5 ms·

>And then - because not bundled - all the modules that will be used on another page will be cached already. Why isn't anyone else mentioning this feature? I'm

by catern 5y ago

>And then - because not bundled - all the modules that will be used on another page will be cached already. Why isn't anyone else mentioning this feature? I'm not a browser developer but this seems like a clear win, and indeed makes bundling unnecessary. I'm assuming that it's shared between domains, too - or are people's dependencies so fragmented that there's basically no sharing between domains?

qudat 5y ago
We already do this with a build step using a vendor bundle and an app bundle and it can be configured to create a bundle for each page.
forty 5y ago
In practice I think downloading many small files is actually slower than a single bigger file. It might not be so true today with http2 for example though.
- acdha 5y ago
  HTTP/2 definitely changed that and is near-universally supported now. The biggest win is the ability to cache things independently: with bundles your servers and clients have to retransfer everything if a single byte changes, and most of the sites I’ve worked on don’t change most of their files every time they ship an update. A cold visit will usually be immeasurably different from a bundle but a warm visit is noticeably faster.
- kevingadd 5y ago
  Yes, it's much slower pre-http2 since no modern browser actually does pipelining, so it's going to be a socket per file HTTP2 fixes this by allowing multiple requests to occur in parallel on a single connection.
  - forty 5y ago
    In the specific case of JS import, it's still going to be pretty bad though, I guess, since you have to download a file, parse it to figure out the deps, then fetch them, parse them, etc, so you are limited in what you can do in parallel.
    - eyelidlessness 5y ago
      That’s what `modulepreload` &co is for. It’s a shame HTTP Push is dead, it was a much more general solution. But specifically for web pages the solution is more or less the same + 1 round trip (you won’t get the benefits of “push” until you at least process all the head>meta tags).
simonw 5y ago
I believe sharing cached code between domains has been almost entirely eliminated by browsers now, because it turned out to be a huge privacy leak: a malicious domain could attempt to load code that was used by another domain, time how long it took to load and use that to determine if the user had visited that other site. Browsers fixed this by making the browser cache no longer shared between domains.
- catern 5y ago
  Hm, I wonder if this could be circumvented by doing timing attacks against the CDN cache? That's still shared between domains...
  - jakelazaroff 5y ago
    It is not: https://developers.google.com/web/updates/2020/10/http-cache-partitioning https://developers.google.com/web/updates/2020/10/http-cache... https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...
    - catern 5y ago
      That's the cache in the browser, not the cache in the CDN.
      - jakelazaroff 5y ago
        Oh, I see what you’re saying. How could that possibly be exploited for a side channel attack, though? All it would tell an attacker is that someone requested the file before.
tofflos 5y ago
The cache used to be shared between domains but that's no longer the case due to privacy concerns and limited effectiveness. > As of Firefox v85 and Chrome v86 the browser cache will be partitioned, this means that the same resource included on two sites will have to be downloaded from the internet twice and cached separately. Source https://www.peakhour.io/blog/cache-partitioning-firefox-chrome https://www.peakhour.io/blog/cache-partitioning-firefox-chro....
- acdha 5y ago
  This still helps other requests to the same origin, which is a very common situation if you don’t have the extra resources needed to get an SPA up to the same performance and reliability levels.

by catern 5y ago

qudat 5y ago

We already do this with a build step using a vendor bundle and an app bundle and it can be configured to create a bundle for each page.

forty 5y ago

In practice I think downloading many small files is actually slower than a single bigger file. It might not be so true today with http2 for example though.

acdha 5y ago
HTTP/2 definitely changed that and is near-universally supported now. The biggest win is the ability to cache things independently: with bundles your servers and clients have to retransfer everything if a single byte changes, and most of the sites I’ve worked on don’t change most of their files every time they ship an update. A cold visit will usually be immeasurably different from a bundle but a warm visit is noticeably faster.
kevingadd 5y ago
Yes, it's much slower pre-http2 since no modern browser actually does pipelining, so it's going to be a socket per file HTTP2 fixes this by allowing multiple requests to occur in parallel on a single connection.
- forty 5y ago
  In the specific case of JS import, it's still going to be pretty bad though, I guess, since you have to download a file, parse it to figure out the deps, then fetch them, parse them, etc, so you are limited in what you can do in parallel.
  - eyelidlessness 5y ago
    That’s what `modulepreload` &co is for. It’s a shame HTTP Push is dead, it was a much more general solution. But specifically for web pages the solution is more or less the same + 1 round trip (you won’t get the benefits of “push” until you at least process all the head>meta tags).

simonw 5y ago

I believe sharing cached code between domains has been almost entirely eliminated by browsers now, because it turned out to be a huge privacy leak: a malicious domain could attempt to load code that was used by another domain, time how long it took to load and use that to determine if the user had visited that other site. Browsers fixed this by making the browser cache no longer shared between domains.

catern 5y ago
Hm, I wonder if this could be circumvented by doing timing attacks against the CDN cache? That's still shared between domains...
- jakelazaroff 5y ago
  It is not: https://developers.google.com/web/updates/2020/10/http-cache-partitioning https://developers.google.com/web/updates/2020/10/http-cache... https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...
  - catern 5y ago
    That's the cache in the browser, not the cache in the CDN.
    - jakelazaroff 5y ago
      Oh, I see what you’re saying. How could that possibly be exploited for a side channel attack, though? All it would tell an attacker is that someone requested the file before.

tofflos 5y ago

The cache used to be shared between domains but that's no longer the case due to privacy concerns and limited effectiveness. > As of Firefox v85 and Chrome v86 the browser cache will be partitioned, this means that the same resource included on two sites will have to be downloaded from the internet twice and cached separately. Source https://www.peakhour.io/blog/cache-partitioning-firefox-chrome https://www.peakhour.io/blog/cache-partitioning-firefox-chro....

acdha 5y ago
This still helps other requests to the same origin, which is a very common situation if you don’t have the extra resources needed to get an SPA up to the same performance and reliability levels.