WIP: 2020 Third Parties Chapter #1668

simonhearne · 2020-12-08T12:01:03Z

Progress on #901

tunetheweb · 2020-12-08T12:13:57Z

src/content/en/2020/third-parties.md

+
+<p id="gdcalert10" ><span style="color: red; font-weight: bold">>>>>>  gd2md-html alert: inline image link here (to images/image10.png). Store image on your image server and adjust path/filename/extension if necessary. </span><br>(<a href="#">Back to top</a>)(<a href="#gdcalert11">Next alert</a>)<br><span style="color: red; font-weight: bold">>>>>> </span></p>
+
+![alt_text](images/image10.png "image_tooltip")


@simonhearne If you change these WIP items to Jinja2 comments then it won't fail the pipeline and so will give you real feedback on any real issues:

Suggested change

![alt_text](images/image10.png "image_tooltip")

{# ![alt_text](images/image10.png "image_tooltip") #}

simonhearne · 2020-12-08T12:20:43Z

Thanks, yes I'll be adding the images and fixing those shortly.

…

On Tue, 8 Dec 2020, 12:14 Barry Pollard, ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In src/content/en/2020/third-parties.md <#1668 (comment)> : > + +>>>>> gd2md-html alert: inline image link here (to images/image9.png). Store image on your image server and adjust path/filename/extension if necessary. (<a href="#">Back to top</a>)(<a href="#gdcalert10">Next alert</a>) >>>>> + +![alt_text](images/image9.png "image_tooltip") + +The results show that the majority of 3XX responses are small: the 90th percentile is 420B (i.e. 90% of 3XX responses are 420 bytes or smaller). The 95th percentile is 6.5kB and the 99th is 36kB! Whilst redirects may seem innocuous, 36kB is a reasonable amount of bytes over the wire for a response that simply leads to another response! + +## Early-loaders + +Scripts that load late in the page will have an impact on total page load duration and page weight, but might have no impact on the user experience. Scripts that load early in the page, however, will potentially cannibalize bandwidth for critical first-party resources and are more likely to interfere with the page load. This can have a detrimental impact on performance metrics and user experience. + +The chart below shows the percentage of requests that load early, by device type and third-party type. The three stand-out categories are CDN, Hosting and Tag Managers, all of which tend to deliver JavaScript that is requested in the head of a document. + +>>>>> gd2md-html alert: inline image link here (to images/image10.png). Store image on your image server and adjust path/filename/extension if necessary. (<a href="#">Back to top</a>)(<a href="#gdcalert11">Next alert</a>) >>>>> + +![alt_text](images/image10.png "image_tooltip") @simonhearne <https://github.com/simonhearne> If you change these to Jinja2 comments then it won't fail the pipeline and so will give you real feedback on any real issues: ⬇️ Suggested change -![alt_text](images/image10.png "image_tooltip") +{# ![alt_text](images/image10.png "image_tooltip") #} — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1668 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADZEPMVJPAUGVPUWSR7IYDSTYKBNANCNFSM4UR3XLRA> .

rviscomi · 2020-12-08T23:32:16Z

src/content/en/2020/third-parties.md

 reviewers: [tammyeverts, jzyang]
 analysts: [max-ostapenko]


Also update contributor metadata when you get a chance. List everyone who contributed, remove those that didn't, and order roughly by significance of their contributions (as a courtesy to those that did more)

paulcalvano

Nice work @simonhearne. This is excellent. I added a few comments/suggestions in this review.

paulcalvano · 2020-12-09T02:07:34Z

src/content/en/2020/third-parties.md

+### Caveats
+
+* All data presented here is based on a non-interactive, cold load. These values could start to look quite different after user interaction.
+* The pages are tested with no cookies set, so third-parties requested after opt-in are not included. This will especially affect pages hosted and predominantly served to countries in scope for the [General Data Protection Regulation](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation).


In the context of GDPR, it may also be important to mention that all of these measurements were performed on servers in the US.

Also worth including a link to the methodolgy - https://almanac.httparchive.org/en/2020/methodology

paulcalvano · 2020-12-09T02:14:08Z

src/content/en/2020/third-parties.md

+
+The sixth most common domain is digicert.com.  Calls to digicert.com are generally OCSP revocation checks due to TLS certificates not having OCSP stapling enabled, or the use of Extended Validation (EV) certificates which prevent pinning of intermediate certificates. This number is exaggerated in HTTP Archive due to all page loads being effectively first-time visitors - OCSP responses are generally valid for seven days in real-world browsing. See [this blog post](https://simonhearne.com/2020/drop-ev-certs/) to read more on this issue.
+
+Further down the list at 2.43% is ajax.googleapis.com, Google's [Hosted Libraries project](https://developers.google.com/speed/libraries). Whilst loading a library such as jQuery from a hosted service is easy, the additional cost of a connection to a third-party domain may have a negative impact on performance. It is best to host all critical JavaScript and CSS on the root domain, if possible. There is also now no cache benefit to using a shared CDN resource, as all major browsers [partition caches by page](https://developers.google.com/web/updates/2020/10/http-cache-partitioning).


Harry Roberts wrote an excellent blog post about self hosting static assets last year, which may be worth linking to here. https://csswizardry.com/2019/05/self-host-your-static-assets/

paulcalvano · 2020-12-09T02:18:32Z

src/content/en/2020/third-parties.md

+  )
+}}
+
+The results show that the majority of 3XX responses are small: the 90th percentile is 420B, i.e. 90% of 3XX responses are 420 bytes or smaller. The 95th percentile is 6.5kB, the 99th is 36kB and the 99.9th is over 100kB! Whilst redirects may seem innocuous, 100kB is a reasonable amount of bytes over the wire for a response that simply leads to another response.


Suggested change

The results show that the majority of 3XX responses are small: the 90th percentile is 420B, i.e. 90% of 3XX responses are 420 bytes or smaller. The 95th percentile is 6.5kB, the 99th is 36kB and the 99.9th is over 100kB! Whilst redirects may seem innocuous, 100kB is a reasonable amount of bytes over the wire for a response that simply leads to another response.

The results show that the majority of 3XX responses are small: the 90th percentile is 420B, i.e. 90% of 3XX responses are 420 bytes or smaller. The 95th percentile is 6.5kB, the 99th is 36kB and the 99.9th is over 100kB! Whilst redirects may seem innocuous, 100kB is an unreasonable amount of bytes over the wire for a response that simply leads to another response.

paulcalvano · 2020-12-09T02:23:28Z

src/content/en/2020/third-parties.md

+
+## Repercussions
+
+We know that adding arbitrary JavaScript to our sites introduces risks to both site speed and security. Site owners must be diligent to balance the value of the third-party scripts they include with the speed penalty they may bring, and use modern features such as [subresource integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) and [content security policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) to maintain a strong security posture.


Might be worth referencing the security chapter here, since that should cover both SRI and CSP adoption.

rviscomi · 2020-12-09T04:52:45Z

Merging and iterating

Paul's feedback can be resolved in a follow-up PR

first draft from GDocs

6d64fce

simonhearne added the writing Related to wording and content label Dec 8, 2020

simonhearne added this to the 2020 Content Writing milestone Dec 8, 2020

simonhearne requested review from rviscomi, jzyang and tammyeverts December 8, 2020 12:01

simonhearne self-assigned this Dec 8, 2020

tunetheweb reviewed Dec 8, 2020

View reviewed changes

simonhearne added 2 commits December 8, 2020 15:18

add images

2617de2

more descriptive link text for Lighthouse audit

7269369

rviscomi added the ASAP This issue is blocking progress label Dec 8, 2020

simonhearne added 4 commits December 8, 2020 18:18

update body

5ffa5df

update images

0efc485

improve image quality

57dafb1

add interactive charts

b18ed0d

rviscomi requested changes Dec 8, 2020

View reviewed changes

rviscomi requested a review from paulcalvano December 9, 2020 01:19

rviscomi assigned paulcalvano Dec 9, 2020

paulcalvano requested changes Dec 9, 2020

View reviewed changes

rviscomi merged commit fc1ba62 into HTTPArchive:main Dec 9, 2020

simonhearne mentioned this pull request Dec 9, 2020

Third-Party 2020 - Minor Edits #1695

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: 2020 Third Parties Chapter #1668

WIP: 2020 Third Parties Chapter #1668

simonhearne commented Dec 8, 2020 •

edited by rviscomi

Loading

tunetheweb Dec 8, 2020 •

edited

Loading

simonhearne commented Dec 8, 2020 via email

rviscomi Dec 8, 2020

paulcalvano left a comment

paulcalvano Dec 9, 2020

paulcalvano Dec 9, 2020

paulcalvano Dec 9, 2020

paulcalvano Dec 9, 2020

rviscomi commented Dec 9, 2020


		<p id="gdcalert10" ><span style="color: red; font-weight: bold">>>>>> gd2md-html alert: inline image link here (to images/image10.png). Store image on your image server and adjust path/filename/extension if necessary. </span><br>(<a href="#">Back to top</a>)(<a href="#gdcalert11">Next alert</a>)<br><span style="color: red; font-weight: bold">>>>>> </span></p>

		![alt_text](images/image10.png "image_tooltip")

	![alt_text](images/image10.png "image_tooltip")
	{# ![alt_text](images/image10.png "image_tooltip") #}


		The sixth most common domain is digicert.com. Calls to digicert.com are generally OCSP revocation checks due to TLS certificates not having OCSP stapling enabled, or the use of Extended Validation (EV) certificates which prevent pinning of intermediate certificates. This number is exaggerated in HTTP Archive due to all page loads being effectively first-time visitors - OCSP responses are generally valid for seven days in real-world browsing. See [this blog post](https://simonhearne.com/2020/drop-ev-certs/) to read more on this issue.

		Further down the list at 2.43% is ajax.googleapis.com, Google's [Hosted Libraries project](https://developers.google.com/speed/libraries). Whilst loading a library such as jQuery from a hosted service is easy, the additional cost of a connection to a third-party domain may have a negative impact on performance. It is best to host all critical JavaScript and CSS on the root domain, if possible. There is also now no cache benefit to using a shared CDN resource, as all major browsers [partition caches by page](https://developers.google.com/web/updates/2020/10/http-cache-partitioning).

	The results show that the majority of 3XX responses are small: the 90th percentile is 420B, i.e. 90% of 3XX responses are 420 bytes or smaller. The 95th percentile is 6.5kB, the 99th is 36kB and the 99.9th is over 100kB! Whilst redirects may seem innocuous, 100kB is a reasonable amount of bytes over the wire for a response that simply leads to another response.
	The results show that the majority of 3XX responses are small: the 90th percentile is 420B, i.e. 90% of 3XX responses are 420 bytes or smaller. The 95th percentile is 6.5kB, the 99th is 36kB and the 99.9th is over 100kB! Whilst redirects may seem innocuous, 100kB is an unreasonable amount of bytes over the wire for a response that simply leads to another response.


		## Repercussions

		We know that adding arbitrary JavaScript to our sites introduces risks to both site speed and security. Site owners must be diligent to balance the value of the third-party scripts they include with the speed penalty they may bring, and use modern features such as [subresource integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) and [content security policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) to maintain a strong security posture.

WIP: 2020 Third Parties Chapter #1668

WIP: 2020 Third Parties Chapter #1668

Conversation

simonhearne commented Dec 8, 2020 • edited by rviscomi Loading

tunetheweb Dec 8, 2020 • edited Loading

Choose a reason for hiding this comment

simonhearne commented Dec 8, 2020 via email

rviscomi Dec 8, 2020

Choose a reason for hiding this comment

paulcalvano left a comment

Choose a reason for hiding this comment

paulcalvano Dec 9, 2020

Choose a reason for hiding this comment

paulcalvano Dec 9, 2020

Choose a reason for hiding this comment

paulcalvano Dec 9, 2020

Choose a reason for hiding this comment

paulcalvano Dec 9, 2020

Choose a reason for hiding this comment

rviscomi commented Dec 9, 2020

simonhearne commented Dec 8, 2020 •

edited by rviscomi

Loading

tunetheweb Dec 8, 2020 •

edited

Loading