3 ms·

Browser makers like Mozilla think it's appropriate that holding down F5 should repeatedly pummel the server in accord with keyboard repeat rates. It's like the

Browser makers like Mozilla think it's appropriate that holding down F5 should repeatedly pummel the server in accord with keyboard repeat rates. It's like the browser makers are being intentionally hostile towards web servers. E.g. https://bugzilla.mozilla.org/show_bug.cgi?id=224026 https://bugzilla.mozilla.org/show_bug.cgi?id=224026 https://bugzilla.mozilla.org/show_bug.cgi?id=873045 https://bugzilla.mozilla.org/show_bug.cgi?id=873045 There's no excuse, but they don't fix it.

quotemstr 12y ago
> There's no excuse, but they don't fix it. Browsers exist for my convenience, not yours.
- sjwright 12y ago
  Is a denial-of-service tool so convenient for you?
  - babby 12y ago
    Thats a poor argument. Literally no one gets DoS'ed by a few guys F5'ing in coordination. If your server is so poorly set up as to allow any small number of IP's to impact it in any way then you are doing it wrong. When I was getting into nodejs a few years back I wrote DoS script to kill a site that was scraping content from one of my sites and posing it as their own. I made it just for shits n giggles in about 5 minutes and I was surprised when it actually worked, their website just went down. DoS is and always will be easy.
    - sjwright 12y ago
      That is a poor deflection of the underlying point. It's absurd to conclude that an obviously undesirable behavior -- however unlikely to pose a problem in reality -- should not even be considered let alone addressed. It could be as simple as a modest global rate limit on repeated GET requests to the same URL. We could start with 250 msec and see how that goes. Or it could be as simple as limiting F5 reloads to once per keydown. Let users work for their accidental DoS attacks. :-)
      - oldmanjay 12y ago
        what's absurd is protecting the server from a vanishingly rare accident by changing the client. if you feel you need to be protected, put that protection where it belongs, on the server, where it works against more likely things as well.
        sjwright 12y ago
        It protects the end user as much as it does the server.
Retra 12y ago
So rather than fix your one server to be more robust, every one of the thousands of browsers that exist should change?
- sjwright 12y ago
  Rather than tweak the top four web browsers to be more intelligent towards actual user intent, every one of the millions of web applications should change?
  - Retra 12y ago
    How do you know what user intent is? If I'm holding the F5 key down, what do you think I want to happen? What if I'm running a plugin that does that for me? What if I'm writing my own web crawler or something? Yes, I expect everyone who writes a web application to make it able to handle server requests reliably. There is no such thing as making a robust request -- a browser is just a browser. It doesn't know enough about your server to know what it doesn't like or can't handle. It also doesn't know enough about the user to know what their intent is. You are blaming the pipeline for end-point issues.
    - sjwright 12y ago
      > How do you know what user intent is? I can tell you what it's unlikely to be. It's unlikely to be to fire HTTP requests at the arbitrary keyboard repeat of their particular computer. It's unlikely to be to machine gun off HTTP requests so rapidly that no pages ever get rendered. Or perhaps I'm wrong. Perhaps there's a reasonable user behavior I'm forgetting. Please, enlighten me. > If I'm holding the F5 key down, what do you think I want to happen? At a guess, it would be to refresh the page repeatedly. In which case the ideal browser behavior might be to refresh the page at the maximum possible speed that would still allow some kind of visual feedback. Perhaps it could repeat as soon as the previous requests hits first paint. That would make sense.

quotemstr 12y ago

> There's no excuse, but they don't fix it. Browsers exist for my convenience, not yours.

sjwright 12y ago
Is a denial-of-service tool so convenient for you?
- babby 12y ago
  Thats a poor argument. Literally no one gets DoS'ed by a few guys F5'ing in coordination. If your server is so poorly set up as to allow any small number of IP's to impact it in any way then you are doing it wrong. When I was getting into nodejs a few years back I wrote DoS script to kill a site that was scraping content from one of my sites and posing it as their own. I made it just for shits n giggles in about 5 minutes and I was surprised when it actually worked, their website just went down. DoS is and always will be easy.
  - sjwright 12y ago
    That is a poor deflection of the underlying point. It's absurd to conclude that an obviously undesirable behavior -- however unlikely to pose a problem in reality -- should not even be considered let alone addressed. It could be as simple as a modest global rate limit on repeated GET requests to the same URL. We could start with 250 msec and see how that goes. Or it could be as simple as limiting F5 reloads to once per keydown. Let users work for their accidental DoS attacks. :-)
    - oldmanjay 12y ago
      what's absurd is protecting the server from a vanishingly rare accident by changing the client. if you feel you need to be protected, put that protection where it belongs, on the server, where it works against more likely things as well.
      - sjwright 12y ago
        It protects the end user as much as it does the server.

Retra 12y ago

So rather than fix your one server to be more robust, every one of the thousands of browsers that exist should change?

sjwright 12y ago
Rather than tweak the top four web browsers to be more intelligent towards actual user intent, every one of the millions of web applications should change?
- Retra 12y ago
  How do you know what user intent is? If I'm holding the F5 key down, what do you think I want to happen? What if I'm running a plugin that does that for me? What if I'm writing my own web crawler or something? Yes, I expect everyone who writes a web application to make it able to handle server requests reliably. There is no such thing as making a robust request -- a browser is just a browser. It doesn't know enough about your server to know what it doesn't like or can't handle. It also doesn't know enough about the user to know what their intent is. You are blaming the pipeline for end-point issues.
  - sjwright 12y ago
    > How do you know what user intent is? I can tell you what it's unlikely to be. It's unlikely to be to fire HTTP requests at the arbitrary keyboard repeat of their particular computer. It's unlikely to be to machine gun off HTTP requests so rapidly that no pages ever get rendered. Or perhaps I'm wrong. Perhaps there's a reasonable user behavior I'm forgetting. Please, enlighten me. > If I'm holding the F5 key down, what do you think I want to happen? At a guess, it would be to refresh the page repeatedly. In which case the ideal browser behavior might be to refresh the page at the maximum possible speed that would still allow some kind of visual feedback. Perhaps it could repeat as soon as the previous requests hits first paint. That would make sense.