3 ms·

I really would like to know why anyone would use an API to minify javascript/css/html instead of using a local library, built-in webserver features, or relying

by Alupis 4y ago

I really would like to know why anyone would use an API to minify javascript/css/html instead of using a local library, built-in webserver features, or relying on some front-end service like Cloudflare. Feels like we've jumped the shark if you need to send un-minified stuff to another server to get minified, sort of defeating the point in the first place...

simlevesque 4y ago
Closure compiler has been a thing since forever. Some people don't want to fiddle and don't care about owning their tools.
bagels 4y ago
Using some node library you pull down is still vulnerable to exactly this same kind of injection attack vector.
- Alupis 4y ago
  Except you're not then pounding on some pet side-project "API" stood up by a poaching agency... Seems insane anyone would even entertain the thought... it's trivially easy to minify whatever you want right within your app. And now here's OP bagging on this company for not disclosing this in some ToS or whatever, even though OP is the one abusing a free, obviously not-serious service.
  - cududa 4y ago
    Well when you google "CSS Minify" or "JS Minify" it's the top result - so it clearly isn't some low use tool. I just decided to use it for HTML as well. Wasn't "pounding it". The API limits to 30 requests per minute. I made around 50 requests in 3 minutes. Most local minification packages I tried spit out garbage, so just went with their API. Took a few hours to get a proper package stood up (the one I mentioned above). I'd generally just assume that if you're injecting tracking/ analytics into an output you'd tell folks. As they didn't mention it, thought I'd just alert folks. Not sure why you're so outraged I mentioned this is happening.
    - Alupis 4y ago
      I'm not outraged, I'm flabbergasted. Flabbergasted this idea made it's way into a real app, and flabbergasted this post made it's way onto the front page of HN. You went through great lengths here to make sure everyone knows a random for-funsies "API" from a random google result doesn't behave like you expected it, complete with the multi-tweet write-up and everything. Looking at what Toptal does, it seems glaringly obvious this "API" was setup for interview coding questions - nothing more. You've drug this company's name and reputation through the mud, right onto the front page of HN. All over a misunderstanding on your part, as we all now know (Cloudflare doing what Cloudflare does and all...), and a misconfiguration on the web admin's part (missing page rule apparently). I'll leave it at that... but perhaps your post/thread should be updated to indicate this company is in fact not doing what you have accused them of.
      - deleted 4y ago
        [deleted]
cududa 4y ago
Well the API was easy to implement, took minutes. Was more just out of convenience for producing a lot of assets that then get served to a lot of people. None of it ever went into production because we caught the requests pretty quickly this morning. As well, most of the python packages would mangle the minification - the one I linked to in the top post works great - documentation isn't up to date for python, but not horribly hard to setup
vlunkr 4y ago
It's like left-pad.io but real. Incredible

by Alupis 4y ago

simlevesque 4y ago

Closure compiler has been a thing since forever. Some people don't want to fiddle and don't care about owning their tools.

bagels 4y ago

Using some node library you pull down is still vulnerable to exactly this same kind of injection attack vector.

Alupis 4y ago
Except you're not then pounding on some pet side-project "API" stood up by a poaching agency... Seems insane anyone would even entertain the thought... it's trivially easy to minify whatever you want right within your app. And now here's OP bagging on this company for not disclosing this in some ToS or whatever, even though OP is the one abusing a free, obviously not-serious service.
- cududa 4y ago
  Well when you google "CSS Minify" or "JS Minify" it's the top result - so it clearly isn't some low use tool. I just decided to use it for HTML as well. Wasn't "pounding it". The API limits to 30 requests per minute. I made around 50 requests in 3 minutes. Most local minification packages I tried spit out garbage, so just went with their API. Took a few hours to get a proper package stood up (the one I mentioned above). I'd generally just assume that if you're injecting tracking/ analytics into an output you'd tell folks. As they didn't mention it, thought I'd just alert folks. Not sure why you're so outraged I mentioned this is happening.
  - Alupis 4y ago
    I'm not outraged, I'm flabbergasted. Flabbergasted this idea made it's way into a real app, and flabbergasted this post made it's way onto the front page of HN. You went through great lengths here to make sure everyone knows a random for-funsies "API" from a random google result doesn't behave like you expected it, complete with the multi-tweet write-up and everything. Looking at what Toptal does, it seems glaringly obvious this "API" was setup for interview coding questions - nothing more. You've drug this company's name and reputation through the mud, right onto the front page of HN. All over a misunderstanding on your part, as we all now know (Cloudflare doing what Cloudflare does and all...), and a misconfiguration on the web admin's part (missing page rule apparently). I'll leave it at that... but perhaps your post/thread should be updated to indicate this company is in fact not doing what you have accused them of.
    - deleted 4y ago
      [deleted]

cududa 4y ago

Well the API was easy to implement, took minutes. Was more just out of convenience for producing a lot of assets that then get served to a lot of people. None of it ever went into production because we caught the requests pretty quickly this morning. As well, most of the python packages would mangle the minification - the one I linked to in the top post works great - documentation isn't up to date for python, but not horribly hard to setup

vlunkr 4y ago

It's like left-pad.io but real. Incredible