6 ms·

> browsers no longer cache resources across top level sites. Wait is this true? Definitely warrants some kind of citation. If no one's heard one way or another

> browsers no longer cache resources across top level sites. Wait is this true? Definitely warrants some kind of citation. If no one's heard one way or another I might test it later because I'm pretty skeptical of this claim. Edit: mind blown

kube-system 4y ago
https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/
beejiu 4y ago
Yes, it seems like it is now true. https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/
zinekeller 4y ago
Yes, all modern browsers divide their cache per-site. Some large advertising companies like Taboola have abused caches to store unique identifiers. I won't be shocked if Google and Facebook have also used this, so Safari (from 2013, https://bugs.webkit.org/show_bug.cgi?id=110269 https://bugs.webkit.org/show_bug.cgi?id=110269), Firefox (depending on settings from 2018 and widely deployed in 2020, https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...) and Chrome (from 2020, https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/) now separate caches.
bombcar 4y ago
It's true and kind of asinine in my opinion, and actually makes setting up a Squid cache worthwhile again, potentially.
- usr1106 4y ago
  Wasn't it so that squid does not support https? If yes, there shouldn't be much to cache today.
robin_reala 4y ago
The reasoning behind this is a privacy leak attack. Let’s say that you know that, say, your competitor is loading a specific asset at a specific version from a CDN. You can then attempt to load that asset as well, and using the Resource Timing API[1] see how long it takes to come down. If it’s 500ms+ you can guess that it’s a network load. If a lower number you could guess that instead it’s come from the cache. You could then target that user with that new knowledge. Safari realised this a long time ago, but it took Firefox and Chrome a while to catch up, or at least to decide that the harm outweighed the benefit. [1] https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API https://developer.mozilla.org/en-US/docs/Web/API/Resource_Ti...

kube-system 4y ago

https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/

beejiu 4y ago

Yes, it seems like it is now true. https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/

zinekeller 4y ago

Yes, all modern browsers divide their cache per-site. Some large advertising companies like Taboola have abused caches to store unique identifiers. I won't be shocked if Google and Facebook have also used this, so Safari (from 2013, https://bugs.webkit.org/show_bug.cgi?id=110269 https://bugs.webkit.org/show_bug.cgi?id=110269), Firefox (depending on settings from 2018 and widely deployed in 2020, https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...) and Chrome (from 2020, https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/) now separate caches.

bombcar 4y ago

It's true and kind of asinine in my opinion, and actually makes setting up a Squid cache worthwhile again, potentially.

usr1106 4y ago
Wasn't it so that squid does not support https? If yes, there shouldn't be much to cache today.

robin_reala 4y ago

The reasoning behind this is a privacy leak attack. Let’s say that you know that, say, your competitor is loading a specific asset at a specific version from a CDN. You can then attempt to load that asset as well, and using the Resource Timing API[1] see how long it takes to come down. If it’s 500ms+ you can guess that it’s a network load. If a lower number you could guess that instead it’s come from the cache. You could then target that user with that new knowledge. Safari realised this a long time ago, but it took Firefox and Chrome a while to catch up, or at least to decide that the harm outweighed the benefit. [1] https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API https://developer.mozilla.org/en-US/docs/Web/API/Resource_Ti...