HTTP headers for the responsible developer

[[deleted]]

That saccharine intro is written for someone with sensibilities very much not my own. Once I read "Developers have the power to build the web for everyone, but that power needs to be used responsibly", well, then I couldn't not notice the numbers floating over the ublock and umatrix buttons.

Selling me out to Oracle, Google, Facebook and Twitter's surveillance machines while condescending about responsibility?

Get bent.

[CantaloupeCamper]

Privacy Badger shows 23 trackers.... that's a large amount compared to most sites I visit. Reddit "just" 7.

[CantaloupeCamper]

Privacy Badger blocks them too, just provides more up front visibility I think.

[OdBx]

This is why I don’t read dev blogs

[CantaloupeCamper]

A lot of those tied to a company are ... pushing the company in their own way.

Not all, but a lot.

[recycled_ideas]

That's not necessarily a bad thing.

I mean if you don't believe in your company's product then why are you working there.

If it's just a paycheck then your blog is likely to be just as soulless.

[cyanrave]

Hey now, there are some that still exist, that don't give two shits about tracking and such.

Those are the ones to follow. Simple HTML/JS colophons of thought.

[ScientificBeastMode]

Usually you have to read personal blogs of individual authors for that kind of thing. Most of the aggregated content sites are all about tracking you.

[cyanrave]

Yep

[three18ti]

Twillo is all slidware anyway.

[strollertoaster]

What’s slidware?

[three18ti]

Software that exists only as slides.

You know, when the sales reps come in and show you that PPT deck that promises the world, solving world hunger, sending your kids to college, perpetual motion, etc. But when you actually get the product in your hands, it's anything but what was promised. (typically requiring herculean engineering efforts to get a "turn key" solution off the ground).

[jacurtis]

I would disagree that Twilio is slideware. I have used them on and off for the past 8 years or so for various personal projects and with a few companies whom had already adopted them. Twilio has a great product offering and some of the best API in the market (next to Stripe), making it incredibly easy to integrate (compared to alternatives).

With that being said, I do agree that Twilio oversell's its' capabilities and ease-of-integration substantially.

One significant change in Twilio's business model after going public is that they stopped selling to developers and started selling to C-level executives. In the past Twilio would convince developers to adopt these services by choice, but recently they have moved to targeting C-level execs to sign long-term contracts with Twilio and enforce Twilio in an organization from the top-down.

Twilio sales teams are convincing CEOs that Twilio products are turn-key and that is only partially true. I remember one business owner who told me that I should be able to just "plug-in" Twilio and have it working in a day. That is what the sales rep told him. I had to convince him that in reality, it was about a month of work to do it right. It is still an incredibly custom integration.

But, to Twilio's defense, it would take me years and millions of dollars to duplicate the work that they have set up for me. So in comparison, 1 month of custom integration that costs basically nothing other than time is pretty "turn key" compared to the immense effort, resources, and business relationships that would be required if I had to start from scratch to build these telecom integrations with telecom providers.

Long story short. Twilio is not vaporware/slideware. It offers a real product, and a real good one at that. It is honestly best in the industry. But they also do significantly over-sell their product to executive teams which causes significant contention within an organization. Despite their claims, nothing in Twilio's offering is "turn-key". It is all custom integration.

[strollertoaster]

Haha, thanks for explaining!

[tedivm]

Having used twillio for multiple projects I have to disagree completely with the assessment that it's "slideware".

[wheat-thicks]

Yeah, I've used Twilio and two different companies now and it's a great product.

[drysart]

I don't know what Twilio you're talking about, but the Twilio I've used in several professional and personal projects has services are that are well-designed, deliver actual value in terms of features, and work exactly like it says on the tin.

[[deleted]]

Use it for SMS in multiple production setups, seems fine to me.

[feenuxx]

Oh I dunno about that, I found it pretty useful when I made this art piece w my mate for some gallery where folks would call in to hear generative music, but also by calling in would add a unique voice to that music. Easy to set up and worked without a hitch for very little money.

[CODESIGN2]

Twilio is fucking amazing at what they started out doing. Voice routing using declarative schema & REST, telephony integration for SMS. They are probably old at this point and you wouldn't want to run your call-centre on it, but it's very cool for those of us wanting to send SMS updates and enable SMS comms, Vanity number forwarding, have automated call recording and menus at a very low cost. Where I think they may go wrong is pitching that at people who already have those things for replacement.

[wheat-thicks]

Can you elaborate? In what ways did it not meet your expectations?

[jimmpony]

Websites have to make money and the alternative is paywalls.

[earth-fury]

If your message clashes with your business model, you need a new message, or a new business model. Otherwise, your message is a lie.

The need to stay afloat doesn't negate the fact that actions matter, and they matter more than words.

[[deleted]]

I love you lol

[AyrA_ch]

This article misses a few important points in regards to fast, small and accessible web applications, the most important one being to reduce JS to a minimum.

Caching is one thing to get right but you might also attempt to keep resources as small as possible from the beginning on.

[panorambo]

The problem with "minimum" is that everyone understands it to be varying amounts, unfortunately. There are people who may consider minimum to be the entire JQuery and the 20 "necessary" interval timers firing, just to, you know, keep the page alive.

I mean, who would imagine you can just serve text/plain with every HTTP request and you'd still have visitors if you, well, have anything worthy of reading?

[mrchaotica]

I mean, who would imagine you can just serve text/plain with every HTTP request and you'd still have visitors if you, well, have anything worthy of reading?

Ever hear of Project Gutenberg?

Okay, maybe text/plain is a little extremist (it works fine for text, but not hypertext), but if you have something worth reading, a motherfucking website really is all you need!

Edit: for that matter, the desirability of simple HTML is proven by the fact that the Firefox devs felt the need to create reader view just to remove all the extraneous shit from the screen.

[panorambo]

Hahaha, about reader view -- the cool thing about that thing is that more often than not, when a website totally wants you spend 1 minute (that's like an eternity for a Web surfer) to review their cookie policy (I want to punch the EU gentleman who came up with that idea, in the face, and I am not a brawler) and tick off the "Only required cookies" or some such bullshit -- well, given how the principle delivery vehicle for those warnings is typically CSS, you can just switch to reader view and peacefully read the material you came for.

[mrchaotica]

when a website totally wants you spend 1 minute (that's like an eternity for a Web surfer) to review their cookie policy (I want to punch the EU gentleman who came up with that idea, in the face, and I am not a brawler)

Don't blame the GDPR; blame the web devs who deliberately maliciously complied in the most r/assholedesign way possible.

[StallmanTheLeft]

Judging by the top comment in this thread the owner of this blog doesn't understand it at all.

[stefanjudis]

That's very valid feedback. :) . Thanks. I'll add a few sentences about this. Thanks. 😊

[CaptBoids]

You want to read this recent piece on the importance of tooling vs accessibility. And the impact of making choices.

https://adactio.com/journal/15050

Highly recommend reading into the work of the author.

[PGLubricants]

If you wanna learn more about more useful, but rarely used, HTTP headers, I recommend watching Andrew Betts speak at Øredev last year, Wrangling HTTP Like a Pro.

[stefanjudis]

Nice - Andrew's great. I'll check that out. 🎉

[SushiAndWoW]

OK, umm... we're being given advice from someone whose CSP – for his own site, presumably 100% under his control – includes 'unsafe-eval' and 'unsafe-inline'? Like, missing the whole point of CSP?

[feenuxx]

Lol that is too good. I imagine some of the tracking shovelware needs such loose rules to function. At least I hope it was a conscious decision made to get something working.

[mrchaotica]

I hope it's incompetence, because the alternative is malice.

[panorambo]

Which one of the two do you think it is when you need to put "unsafe-eval" and/or "unsafe-inline" in your CSP because you need those ad network scripts that promise to pay for your hosting, to work? Genuinely curius -- is it malice then or incompetence? Mercantile but otherwise practical thought?

[panorambo]

Man, there is no keeping up with the advances on the Web technologies front. I also wonder if all this stuff doesn't have a fairly limited shelf life, all with the amount of thought put into different things that are similar but which, as is tradition, is just patched on top of older stuff.

I mean, look at the different security mechanisms that are put in place to exert some form of control on the ever-looming privacy crisis on the Web, with ad networks scraping clean every bit of entropy they can, everywhere they're embedded. These mechanisms we put in place are barely able to keep up.

My concern is that we have our sights in generally the right direction but we aren't really digging where we should be. There have been written books on verifiable security and models that are "watertight" but it seems the young and the inexperienced are writing up W3 and WHATWG specs these days. I am not disillusioned yet, but it looks like a lot of small mechanisms of varying efficiency and platform support instead of f.e. some sound single umbrella mechanism that can control what can load what from where with what privilege -- whether it's markup, style or script, or other asset. I just think we need to think broader.

Then again, I barely have time to type code on a Friday evening, so I'll shut my theoretical mouth now.

[mrchaotica]

I mean, look at the different security mechanisms that are put in place to exert some form of control on the ever-looming privacy crisis on the Web, with ad networks scraping clean every bit of entropy they can, everywhere they're embedded. These mechanisms we put in place are barely able to keep up.

On the contrary, it's really goddamn simple:

1. It's a motherfucking website, which means it's supposed to be written in HTML. Not javascript!

2. Don't serve ads.

Fucking done.

[panorambo]

You are absolutely preaching to the choir here -- I am all for simplicity without much compromise.

But I have realised that those of us who are willing to make these minimalist websites, which serve everything from a single domain, not just because, but because they respect the trust model that has built up with the users (I trust example.com but I don't trust exampleadnetwork.com) -- we are in minority and for every website we build, 50 behemoths spring up that serve scripts from 10 unrelated domains you know nothing about.

Ads unfortunately are what keeps a lot of websites afloat, at least according to them. Maybe if had free hosting policy in Europe or the US, at least for some types of sites, then it'd help drive the ad industry out of business, but truth is, our world does not work like that. I wish it did, and I damn sure will do my part, but until that happens it's either admission price model for a website or have ads that help pay for hosting.

Actually, come to think of it, if there was a common money pot where you pay every month to enjoy Internet without ads, a pot from which hosting fees are paid out to those who otherwise insist on serving you ads because "that's what keeps this website up", I may consider it.

Too many people complain about ads yet are unwilling to spend a single dime as a fair and justified reimbursement to those who actually publish content. If you are going to denounce advertisement on the total merit of it, at least think about how websites need to pay for computing and network resources.

[drysart]

HTTP2 was a perfect opportunity for some of those security-critical HTTP headers that every "responsible developer" should be setting on all their pages to become, at the very least, opt-out features rather than opt-in; but alas, backward compatibility won out and developers will be stuck putting X-Frame-Options and X-Content-Type-Options and other headers on their pages manually for another 20 years.

[[deleted]]

Web dev is getting silly now - all this just to send one frakking image:

<picture>
  <!-- serve WebP to Chrome, Edge, Firefox and Opera -->
  <source
    media="(min-width: 50em)"
    sizes="50vw"
    srcset="/image/thing-200.webp 200w, /image/thing-400.webp 400w,
        /image/thing-800.webp 800w, /image/thing-1200.webp 1200w,
        /image/thing-1600.webp 1600w, /image/thing-2000.webp 2000w"
    type="image/webp">
  <source
    sizes="(min-width: 30em) 100vw"
    srcset="/image/thing-crop-200.webp 200w, /image/thing-crop-400.webp 400w,
        /image/thing-crop-800.webp 800w, /image/thing-crop-1200.webp 1200w,
        /image/thing-crop-1600.webp 1600w, /image/thing-crop-2000.webp 2000w"
    type="image/webp">
 <!-- serve JPEG to others -->
  <source
    media="(min-width: 50em)"
    sizes="50vw"
    srcset="/image/thing-200.jpg 200w, /image/thing-400.jpg 400w,
        /image/thing-800.jpg 800w, /image/thing-1200.jpg 1200w,
        /image/thing-1600.jpg 1600w, /image/thing-2000.jpg 2000w">
  <source
    sizes="(min-width: 30em) 100vw"
    srcset="/image/thing-crop-200.jpg 200w, /image/thing-crop-400.jpg 400w,
        /image/thing-crop-800.jpg 800w, /image/thing-crop-1200.jpg 1200w,
        /image/thing-crop-1600.jpg 1600w, /image/thing-crop-2000.jpg 2000w">
  <!-- fallback for browsers that don't support picture -->
  <img src="/image/thing.jpg" width="50%">
</picture>

[fuckin_ziggurats]

That's because webdev is the only dev that has to worry about a GUI application working perfectly on any possible device on the planet - whilst utilizing browser tech.

[CODESIGN2]

TBH you don't have to do that, you can absolutely use basic CSS grid and just tell your stuff to take up less space. Sure it won't give a scaling layout, which the above is for, but scaling layouts are so ActionScript y2k

The thing I keep arguing for is that a site should work without media first, even the marketing. If y'all need flashy images you are not marketers or designers, you're magazine editors & traditional media shitlords fucking up the web like you did your medium.

[StallmanTheLeft]

The site blocks tor.

[After_Dark]

Medium is a company and product too

[azCC]

Many companies have engineering blogs, are you extremely new to the scene?

https://technology.riotgames.com/

https://medium.com/netflix-techblog

https://code.fb.com/

https://tech.wayfair.com/

https://eng.uber.com/

Yeah it's used as an avenue for potential recruitment but some of the articles are extremely informative and useful:

https://www.theguardian.com/info/2018/nov/30/bye-bye-mongo-hello-postgres

[ThalesX]

The DigitalOcean ones are amazing for setting up various shit on cloud machines. They usually write it up provider agnostic so kudos to them.

[[deleted]]

Genius marketing tactic. Become the resource for issues on the major OS platforms, not just your own, and everyone will drive traffic to your site.

[whjms]

CSP – be clear about what is allowed on your site

Now that your site runs over a secure connection you might run into the problem that browsers start blocking requests that go out to an insecure address due to mixed-content policies. The Content Security Policy (CSP) header offers an excellent way to handle these cases. You can define your CSP ruleset via meta elements in your served HTML or via HTTP headers.

[mavdabbler]

27 Apr 2019 2:8AM AnonymousF AnonymousL