “regulate browsers”? What’s going to happen when someone decides that browsers must have content restrictions? It amazes me how willing some people on HN just willingly give up their freedom to the government.
      - jonathankoren 7y ago
        >So what is this government agency that has the technical wherewithal to “regulate browsers”? NIST for one.
        scarface74 7y ago
        You really trust NIST to know the intricacies of creating a browser? Besides, hasn’t the last few years shown you what happens when you have government organizations led by people who aren’t experts but who are appointed for political reasons? Even when you do have competent people in the government like in the CDC, they are still hamstrung by the ideology of the executive branch.
        badrabbit 7y ago
        Yes. Have you ever read a NIST standard?
        scarface74 7y ago
        So before Apple, Google, and Mozilla release a browser they should have to go through an approval process?
- oefrha 7y ago
  https://tools.ietf.org/html/rfc7234#section-4.2.2 https://tools.ietf.org/html/rfc7234#section-4.2.2 Since origin servers do not always provide explicit expiration times, a cache MAY assign a heuristic expiration time when an explicit time is not specified, employing algorithms that use other header field values (such as the Last-Modified time) to estimate a plausible expiration time. This specification does not provide specific algorithms, but does impose worst-case constraints on their results. The standard does not say what heuristics should be used, so Firefox’s heuristics is no more “legitimate” than Chorme/Safari’s heuristics of expiring immediately when Content-Dispostion is present. “Firefox legitimately treats...” is highly misleading, making it sound like Firefox is more standard-compliant, but it’s not; it’s just different.
  - detaro 7y ago
    And it's allowed to treat it differently than the other browsers. That's what "legitimately" means. And that needs to be pointed out, because Twitter was very careful to avoid saying it wasn't a Firefox bug.
  - SpaceNugget 7y ago
    I am fairly confident that the article is not trying to imply that Chrome/Safari are NOT standards compliant. The author seems to be trying to heavily emphasize that this is not a Firefox bug, and that Firefox can legitimately do this while being standards compliant. I feel like the author was anticipating a lot of people blaming Firefox for this incident, and is attempting to shut those responses before they get made. I think that trying to write to the responses you expect from your audience unfortunately ends up with these kinds of miscommunications of intention more often than not.
    - faitswulff 7y ago
      Twitter explicitly blamed Firefox for the behavior, so the anticipation is warranted.
  - notRobot 7y ago
    Please don't use code blocks for quotes. It makes it very hard to read text on mobile, narrow viewports or via screen readers.
- jefftk 7y ago
  Since this handling of Content-Disposition is also in Safari it likely predates Google's involvement, and might even go all the way back to KHTML. (Disclosure: I work for Google)
  - dblohm7 7y ago
    Mozilla dev here, I’ve been told that Gecko’s behaviour matches IE’s and Netscape’s.
- detaro 7y ago
  Google hasn't decided a standard here. It just happened to be the case that their heuristic avoided the problem here, so Twitters bug only caused a potential problem for Firefox.
  - Vinnl 7y ago
    I don't think GP meant that Google decided a standard, but that the world (and in this case, Twitter) decided that whatever Google does is considered the standard. In other words, rather than checking with the standard how to indicate that content should not be cached, they simply checked whether Chrome did not cache it, and since it didn't, decided that whatever they were doing was the way to prevent caching.
    - badrabbit 7y ago
      Yes, that is what I meant.
    - deleted 7y ago
      [deleted]
detaro 7y ago
I suspect they didn't test for it at all, noticed later or got a report, and then checked which browsers are affected.
cortesoft 7y ago
They should have absolutely added a no-store cache directive. It is crazy that they didn’t and instead just checked if browsers cached it or not. To rely on undocumented behavior when there is a specific documented way to do what you want is just bizarre.
- DangitBobby 7y ago
  I wouldn't even be so sure that they tested caching behavior in any browser.
- dathinab 7y ago
  Sure, but now look at general HTTP API's and see how many set any kind of Cache header. I wouldn't be surprised if _many_ API's used by (Phone)Apps and a (Web)App do not do so and might leak private data into the cache, maybe even secret keys or one-time tokens like recovery codes.

saagarjha 7y ago

> This is because some other browsers disable heuristic caching if an unrelated HTTP header, Content-Disposition, is present.

badrabbit 7y ago

I have fuming anger over the whole world deciding Google will set the standard for browsers. I wonder if EFF and similar orgs are doing anything legally, perhaps EU can armtwist again?

cortesoft 7y ago
What would the legal issue be, exactly? Twitter is the one deciding to code against chrome’s features, not google.
- badrabbit 7y ago
  Regulating browser standards so that a commercial org can't publish browsers that don't comply. Much like how cars are regulated to be "road legal".
  - detaro 7y ago
    Both Chrome and Firefox behave correctly according to the relevant standard.
  - scarface74 7y ago
    So now we want the government to define what can be defined as a browser? So what is this government agency that has the technical wherewithal to “regulate browsers”? What’s going to happen when someone decides that browsers must have content restrictions? It amazes me how willing some people on HN just willingly give up their freedom to the government.
    - jonathankoren 7y ago
      >So what is this government agency that has the technical wherewithal to “regulate browsers”? NIST for one.
      - scarface74 7y ago
        You really trust NIST to know the intricacies of creating a browser? Besides, hasn’t the last few years shown you what happens when you have government organizations led by people who aren’t experts but who are appointed for political reasons? Even when you do have competent people in the government like in the CDC, they are still hamstrung by the ideology of the executive branch.
        badrabbit 7y ago
        Yes. Have you ever read a NIST standard?
        scarface74 7y ago
        So before Apple, Google, and Mozilla release a browser they should have to go through an approval process?
oefrha 7y ago
https://tools.ietf.org/html/rfc7234#section-4.2.2 https://tools.ietf.org/html/rfc7234#section-4.2.2 Since origin servers do not always provide explicit expiration times, a cache MAY assign a heuristic expiration time when an explicit time is not specified, employing algorithms that use other header field values (such as the Last-Modified time) to estimate a plausible expiration time. This specification does not provide specific algorithms, but does impose worst-case constraints on their results. The standard does not say what heuristics should be used, so Firefox’s heuristics is no more “legitimate” than Chorme/Safari’s heuristics of expiring immediately when Content-Dispostion is present. “Firefox legitimately treats...” is highly misleading, making it sound like Firefox is more standard-compliant, but it’s not; it’s just different.
- detaro 7y ago
  And it's allowed to treat it differently than the other browsers. That's what "legitimately" means. And that needs to be pointed out, because Twitter was very careful to avoid saying it wasn't a Firefox bug.
- SpaceNugget 7y ago
  I am fairly confident that the article is not trying to imply that Chrome/Safari are NOT standards compliant. The author seems to be trying to heavily emphasize that this is not a Firefox bug, and that Firefox can legitimately do this while being standards compliant. I feel like the author was anticipating a lot of people blaming Firefox for this incident, and is attempting to shut those responses before they get made. I think that trying to write to the responses you expect from your audience unfortunately ends up with these kinds of miscommunications of intention more often than not.
  - faitswulff 7y ago
    Twitter explicitly blamed Firefox for the behavior, so the anticipation is warranted.
- notRobot 7y ago
  Please don't use code blocks for quotes. It makes it very hard to read text on mobile, narrow viewports or via screen readers.
jefftk 7y ago
Since this handling of Content-Disposition is also in Safari it likely predates Google's involvement, and might even go all the way back to KHTML. (Disclosure: I work for Google)
- dblohm7 7y ago
  Mozilla dev here, I’ve been told that Gecko’s behaviour matches IE’s and Netscape’s.
detaro 7y ago
Google hasn't decided a standard here. It just happened to be the case that their heuristic avoided the problem here, so Twitters bug only caused a potential problem for Firefox.
- Vinnl 7y ago
  I don't think GP meant that Google decided a standard, but that the world (and in this case, Twitter) decided that whatever Google does is considered the standard. In other words, rather than checking with the standard how to indicate that content should not be cached, they simply checked whether Chrome did not cache it, and since it didn't, decided that whatever they were doing was the way to prevent caching.
  - badrabbit 7y ago
    Yes, that is what I meant.
  - deleted 7y ago
    [deleted]

detaro 7y ago

I suspect they didn't test for it at all, noticed later or got a report, and then checked which browsers are affected.

cortesoft 7y ago

They should have absolutely added a no-store cache directive. It is crazy that they didn’t and instead just checked if browsers cached it or not. To rely on undocumented behavior when there is a specific documented way to do what you want is just bizarre.

DangitBobby 7y ago
I wouldn't even be so sure that they tested caching behavior in any browser.
dathinab 7y ago
Sure, but now look at general HTTP API's and see how many set any kind of Cache header. I wouldn't be surprised if _many_ API's used by (Phone)Apps and a (Web)App do not do so and might leak private data into the cache, maybe even secret keys or one-time tokens like recovery codes.