6 ms·

I really, really wish it were possible for wasm modules like this to be shared between sites. That is, python.org could host an official wasm module, and the fi

I really, really wish it were possible for wasm modules like this to be shared between sites. That is, python.org could host an official wasm module, and the first time you visited a site using python the browser would download and compile it once and cache the result, and then any other website could use python with no download size or load time penalty. But unfortunately privacy concerns killed this utopia. Caches are now partitioned per origin, so every site that uses python has to download and compile the wasm module separately even if it's the exact same module from the same place, and that is unlikely to ever change: https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/

cgb223 5y ago
Couldn’t browsers theoretically “bake in” the python.org binary to the browser itself to avoid this? Kind of like how macOS (used to) ship with python preinstalled?
- kumarvvr 5y ago
  Yes. It absolutely can. And it would be even more efficient than using WASM. However, I guess adding a new language would introduce a lot of security issues and what not.
- toastal 5y ago
  If browsers already have a multi-paradigm, dynamic/duck-typed, garbage-collected scripting language in JavaScript, why would they add another one--especially since JS is incredibly backwards-compatible to not break the web? In the broader scope of programming languages, Python and JS are the same thing. If their going to add a second language, the least they could do is make it interesting in comparison.
  - nine_k 5y ago
    On top of it, JS is significantly faster.
    - bb88 5y ago
      Faster than what? JS was considerably slow until Google decided to spend resources to make it faster.
      - nine_k 5y ago
        Current standard JS runtimes (e.g. V8) are faster than current standard Python runtimes (such as CPython). Not that Python can't be made faster (though many architectural decisions of the language resist it), but it hasn't been so far, so there's little incentive to include it to a browser. It gives too little new capabilities, on top of JS. OTOH, say, WASM gave many new capabilities, and has been included.
  - bb88 5y ago
    Javascript will be 30 years old in 3 years. It's been successful, sure, but it's also been controversial and a lot of language mistakes have had to be carried forward. The 5 minute "wat" talk still lingers in my head about those basic mistakes. "Oh they fixed that in Typescript." But they could have fixed it with practically any other language as well.
    - deleted 5y ago
      [deleted]
    - asiachick 5y ago
      The Wat talk is mostly BS for laughs. It's hilarious but to someone familiar with the language it's a bunch of stuff you'd mostly never run into. Some are even outdated. Like he makes fun of the fact that Array(16).toString() prints 15 commas. In the context of the talk it's funny but in reality, what would you expect. You made a array with 16 empty elements. Array.toString() calls toString() on each element and separates them by commas. Why is that unexpected? He then shows Array(16).join("wat") which is the same as the previous except JS uses "wat" between elements instead of "," "wat" + 1 is string + number coerced to string so string + string. string + is defined as concatenation "wat" - 1. There is no override for - for a string so numeric minus tries to add a string to a number and returns NaN. Ok, why is that unexpected? When will this bite you. You shouldn't be adding numbers to string or strings to numbers. I've been programming JS for ~20 years, I don't remember running into any of these issues. I've also never tries to add to arrays, add an object and an array, add an array and an object, nor add 2 objects. It's funny that the language does something but so what. You wanna talk about a language that sucks try bash. Meanwhile I've had no problems shipping 100s of projects in JS. (also, C, C++, C#, perl, python, assembly, others)
    - lenkite 5y ago
      > Javascript will be 30 years old in 3 years Python is already >31 years old.. Python is even older than Java. It is so slow - can barely crawl compared to other languages. Maybe we should retire grand-daddy Python ?
      - bb88 5y ago
- liftm 5y ago
  This is what https://decentraleyes.org/ https://decentraleyes.org/ does, right?
xpressvideoz 5y ago
Wait, so the traditional "use the JavaScript CDN as a cross-site cache" method does not work anymore? How did I not know that!
- simonw 5y ago
  It was a huge privacy hole: malicious pages could measure how long it took for URLs to load and use that to tell which other sites you had visited in the past.
  - colordrops 5y ago
    Weren't the shared libraries used on countless sites though? How would this work?
    - TOMDM 5y ago
      Because you'd make your own library used exclusively for tracking, or check to see if another site specific set of resources had been loaded.
    - modeless 5y ago
      Yes but each site uses a lot of libraries too. The set of libraries and specific versions of those libraries used by a site is a pretty good fingerprint.
      - colordrops 5y ago
        Still doesn't make sense - there is only a single set of libraries - the ones cached by a user's browser, and since each library in that set is used by thousands of sites, there's no way to know which site it was cached for. For each version, there are certainly thousands of sites using it. Since I'm still not getting it, perhaps you could explain how a particular set of libraries is fingerprinted?
        dmurray 5y ago
krapp 5y ago
That page says there's a model for shared libraries being considered, so maybe there's hope.
deleted 5y ago
[deleted]
skybrian 5y ago
I wonder if a browser vendor could host a repository of common libraries? With a limited number of versions available that changes only at the same time as the browser, maybe it wouldn't leak much info. It would be almost like including the code in the browser.
- bb88 5y ago
  Isn't that almost like all browsers including a language with the browser?
  - nine_k 5y ago
    It is, except the feature is downloaded on demand. Users need to trust the browser's producer anyway.
- zodiakzz 5y ago
  How could this go wrong - Bill Gates
bitpow 5y ago
You’re basically describing the old Java plugin paradigm.
nine_k 5y ago
While I understand how finding a particular unique resource cached may allow to glean some privacy-infringing info, I don't see how detecting a common library downloaded from a site that provides it for everyone (like python.org) would help reveal anything. If users might define a list of sites trusted for cross-site caching (like fonts.google.com and other known library CDNs), this could help cache quite some common resources without downsides to user's privacy.
- berkes 5y ago
  But then those 'common trusted sites' can spy on users massively. fonts.google.com is, after google analytics, the most effective spyware around today.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
- remorses 5y ago
  The problem is that you can identify people by checking what resources they have already cached
froh 5y ago
You'd need trusted providers, and a mechanism to 'import' a trusted something into your 'domain'. What am I missing?
fnord123 5y ago
While I get you point, I think it's of limited usefulness for Python. You would end up with Snekr.io using 3.11 and cheeseshoppr.ws using Python 3.8.4 and etc. You can get some packages for any Python3 but they are the smaller ones. The larger wheels like numpy and pandas have C code which needs to be compiled or there's a giant version dependent wheel. Server side Python is often deployed in a venv which has the desired python version and all the dependencies copied with the code.
- asah 5y ago
  the caching sites would host a small number of versions and the publishers would be motivated to select from among them.

cgb223 5y ago

Couldn’t browsers theoretically “bake in” the python.org binary to the browser itself to avoid this? Kind of like how macOS (used to) ship with python preinstalled?

kumarvvr 5y ago
Yes. It absolutely can. And it would be even more efficient than using WASM. However, I guess adding a new language would introduce a lot of security issues and what not.
toastal 5y ago
If browsers already have a multi-paradigm, dynamic/duck-typed, garbage-collected scripting language in JavaScript, why would they add another one--especially since JS is incredibly backwards-compatible to not break the web? In the broader scope of programming languages, Python and JS are the same thing. If their going to add a second language, the least they could do is make it interesting in comparison.
- nine_k 5y ago
  On top of it, JS is significantly faster.
  - bb88 5y ago
    Faster than what? JS was considerably slow until Google decided to spend resources to make it faster.
    - nine_k 5y ago
      Current standard JS runtimes (e.g. V8) are faster than current standard Python runtimes (such as CPython). Not that Python can't be made faster (though many architectural decisions of the language resist it), but it hasn't been so far, so there's little incentive to include it to a browser. It gives too little new capabilities, on top of JS. OTOH, say, WASM gave many new capabilities, and has been included.
- bb88 5y ago
  Javascript will be 30 years old in 3 years. It's been successful, sure, but it's also been controversial and a lot of language mistakes have had to be carried forward. The 5 minute "wat" talk still lingers in my head about those basic mistakes. "Oh they fixed that in Typescript." But they could have fixed it with practically any other language as well.
  - deleted 5y ago
    [deleted]
  - asiachick 5y ago
    The Wat talk is mostly BS for laughs. It's hilarious but to someone familiar with the language it's a bunch of stuff you'd mostly never run into. Some are even outdated. Like he makes fun of the fact that Array(16).toString() prints 15 commas. In the context of the talk it's funny but in reality, what would you expect. You made a array with 16 empty elements. Array.toString() calls toString() on each element and separates them by commas. Why is that unexpected? He then shows Array(16).join("wat") which is the same as the previous except JS uses "wat" between elements instead of "," "wat" + 1 is string + number coerced to string so string + string. string + is defined as concatenation "wat" - 1. There is no override for - for a string so numeric minus tries to add a string to a number and returns NaN. Ok, why is that unexpected? When will this bite you. You shouldn't be adding numbers to string or strings to numbers. I've been programming JS for ~20 years, I don't remember running into any of these issues. I've also never tries to add to arrays, add an object and an array, add an array and an object, nor add 2 objects. It's funny that the language does something but so what. You wanna talk about a language that sucks try bash. Meanwhile I've had no problems shipping 100s of projects in JS. (also, C, C++, C#, perl, python, assembly, others)
  - lenkite 5y ago
    > Javascript will be 30 years old in 3 years Python is already >31 years old.. Python is even older than Java. It is so slow - can barely crawl compared to other languages. Maybe we should retire grand-daddy Python ?
    - bb88 5y ago
liftm 5y ago
This is what https://decentraleyes.org/ https://decentraleyes.org/ does, right?

xpressvideoz 5y ago

Wait, so the traditional "use the JavaScript CDN as a cross-site cache" method does not work anymore? How did I not know that!

simonw 5y ago
It was a huge privacy hole: malicious pages could measure how long it took for URLs to load and use that to tell which other sites you had visited in the past.
- colordrops 5y ago
  Weren't the shared libraries used on countless sites though? How would this work?
  - TOMDM 5y ago
    Because you'd make your own library used exclusively for tracking, or check to see if another site specific set of resources had been loaded.
  - modeless 5y ago
    Yes but each site uses a lot of libraries too. The set of libraries and specific versions of those libraries used by a site is a pretty good fingerprint.
    - colordrops 5y ago
      Still doesn't make sense - there is only a single set of libraries - the ones cached by a user's browser, and since each library in that set is used by thousands of sites, there's no way to know which site it was cached for. For each version, there are certainly thousands of sites using it. Since I'm still not getting it, perhaps you could explain how a particular set of libraries is fingerprinted?
      - dmurray 5y ago

krapp 5y ago

That page says there's a model for shared libraries being considered, so maybe there's hope.

deleted 5y ago

[deleted]

skybrian 5y ago

I wonder if a browser vendor could host a repository of common libraries? With a limited number of versions available that changes only at the same time as the browser, maybe it wouldn't leak much info. It would be almost like including the code in the browser.

bb88 5y ago
Isn't that almost like all browsers including a language with the browser?
- nine_k 5y ago
  It is, except the feature is downloaded on demand. Users need to trust the browser's producer anyway.
zodiakzz 5y ago
How could this go wrong - Bill Gates

bitpow 5y ago

You’re basically describing the old Java plugin paradigm.

nine_k 5y ago

While I understand how finding a particular unique resource cached may allow to glean some privacy-infringing info, I don't see how detecting a common library downloaded from a site that provides it for everyone (like python.org) would help reveal anything. If users might define a list of sites trusted for cross-site caching (like fonts.google.com and other known library CDNs), this could help cache quite some common resources without downsides to user's privacy.

berkes 5y ago
But then those 'common trusted sites' can spy on users massively. fonts.google.com is, after google analytics, the most effective spyware around today.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
remorses 5y ago
The problem is that you can identify people by checking what resources they have already cached

froh 5y ago

You'd need trusted providers, and a mechanism to 'import' a trusted something into your 'domain'. What am I missing?

fnord123 5y ago

While I get you point, I think it's of limited usefulness for Python. You would end up with Snekr.io using 3.11 and cheeseshoppr.ws using Python 3.8.4 and etc. You can get some packages for any Python3 but they are the smaller ones. The larger wheels like numpy and pandas have C code which needs to be compiled or there's a giant version dependent wheel. Server side Python is often deployed in a venv which has the desired python version and all the dependencies copied with the code.

asah 5y ago
the caching sites would host a small number of versions and the publishers would be motivated to select from among them.