Meta tags:

Headings (most frequently used words):

popularity, recent, reply, 27, replies, to, post, navigation, posts, comments, archives, categories, meta, leave, cancel,

Text of the page (most frequently used words):
the (196), and (90), that (53), for (40), not (36), shared (34), 2008 (32), but (32), april (30), you (30), reply (29), says (27), was (24), script (22), with (21), hash (21), javascript (19), would (19), this (19), src (17), cache (17), can (17), are (16), brendan (15), eich (14), browser (14), language (13), has (13), url (13), from (12), web (12), about (12), have (12), which (12), may (11), one (11), source (11), like (11), had (11), idea (11), netscape (11), 2013 (10), what (10), your (10), will (10), good (10), code (10), use (10), could (10), dojo (10), then (10), more (10), way (9), don (9), should (9), here (9), also (9), even (9), attribute (9), java (9), june (8), 2005 (8), october (8), 2007 (8), https (8), com (8), too (8), into (8), canonical (8), some (8), scheme (8), august (7), september (7), post (7), only (7), via (7), problem (7), there (7), two (7), doug (7), how (7), been (7), first (7), own (7), still (7), popular (7), libraries (7), 2004 (6), november (6), 2011 (6), asm (6), webassembly (6), see (6), know (6), caching (6), seems (6), tag (6), server (6), new (6), look (6), same (6), file (6), already (6), much (6), history (6), poisoning (6), without (6), bug (6), back (6), versioning (6), libfoo (6), yet (6), cdn (6), popularity (6), comments (5), july (5), january (5), february (5), 2006 (5), 2010 (5), 2012 (5), ajax (5), does (5), isn (5), another (5), time (5), when (5), needed (5), data (5), any (5), long (5), all (5), wrote (5), content (5), level (5), done (5), bertrand (5), part (5), existing (5), something (5), page (5), author (5), scripts (5), were (5), site (5), used (5), library (5), org (4), mozilla (4), march (4), 2017 (4), next (4), name (4), required (4), original (4), edge (4), both (4), why (4), video (4), hashes (4), easy (4), interesting (4), case (4), order (4), than (4), base (4), based (4), think (4), tom (4), started (4), work (4), avoids (4), right (4), evil (4), crypto (4), missing (4), before (4), must (4), get (4), enough (4), sean (4), check (4), whether (4), management (4), internet (4), instead (4), cached (4), out (4), other (4), his (4), course (4), well (4), its (4), where (4), kipp (4), jvm (4), who (4), december (3), 2014 (3), platform (3), search (3), comment (3), according (3), johnson (3), html (3), days (3), read (3), copy (3), just (3), download (3), everyone (3), often (3), van (3), jacobson (3), google (3), david (3), over (3), years (3), message (3), attack (3), thought (3), given (3), header (3), along (3), avoid (3), different (3), http (3), requires (3), support (3), diatribe (3), being (3), pretty (3), fine (3), actually (3), love (3), argument (3), lack (3), having (3), string (3), because (3), roy (3), dns (3), thanks (3), wasn (3), installed (3), meant (3), they (3), now (3), such (3), aol (3), using (3), tell (3), designed (3), apt (3), issue (3), soon (3), downloaded (3), write (3), never (3), version (3), pre (3), open (3), serve (3), tags (3), john (3), nfs (3), named (3), hard (3), many (3), those (3), world (3), heard (3), most (3), later (3), embedding (3), bill (3), convinced (3), sun (3), navigator (3), 1995 (3), languages (3), programming (3), wordpress (2), feed (2), uncategorized (2), categories (2), between (2), saw (2), application (2), recent (2), keynote (2), previous (2), email (2), address (2), leave (2), funny (2), trevor (2), average (2), cdns (2), want (2), dedicated (2), risk (2), relying (2), going (2), reference (2), identical (2), concerned (2), take (2), proxy (2), non (2), did (2), really (2), relevant (2), network (2), networking (2), videoplay (2), docid (2), 6972678839686672840 (2), roussel (2), patrick (2), lived (2), copied (2), necessarily (2), algorithm (2), top (2), algorithms (2), sure (2), poisoned (2), able (2), generate (2), find (2), match (2), sha (2), resources (2), files (2), request (2), path (2), palmer (2), matching (2), downloading (2), easily (2), cases (2), longer (2), needs (2), lighten (2), doing (2), personally (2), buy (2), concept (2), success (2), approach (2), admit (2), legitimate (2), security (2), finally (2), said (2), goes (2), posting (2), let (2), blog (2), misses (2), point (2), proposal (2), second (2), need (2), vulnerable (2), cannot (2), value (2), happen (2), updated (2), values (2), pages (2), left (2), line (2), calling (2), wondering (2), legacy (2), probably (2), background (2), might (2), volodymyr (2), make (2), come (2), dependency (2), declare (2), distributed (2), them (2), again (2), home (2), extension (2), until (2), anyways (2), cinneidesean (2), high (2), run (2), recently (2), create (2), object (2), model (2), mention (2), hogan (2), standard (2), stored (2), firefox (2), minification (2), worst (2), scenario (2), uses (2), ensure (2), element (2), compiled (2), main (2), reason (2), least (2), among (2), aolcdn (2), visit (2), startup (2), hmac (2), attacks (2), sgi (2), highly (2), available (2), date (2), known (2), authors (2), securing (2), mean (2), 1996 (2), applications (2), very (2), oriented (2), sha1 (2), itself (2), optional (2), developers (2), curse (2), including (2), self (2), concerns (2), mce (2), share (2), client (2), early (2), prototyping (2), mocha (2), mid (2), scripting (2), ish (2), engineering (2), tcl (2), big (2), directly (2), short (2), ari (2), pointy (2), haired (2), boss (2), proudly, powered, entries, log, meta, opinion, 2015, archives, difference, photolens, büyük, geleceği, kodedu, js和webassembly之间有什么区别, 开发百科, 程序代码问答平台, today, future, orbx, streaming, demain, koto, game, webassembly系列2, 为什么我们需要webassembly, 采访brendan, java天堂, mission, rehosted, render, token, dotjs, posts, tracemonkey, lightspeed, media, navigation, website, fields, marked, published, cancel, quote, misattributed, samuel, www, samueljohnson, apocryph, skagedal, consumer, proxies, bad, startups, provision, presence, ec2, helps, failover, douglas, crockford, assessment, little, off, target, compact, responsible, mess, competing, conflicting, doms, got, messenger, excuse, ignorance, supposedly, extend, else, solving, turton, anyone, watch, linked, direct, finds, interested, exactly, longevity, combined, strength, ago, greater, faith, discussion, applies, suggestion, documents, colliding, arbitrary, document, dubroy, variation, none, rather, dependent, etag, externally, defined, calculate, large, store, mapping, perhaps, heuristics, subset, simple, pattern, send, integrity, helpful, jquery, copies, addressed, response, finished, recommended, across, types, paste, emailing, believe, backs, explaining, detail, sketched, reader, willingness, assume, dumb, hey, english, after, stand, behind, word, heated, debates, apparently, answered, venom, discuss, extent, vocabulary, thereof, ironically, swear, truth, trace, spam, folder, happened, topic, creating, signature, legit, remains, mainly, impractical, despite, proofs, quite, lot, software, shown, third, solves, weird, markup, concern, raised, expert, wrong, understand, secure, prevents, attacker, poisons, visitor, moderate, trouble, please, retry, error, try, installation, fixed, misuses, memoir, bit, broadway, fun, completely, unsound, browsers, contains, matches, requested, regardless, safely, index, fetching, noted, lesser, threat, auto, administered, stale, thousands, millions, found, worthwhile, scrolling, every, preferred, reality, disabled, stylesheet, doesn, sound, ciarang, expects, contain, evaluated, impute, intended, carry, handy, wouldn, though, propose, climb, mountain, once, signed, tried, general, pain, failed, certainly, likewise, handled, yahoo, conventions, keep, talking, abstract, improve, solve, block, progress, sharing, waiting, innovation, lacks, key, stones, automatic, compatible, bar, baz, sign, otherwise, domain, expire, somebody, replace, old, crack, selected, entire, clicks, documentation, package, systems, information, integrate, smart, yum, implementing, wheel, command, install, repo, trusted, repository, basedir, user, implement, few, cross, however, tool, lisivka, luck, launch, cool, deserves, increased, attention, hopefully, hope, rhyme, chapter, voyage, describing, ultra, cant, further, becuase, haven, except, timeline, floating, round, mit, proper, vpri, always, maintenance, obvious, low, priority, within, yui, examples, agree, precompiled, ccache, analogue, ran, due, subject, measure, hit, rate, custom, cleared, hits, per, example, unlikely, scenarios, reduces, control, basically, saying, appear, referer, field, logs, minor, changes, urls, couple, questions, related, dynamic, insertion, happens, onerror, fired, text, act, inline, unless, interest, currently, cards, unaware, proposing, fact, purchased, openajax, allow, wiki, editing, fly, immediate, fixing, vetted, community, exist, session, wanted, cname, ric, took, almost, decade, developer, grok, understood, pass, achieved, acceptance, bet, forever, functional, features, mike, ivanov, loaded, entry, wait, prevent, considerably, easier, straight, commenting, system, disallows, various, errors, great, passing, since, schemes, birthday, collision, research, burning, live, decades, shudder, port, issues, solution, attractive, presuming, propers, ahead, major, app, sites, complete, versions, flat, breaking, sweat, etc, drive, differential, common, locations, apps, pay, their, hosting, wins, away, count, connectivity, nine, nines, availability, hosted, place, simply, ideal, lower, costs, evolutionary, pathway, machines, solved, trivialize, equated, hand, thing, renaming, livescript, scrambling, reaction, didn, realize, expecting, released, depends, trusting, modify, imagine, hell, people, weren, careful, locally, mounted, stracke, ties, ideas, put, forward, claims, helped, develop, tcp, stream, labels, hostnames, ports, possibilities, reminded, git, label, bittorrent, worried, providing, extra, provided, sha256, similar, supported, realised, baked, infrastructure, replies, looks, performance, metrics, space, evolve, die, wherefore, anon, es4, certain, say, profess, quickie, child, words, mind, demonstrate, welcome, inscrutable, hashcodes, trust, ulp, valid, rules, mce_src, better, html5, rob, sayre, theoretical, soundness, mooted, folks, entails, potentially, attributes, nevertheless, crunched, minified, link, culled, plaintext, forms, schlepped, around, constantly, rest, perverse, merciless, beat, rivaled, flash, supports, offspring, actionscript, drop, compatibility, wise, observation, proven, rapid, alpha, development, phase, studying, writing, portability, layer, underlying, purpose, nspr, hickman, spring, remember, meeting, during, period, discussing, points, garbage, collection, card, marking, efficient, barriers, him, beginning, grokked, companion, analogous, relationship, microsoft, nineties, far, our, champion, joy, proud, happy, chose, class, functions, albeit, singular, prototypes, ingredients, influences, especially, y2k, bugs, primitive, distinction, unfortunate, inventing, decided, upper, ruled, perl, python, came, pitch, lament, missed, opportunity, ousterhout, diktat, debate, inside, therefore, became, answer, mostly, disjoint, audiences, ziggurat, deserved, component, hoped, scripters, amateur, pro, embedded, joined, transferred, group, hired, term, requisition, scarcity, games, pleasure, working, briefly, renamed, negotiating, include, oak, pac, luotonen, mccool, twins, convincing, proof, aka, demo, delivered, fait, accompli, question, bait, went, joining, previously, turned, sicp, nick, thompson, others, confirm, recruited, promise, guy, embed, form, hardly, selling, reverse, marc, andreessen, rick, schell, michael, toy, paquin, knows, care, week, tenth, anniversary, project, founded, making, stories, recollections, birth, told, keynotes, revisionist, shenanigans, advance, agenda, microhoo, conferences, implemented, hurry, considered, role, nerd, tender, age, joke, camp, green, chick, hotter, coming, handed, compliment, guru, 2020, posted, presentations, menu, skip, wayback, machine, archive, 20230326162859, brendaneich, timestamps, capture, fail, 2024, 2023, 2022, apr, mar, feb,

Text of the page (random words):
popular version of the library named by the shared attribute and of course it requires that we trust the dns ulp this scheme also avoids embedding inscrutable hashcodes in script tag attribute values your comments are welcome ok back to javascript popularity we know certain ajax libraries are popular is javascript popular it s hard to say some ajax developers profess and demonstrate love for it yet many curse it including me i still think of it as a quickie love child of c and self dr johnson s words come to mind the part that is good is not original and the part that is original is not good yet here we are the web must evolve or die so too with js wherefore es4 about which more anon firefox 3 looks like it will be popular too based on space and time performance metrics more on that soon too categories mozilla uncategorized tags history javascript 27 replies to popularity david roussel says april 4 2008 at 6 13 am i like the hash idea i ties in very well with the ideas put forward by van jacobson in a new way to look at networking https video google com videoplay docid 6972678839686672840 in it he claims the internet which he helped develop is no longer good enough tcp is stream oriented but most applications are data oriented by using data labels like sha1 instead of hostnames and ports you open up possibilities the video is pretty interesting by itself it also reminded me of git s use of sha1 as a data label and also of bittorrent if you are worried about cache poisoning then providing optional extra security could be provided via hmac sha256 or similar so those cases where you really want to be sure it s the right data if the browser supported this for all content then van jacobson s idea would be realised at the top level and then could be later baked into the infrastructure reply john stracke says april 4 2008 at 6 46 am thanks for the look back i was at netscape in 1996 99 but i never heard any of this history for one thing i thought that renaming livescript to javascript was scrambling in reaction to java i didn t realize you d been expecting to support both of them even before 2 0 was released the canonical url idea also depends on trusting the source not to modify the library at that url imagine the dependency hell if people weren t careful about that it d be like a world where applications are locally installed but shared libraries are nfs mounted over the internet reply brendan eich says april 4 2008 at 9 17 am david hmac is great for message passing but since such schemes are vulnerable to birthday collision extension and other attacks and the research is not yet done burning hashes into script tags that live for years or decades still seems like a risk to avoid if we can john nfs shudder i know it well having done the first sgi port back in 85 has its issues but at a high level it s the right model the cdn solution of highly available standard js libraries still seems attractive to me and aol has done it for dojo presuming aol propers in the years ahead this is what all the major search web app sites do y has date named complete versions of scripts and other resources google can serve flat files without breaking a sweat etc the web should be js s hard drive yet because of differential minification and lack of common well known cdn locations too many apps still pay for their own hosting and edge caching of course if shared wins its reason for existing goes away if you could count on connectivity and nine nines of availability and if those cdn hosted libraries were already in place script authors could simply use src and be done but the world is not that ideal shared is meant to lower costs on the evolutionary pathway to that highly available cdn as nfs world the problem of securing the cdn machines seems more easily solved but i don t mean to trivialize it securing the distributed hash equated scripts in all the pages that might use hash on the other hand be reply bertrand le roy says april 4 2008 at 10 19 am wait how does your proposal prevent poisoning it actually seems to make it considerably easier evil site has script src evil js shared https o aolcdn com dojo 1 0 0 dojo dojo xd js if you visit that site first and then visit edge cached startup it will go straight for the cache and run the evil script am i missing something by the way the commenting system on this blog still disallows posting from ie and has various javascript errors reply brendan eich says april 4 2008 at 10 35 am bertrand only the shared value would be shared among script tags the src would be loaded only if there was no cache entry for shared be reply mike ivanov says april 4 2008 at 11 38 am it took almost a decade for average developer to grok javascript now it is understood at least how much time would pass before scheme achieved the same level of acceptance i bet forever thanks for functional features in js anyways reply ric johnson says april 4 2008 at 11 43 am i was unaware of the shared attribute but i have long been proposing a cdn for javascript in fact that is the main reason i purchased openajax com to allow a wiki for editing javascript on the fly for immediate fixing of open source javascript libraries of course we could not serve new javascript until it was vetted by the community but it would exist for your session and if you wanted for your application using a cname reply sean hogan says april 4 2008 at 4 01 pm the second worst case scenario for the shared attribute no one uses it the worst case scenario everyone uses it i e src and shared as per the example code then the canonical url in shared would never get downloaded into the browser cache unlikely scenarios but too funny not to mention a more relevant issue is that shared reduces the library author s control over how his library is used the page author is basically saying use the canonical source but don t let my web page appear in the referer field in the logs a minor issue when the page author changes the version of the library he has to ensure two urls are updated a couple of questions related to dynamic script insertion what happens when a script element has shared but no src does onerror get fired if the shared url isn t in the cache what if the script element has shared no src and text does it act as an inline script unless the shared url is in the cache out of interest are scripts currently stored in the cache pre compiled if not is it on the cards reply brendan eich says april 4 2008 at 4 56 pm sean shared would be background downloaded at low priority if not already cached versioning within the url is already standard see the dojo and yui examples it s the only way to go i agree shared without src is a bug given the legacy installed base scripts are not yet stored precompiled i meant to write a ccache 1 analogue for js in firefox 3 but ran out of time due to other work which is the subject of the next post should happen soon enough but it will be interesting to measure the hit rate too much custom minification and even my never cleared cache may see more misses than hits be reply sean hogan says april 5 2008 at 3 25 am now that you mention it that shared would always be used for cache maintenance is obvious i wasn t calling shared without src a bug i was wondering if it would be a way to check whether a script isn t in the cache reply cinneidesean says april 5 2008 at 11 14 am another chapter in brendan s voyage then https vpri org had a go at javascript describing it as not ultra high level cant comment much further as yet becuase haven t used it except to run the timeline that was floating round mit recently when are you going to create a proper object model reply cinneidesean says april 6 2008 at 2 26 am anyways good luck with the launch scheme is pretty cool and deserves increased attention hopefully hope and history will rhyme on the web soon reply volodymyr lisivka says april 7 2008 at 4 49 am idea with shared attribute is good but it lacks two key stones versioning and automatic dependency management versioning is needed to tell to browser my code is designed to work with libfoo 1 4 2 and to declare on shared site libfoo 1 5 0 is not compatible with code designed for libfoo 1 0 libfoo 1 5 needs bar 1 3 baz 1 0 it is also good idea to sign shared code otherwise domain of shared code can expire somebody can replace old site by it own and crack any selected site in entire internet in two clicks check documentation about existing distributed package management systems for more information you even can integrate one of them apt smart yum into browser instead of implementing wheel again and again i see no problem if page will declare this code need libfoo 1 4 2 to work and browser will issue command apt get install libfoo 1 4 2 repo trusted javascript repository basedir home user mozilla javascript i personally can implement such extension in few days it will be non cross platform however until apt tool will be part of the browser reply brendan eich says april 7 2008 at 11 09 am sean wrote i wasn t calling shared without src a bug i was wondering if it would be a way to check whether a script isn t in the cache the legacy installed base expects a script tag without src to contain code in line which will be evaluated by the browser so we can t impute src from shared if src is missing by bug i meant probably not what the author intended but the browser must carry on as before the background download of the shared attribute could be started even without src that might be handy you wouldn t be able to check the cache this way though volodymyr i don t propose to climb more than one mountain at once signed scripts were tried they are a general pain and so for now they have failed they could make a come back certainly likewise versioning is already handled by cdns such as aol s and yahoo s using url conventions in the path part we should keep talking about how to abstract and improve versioning but it is not easy enough to solve that we should block progress on sharing of popular libraries waiting for versioning innovation be reply ciarang says april 8 2008 at 6 13 am thanks i even found this post interesting enough to be worthwhile scrolling left and right to read every line but i would have much preferred not having to do that in reality i just disabled the stylesheet but that doesn t sound as good reply brendan eich says april 9 2008 at 9 36 am bertrand le roy i don t moderate comments so if you had trouble posting another one please retry and let me know what error you saw so i can try to get the mt installation fixed your blog misuses diatribe look it up and lighten up my memoir here even had a fine bit of broadway for fun and completely misses the point about the hash proposal being unsound doug wrote second browsers can cache by hash code if the cache contains a file that matches the requested hash then there is no need to go to the network regardless of the url this is vulnerable to the poisoned message attack the browser cannot safely index a cache by the value of hash in order to avoid fetching the given url poisoning a url can happen via the dns as i noted but that s a different and much lesser threat the dns can be auto updated and administered stale hash values copied into thousands to millions of web pages cannot be reply bertrand le roy says april 11 2008 at 11 11 am hey brendan i think you re right everyone here needs to lighten up english not being my first language i did look up diatribe and even after doing that i pretty much stand behind my use of the word doug and you have a long history of heated debates which is fine i actually love a good argument and doug apparently started this one to which you answered with some venom of your own but we re not here to discuss the extent of my vocabulary or lack thereof ironically and i swear that s the truth i can t find a trace of your comment on my own post even in the spam folder i have no idea what happened there so on to being on topic i personally don t buy the argument of poisoning by creating an evil script that has the same signature as the legit one this attack remains mainly impractical despite the existing proofs of concept and actually quite a lot of software has been relying on crypto hashes with success even if you buy into that argument i ve shown on my own post which you ve read a third approach which i think avoids that problem and also solves the problem of having a weird crypto string in the markup which i admit is a legitimate concern that you raised i m not a security expert so i admit i may be missing something here if i m wrong i d like to understand how finally as i ve said before i must be missing something about your approach because i still don t see how it s more secure than doug s what prevents an attacker to have a page that poisons the cache of any visitor that goes there first with a script that has the same shared attribute as a legitimate script reply brendan eich says april 11 2008 at 2 20 pm bertrand and i have been emailing and i believe he no longer backs diatribe i m also explaining the shared idea in more detail it was sketched here in a way that required some thought on the reader s part and the willingness to assume i m not dumb be reply tom palmer says april 25 2008 at 7 26 am i ve long recommended hash matching at the http header level it requires some server support but that would be easily done for needed cases and it would work across all content types and avoids the copy and paste problem reply brendan eich says april 25 2008 at 1 49 pm tom hash matching for integrity could be helpful but how do you avoid re downloading different dojo or jquery copies in order to have a content addressed cache if the hash is in the response header then you ve already started if not finished the download be reply tom palmer says april 28 2008 at 10 49 am use a variation on if none match but rather than the server dependent etag use an externally defined algorithm like sha 1 the browser would calculate the hash for resources like large js files and store a mapping from base file name to sha 1 hash if there was another request for a file with the same base file name or perhaps heuristics based on a subset of the path and i think there could be some simple pattern here the browser would send up a header like if not match hash to the server along with the original file request reply patrick dubroy says may 27 2008 at 6 31 pm interesting discussion here i m not sure the poisoned message attack applies in the case of doug s suggestion i thought that it required you to be able to generate both documents in order to find a colliding hash but given some arbitrary hash it s not necessarily easy to generate another document with the same hash reply brendan eich says june 22 2008 at 11 31 pm patrick the problem with long lived hashes copied all over the web is exactly the longevity combined with what we don t know it s not necessarily easy you wrote about the strength of...