Disqus - Latest Comments for andydavies

Re: Three Ways of Checking Rel=preconnect Resource Hints Are Working

andydavies — Wed, 12 Jan 2022 11:45:29 -0000

Interesting - I see HIGHEST used for the connection the document comes over, and MEDIUM for the connection that favicon was requested on

https://uploads.disquscdn.c... https://uploads.disquscdn.c...

Re: Capturing and Decrypting HTTPS Traffic From iOS Apps

andydavies — Sun, 21 Feb 2021 08:29:35 -0000

I haven't tried decrypting a pcap yet but for iOS14.4 setting the offset to 0x2b8 and then executing the command below definitely produces TLS secrets for me

frida -U -n com.apple.WebKit.Networking -l ios-tls-keylogger.js

For example this is loading Wikipedia

CLIENT_HANDSHAKE_TRAFFIC_SECRET a2794b3202f063d046df90a5e73860c7a7dce4d325283d966447767f3fb5d7c3 dbe836a35b2677c7ddf630f751ba210822f67ff666ef571ef3161566181dbcb14ea0501cd6a71022806cd6b586140015
SERVER_HANDSHAKE_TRAFFIC_SECRET a2794b3202f063d046df90a5e73860c7a7dce4d325283d966447767f3fb5d7c3 2010e37eb28f13f7621abc0b192ab5be354c031c10d0484bc547af361998a99e6bd85cca0da2bc5aa701d9433d1a6c68
CLIENT_TRAFFIC_SECRET_0 a2794b3202f063d046df90a5e73860c7a7dce4d325283d966447767f3fb5d7c3 45cbf18d77a2e93aca168b3c7df8cf7b1f4a0cf7f982f2e2a0293a5cfa90c4e5226562be3fd1ccf3833fb4817366b9a2
SERVER_TRAFFIC_SECRET_0 a2794b3202f063d046df90a5e73860c7a7dce4d325283d966447767f3fb5d7c3 c11606a60415733c6904c44e59d5ad0afb684d1769e4b860aa443c6a86d93238138e5ff96717744666964afdaa1fbc6d
EXPORTER_SECRET a2794b3202f063d046df90a5e73860c7a7dce4d325283d966447767f3fb5d7c3 39b1b9f8f4bc072a54055ee66b259b2a411dfcc18ad4bafaf991ec10955401274605e3579d93d845ce42e32835b30635
CLIENT_HANDSHAKE_TRAFFIC_SECRET 278cda1b209376c1ae777b17854944876015f7f6ada0ab04ea1210cffb1b3d6e 4f3808c34175a9fee727291541d485077d08dfb062a4a61595b60a3bbefa1e7af53ad11ea3f16d566bfe5d7794546411
SERVER_HANDSHAKE_TRAFFIC_SECRET 278cda1b209376c1ae777b17854944876015f7f6ada0ab04ea1210cffb1b3d6e 5c723134d732f72e809a4de324d0a9b267294dc26318699fbce5608d41dc044fa29d3516d7fadd41f6d58d4b7c8325e1
CLIENT_TRAFFIC_SECRET_0 278cda1b209376c1ae777b17854944876015f7f6ada0ab04ea1210cffb1b3d6e ea81073773b9d5080a00295ebc40d411b26d055c4c7e74f9eba6a0e4364dc1cc2bb0617565fd8ee674bb81107f25f25f
SERVER_TRAFFIC_SECRET_0 278cda1b209376c1ae777b17854944876015f7f6ada0ab04ea1210cffb1b3d6e 50cc0c815ace49cf14040de25c7cd7b0c869fdd2dff996d3c2a6741a439339e009d699d53ffaa113b03382769a8be1b4
EXPORTER_SECRET 278cda1b209376c1ae777b17854944876015f7f6ada0ab04ea1210cffb1b3d6e 25ecd5ce021e4b532cc4a39a019c7b881bca43ee189b13040ed933e0a25b105f79803790d38eecf21fe45040e7238e72

I really should write the follow-up to this post as I forget how to fix and test when this breaks (not doing much with Frida etc ATM)

Re: Measuring the Impact of 3rd-Party Tags with WebPageTest - Andy Davies

andydavies — Tue, 26 Jan 2021 05:44:30 -0000

WebPageTest is viewed as one of the most accurate tools in the web performance industry, even the Lighthouse developers say it's the best place to get an accurate Lighthouse result

WebPageTest uses network shaping at the OS level whereas by default Lighthouse runs and them models what the result would be over 3G (using something called Lantern)

If you've ot any examples you can share I might be able to explain what's happening

Re: The Case Against Anti-Flicker Snippets

andydavies — Wed, 18 Nov 2020 11:47:27 -0000

Thanks, knew SiteSpect was one of the few CMSs that supports server-side A/B testing, my issue is that far more should!

Re: Reducing the Speed Impact of Third-Party Tags - brightonSEO by Rough Agenda

andydavies — Fri, 02 Oct 2020 05:24:16 -0000

I think you're going to need to take a two-phased approach

Either use Window Loaded as the trigger in GTM/Adobe Launch, and then check the cookie policy as part of injecting the tag

or you could use the existing approach and wrap the tag snippet in a window loaded event handler

window.addEventListener('load', function() {
/* insert contents of tag here */
});

Feel free to drop me an email if you want to describe it in more detail

Re: Reducing the Speed Impact of Third-Party Tags - brightonSEO by Rough Agenda

andydavies — Fri, 02 Oct 2020 04:03:16 -0000

Slides for my talk are available on Notist – https://noti.st/andydavies/...

And later today they'll be a blog post covering the main points to the talk, adding a bit more detail and some points I didn't have time to fit in (still tidying it up ATM)

https://andydavies.me/blog/...

Re: Exploring Site Speed Optimisations With WebPageTest and Cloudflare Workers

andydavies — Wed, 23 Sep 2020 11:51:58 -0000

Thanks, fixed it, thought I'd checked it was working with curl but perhaps not!

Re: Capturing and Decrypting HTTPS Traffic From iOS Apps

andydavies — Fri, 14 Aug 2020 10:18:20 -0000

I'll write up or make a screencast explainer - will probably be over the weekend

Re: Rel=prefetch and the Importance of Effective HTTP/2 Prioritisation

andydavies — Mon, 03 Aug 2020 03:12:24 -0000

I think there are a few challenges with doing this effectively

First one is that the whole HTML response will need to be scanned before the headers can be sent, which effectively breaks the streaming nature of HTML responses.

Then there's the choice of determining which origins should a preconnect be created for, and what impact that has on page performance.

• There's probably not much to be gained by preconnecting to origins referenced in the head, as the browser is going to discover these really quickly
* There may be some advantage preconnecting to origins from the body as Chrome delays these requests (see the stair-step in the waterfall) and doesn't make a connection until just before making the requests. Here's an example of where it can make a difference - https://andydavies.me/blog/...
* As H2 prioritisation only works on a single connection, requests aren't prioritised between origins. So preconnecting can 'bring requests forward' and resulting in increased contention and slower overall page loads
* Preconnects are cheap but they're not free as there's a certificate exchange. The certificate exchange competes with other (perhaps more critical) resource for network bandwidth

With the odd exception I tend to stick with preconnect for resources that are late discovered - stuff injected via JS, tag managers etc.

That's the theory, but the only way to a good picture is to run experiments over a large corpus of pages and see what the impact is.

To overcome the delay of scanning the document every time, you could just scan it occasionally, and store the preconnect values by URL in Cloudflare's KV store.

You could also have allow, or disallow lists based on URLs or resource types so you could tune which preconnects are used.

Akamai use RUM data to automatically inject some preconnects so there a definitely people trying the automated approach.

Would love to see how you get on!

Re: Capturing and Decrypting HTTPS Traffic From iOS Apps

andydavies — Sat, 13 Jun 2020 03:38:10 -0000

From a quick scan of the code in Hopper, it looks like the secrets should still be dumped - strings and code to do it are still there.

Just acquired a 13.5 test phone so I'll jailbreak it over the weekend and explore further.

Re: Capturing and Decrypting HTTPS Traffic From iOS Apps

andydavies — Fri, 05 Jun 2020 13:04:12 -0000

I'm mainly interested in how the client and the server interact / behave at a protocol level and adding a proxy in the middle alters their behaviour.

I've used mitmproxy in the past but didn't think it was the right tool here

Re: Capturing and Decrypting HTTPS Traffic From iOS Apps

andydavies — Fri, 05 Jun 2020 12:57:28 -0000

I did but somehow Disqus swallowed the comment

offset for iOS 13.5 is 0x2c0

Checked this on versions of boringssl extracted from 6s and 11 Pro updaters

Will amend the post to add how to do this (or write another)

Re: Capturing and Decrypting HTTPS Traffic From iOS Apps

andydavies — Sun, 31 May 2020 09:18:10 -0000

Seem my comments to Jan - that might or might not fix the issue

Re: Capturing and Decrypting HTTPS Traffic From iOS Apps

andydavies — Sun, 31 May 2020 08:13:52 -0000

I suspect the offset of the logging function pointer has changed - I don't have a iOS 13.5 test device ATM but will unpack the libs and see what the offset is

Re: null

andydavies — Sat, 26 Oct 2019 09:26:10 -0000

Any news on when Cloudfront's HTTP/2 prioritisation issues are going to be addressed?

There's the potential to improve the experience for many, many people

Re: Three Ways of Checking Rel=preconnect Resource Hints Are Working

andydavies — Wed, 23 Oct 2019 05:25:27 -0000

On that test page, the image will always be after the the script as the element is inserted using document.write (in real case the image will be requested after due to Chrome's prioritisation mechanism)

I'm seeing the same issue as you in Chrome on MacOS - it's strange will see if I can debug it later today

Re: UK Man Invents Aluminum Air Battery In His Garage

andydavies — Tue, 22 Oct 2019 03:37:44 -0000

Although newly formed, Austin Electric exists - https://beta.companieshouse...

Follow the people to find the other businesses

Re: Modern Script Loading

andydavies — Sat, 28 Sep 2019 03:54:16 -0000

Nice exploration of a complex area, which hopefully is going to get simpler over time!

While it's not that relevant to the point you're making in the rest of the post you might want to add defer to the nomodule example at the top of the post to make it equivalent to the module version's loading behaviour.

Re: Preloading Fonts and the Puzzle of Priorities

andydavies — Fri, 14 Jun 2019 06:39:04 -0000

I would expect that to work but I didn't try it as short-term workarounds tend to become tomorrows maintenance headache.

Before it become to expensive to query I had a good look at the HTTP Archive data and there are some sites doing this, along with others that are preloading tens of assets (I suspect to work around the issue)

Re: Preloading Fonts and the Puzzle of Priorities

andydavies — Wed, 13 Feb 2019 03:50:11 -0000

I've got reservations about coding dependencies like that into the markup as it potentially limits what browsers can do in the future, and relies on authors to understand the browser's priorities too.

Once the AppCache issue is resolved, between preload, priority hints, and maybe even position of the preload directives in the document we'll have a bunch of tools just got to work out what we can do with them

Re: Measuring the Impact of 3rd-Party Tags with WebPageTest - Andy Davies

andydavies — Mon, 19 Mar 2018 10:49:44 -0000

I tend to focus on the render blocking ones first - often A/B or MV Testing - but see clients put all sorts of things in head.

After that I look for tags that are delaying TTI, or blocking the main thread (with JS execution)

For tags that load after onload, I tend to focus on their runtime rather than network impact

Re: Visiting a site that uses Disqus comments when not logged in sends the URL to Facebook

andydavies — Fri, 06 Jan 2017 13:59:40 -0000

I'd noticed it and was planning to use the Content-Security-Policy header to prevent it

Re: Saving 7 terabyte a day: fixing Font Awesome's fonts

andydavies — Sun, 11 Dec 2016 15:00:28 -0000

Yeh but there's no guarantee that it will be in the browsers cache, and if it's not then there's the overhead of a DNS lookup and new TCP connection (possibly involving TLS negotiation) to a new host.

Based on studies from Facebook (and previously Yahoo!) it appears responses don't remain in the cache for very long - https://code.facebook.com/p...

Re: Accelerated Mobile Pages - I’ve Got More Questions Than Answers

andydavies — Sat, 07 May 2016 05:41:37 -0000

Thanks for letting me know, should work now - the permissions appear to have got broken somewhere

Re: Eliminating Roundtrips with Preconnect

andydavies — Mon, 17 Aug 2015 15:33:36 -0000

Looking at the messages that come through the extension API, it appears there's nothing that WPT can use to pickup the timings for the preconnect phases.