KeyCDN Blog

> manufacturing cars is so cheap these days, even General Motors can do it...

Short answer: empirically, there's no question: HTTPS CPU overheads simply aren't a problem [0].

Long answer: that's disanalogous. Manufacturing works with economy of scale. Netflix have it worse than the rest of us.

They have to deliver tens of gigabytes per month per customer, using roughly the same hardware as the rest of us. According to that Ars Technica article, they did their usual Netflix-ey software optimisations with FreeBSD, but their hardware isn't customised for the job. Their scale doesn't much help them. If HTTPS overheads would put anyone out of business, it would be Netflix, but here we are: they voluntarily added HTTPS for their streams.

Again, as I think it bears stressing: these guys are transmitting about 15% of all data-flow across the Internet. Out of all the HTTPS traffic in the entire world (measured by gigabytes, admittedly discounting number of connections established), Netflix handles at least 15% of it. They do so voluntarily. Same goes for YouTube.

If you can think of a business model where HTTPS overheads would cause more trouble than they do for Netflix and YouTube, I'd like to hear it.

> That's not the case. HTTP uses SNI (for now)

Thanks, I wasn't aware of SNI. I don't think it gives much more away though, does it? Someone spying on my line can already see the IP address I'm connecting to. They already know I'm connecting to Wikipedia. They still can't see…

I'm going to attempt to give some fact- & data- based answers, as there seems to be too much ideological axe-grinding in (many of) the existing responses (as is, unfortunately typical on HN it seems, when discussing Front End Development). Even if my attempt seems...boring? (And sorry for the length; hopefully it makes up for that a bit in quality...?)

HN: "Why did Frontend development explode in complexity?"

Answers:

0) It's not ONE thing--it's a combination for forces/trends/factors...

1) The underlying technologies have become more complex (at least CSS and JavaScript have, but much less so w.r.t. HTML). For example: Flex layout, Grid layout, calc(), variables, etc., in CSS. Async/await, destructuring assignment, import(), optional chaining, spread operator, yield, ...more in JavaScript.

2) Customers and Users 'see' something that looks complex (whether inherently or accidentally), using Web technologies, so they are increasingly conditioned to expect that any application (regardless of complexity) can be build/delivered using Web technologies. A few examples, off the top of my head:
https://www.figma.com/
https://docs.google.com/
https://www.onshape.com/en/

3) HTML is--egregiously--impoverished! Quick, when was that last time you saw a non-trivial LOB application (or even most CRUD applications) that did NOT need some sort of data-grid style presentation? Well, luckily we have the HTML5 data grid control for that...oh wait, F** me! And then there's less common…

> How are GET requests a crutch?

They were not in the original spec IIRC. URL's are limited in legth (it's not in the spec, but most clients have a limit) etc.

> Which is what any caching proxy must do anyway?

Nope. A caching proxy can benefit from HTTP Cache Headers [1]. But cache headers don't work well with GraphQL's GET requests, and don't work at all with the default, which is POST.

> This problem is not limited to GraphQL, it's a generic authorization problem.

GraphQL makes it significantly more complex though. Because your requests are ad-hoc.

> You don't have to build a complexity analyzer or figure out recursion levels, there are already tools that do that for you.

Indeed. By adding more and more complexity. And no, tools only solve a part of the problem. Simply a dataloader on a server doesn't entirely solve the N+1 problem.

> But you can go another way and just create a list of approved queries.

Turning it into REST with none of the benefits of REST.

> Usually? That's just speculation. And that's entirely on the implementation of that service

It's not speculation. That's the main use case for GraphQL. But even if you just slap it on top of a single database, you still have the problem of ad-hoc queries hammering your database.

[1] https://www.keycdn.com/blog/http-cache-headers

1. Keyloggers written entirely in CSS have been demonstrated for some time now [a]

2. Malicious Javascript could have been embedded into their CI/CD pipeline and made it onto the site.

3. Somehow stealing SSH keys from a developer and simply logging into the box to change things at the OS level. In fact, it looks like at least one subdomain of theirs is hosted on GoDaddy. SSH keys for some of their customers were recently compromised. Note that I don't think this actually happened, but wanted to list. [b]

4. Smashing Magazine could also improve security by adding the Expect-CT, Feature Policy, and especially a Content Security Policy. Ironically a Smashing Magazine article from 2017 mentions at least having a CSP. [c,d]

5. I recall some speech by the NSA at DEFCON, I think in 2012 or something. One of their speakers said that for all the cool stuff they do...95% of this time it's just password reuse that gets people or phishing for credentials. This would seem to me the most likely way and the best investment of a hackers time.

[a] - https://css-tricks.com/css-keylogger/

[b] - https://www.theregister.co.uk/2020/05/05/godaddy_ssh_login_details_compromised/

[c] - https://www.smashingmagazine.com/2017/04/secure-web-app-http-headers/

[d] - https://www.keycdn.com/blog/http-security-headers

I think the core of the problem is that CSS is applied to the whole page, so it makes thinking about local changes hard.

CSS Modules[1] tries to help by introducing "local" CSS, then there are other approaches like BEM[2] that bake a namespace system into the class names, then there's OOCSS[3] that tries to break it down into separate .foo and .bar "objects" a bit like your example, then others going in the opposite direction like Atomic CSS[4] that try to make all the CSS rules so narrow that it is OK that they are global, then have multiple class names used on each HTML element to make the usage local.

Really, it is quite hard, lots of smart people trying to make it work.

Personally I've found the approach of CSS-in-TypeScript the easiest to work with, since I'm very familiar with TypeScript and it allow re-using the same tools to solve different problems (and my usecase wouldn't be a good fit for static HTML in the first place, so depending on JS for rendering is OK), but I can see how people not familiar with TypeScript might prefer a different approach to handling the complexity.

[1] https://medium.com/front-end-developers/css-modules-solving-the-challenges-of-css-at-scale-85789980b04f
[2] http://getbem.com/introduction/
[3] https://www.keycdn.com/blog/oocss
[4] https://acss.io/

"Obviously, performance was a big win. The website felt like it was running on local machines, bringing a dramatic increase to speed and lower latency across the board. After the switch, at first the load on our cloud servers was so low that we thought the website was down! Switching from PHP to D meant we could cut in half the instance size of each Amazon AWS machine in our cloud. And these machines are still underloaded. Our database cloud was highly affected by this too. We now use one quarter of its original computational power. All of this brought an instantaneous and dramatic cost savings, down to more than half of what our costs used to be."

I'm willing to bet they didn't even try a single one of the many possibly optimizations they could have used and actually stay either in PHP or a subset of PHP. It's so much easier to win your argument with a strawman, not to say there aren't cases where D is, in fact, better.

https://stackoverflow.com/questions/1408417/can-you-compile-php-code-and-upload-a-binary-ish-file-which-will-just-be-run

https://www.keycdn.com/blog/php-performance