3 ms·

Brotli's baked-in dictionary always irked me because it's forever fixed and can't be updated (not that I'm implementing new hypermedias on a weekly basis but st

Brotli's baked-in dictionary always irked me because it's forever fixed and can't be updated (not that I'm implementing new hypermedias on a weekly basis but still). I'd much rather see broad adoption of plain 'Content-Type: zstd` implemented with no dictionary, and later go through a standards process to add named content-specific dictionaries like `Content-Type: zstd-web` or `zstd-cn` or whatever. Edit: Actually this is already considered in RFC-8878 [0]. The RFC reserves zstd frame dictionary ids in the ranges: <= 32767 and >= (1 << 31) for a public IANA dictionary registry, but there are no such dictionaries published for public use yet. [0]: https://datatracker.ietf.org/doc/html/rfc8878#iana_dict https://datatracker.ietf.org/doc/html/rfc8878#iana_dict

SquareWheel 3y ago
Have you seen this proposal yet? It allows domains to define their own dictionaries for future compressions, with delta updates for changes. Still seems a bit complicated to me, but could be meaningful for web apps that are required to be large. https://github.com/WICG/compression-dictionary-transport https://github.com/WICG/compression-dictionary-transport
- cromka 3y ago
  Somehow this sounds like another future vector of attack
  - SquareWheel 3y ago
    Perhaps, but at the very least it's gone through multiple rounds of security and privacy review from different groups.
    - vlovich123 3y ago
      That kind of appeal to authority is myopic because all the major security and privacy issues are introduced by big companies with those teams. They are not that good at red team thinking which is what you need to do. It’s more expensive though and these teams are more about compliance and stopping the most obviously bad ideas only.
      - SquareWheel 3y ago
        That's really not an example of appeal to authority. It's a simple statement of facts. This has passed reviews by Google, Facebook, Apple, Mozilla, and the W3C's security and privacy teams. Make of that what you will.

SquareWheel 3y ago

Have you seen this proposal yet? It allows domains to define their own dictionaries for future compressions, with delta updates for changes. Still seems a bit complicated to me, but could be meaningful for web apps that are required to be large. https://github.com/WICG/compression-dictionary-transport https://github.com/WICG/compression-dictionary-transport

cromka 3y ago
Somehow this sounds like another future vector of attack
- SquareWheel 3y ago
  Perhaps, but at the very least it's gone through multiple rounds of security and privacy review from different groups.
  - vlovich123 3y ago
    That kind of appeal to authority is myopic because all the major security and privacy issues are introduced by big companies with those teams. They are not that good at red team thinking which is what you need to do. It’s more expensive though and these teams are more about compliance and stopping the most obviously bad ideas only.
    - SquareWheel 3y ago
      That's really not an example of appeal to authority. It's a simple statement of facts. This has passed reviews by Google, Facebook, Apple, Mozilla, and the W3C's security and privacy teams. Make of that what you will.