Hacker News Reader

Comment by animationwill | Hacker News Reader

>> Before a user clicks on a link, they hover their mouse over that link. When a user has hovered for 65 ms there is one chance out of two that they will click on that link, so instant.page starts preloading at this moment, leaving on average over 300 ms for the page to preload.

This sounds great! I immediately wonder how many additional HTTPS requests will hit your web server fleet. Has anyone using this calculated a percentage of additional requests vs additional clicks from their http logs?

View on HN

In my case it was multiple extra requests (7x?) it was enough that we could see a degradation in server response times.

Even with that extra server load we still saw improvements visitor performance as measuring using Real User Monitoring

A neat hack would be to have it prefetch only pages already cached on the server (though those are the least in need of speeding up). Or maybe the prefetch requests go into a separate queue at a lower priority.

Isn't that how modern preloading works on browsers already?

So my browser starts loading a page from a link that I haven't clicked. Does anyone else see the potential security nightmare on this scenario?

Drive-by downloads, malware, etc. I totally get the benefits of this mechanism until it starts being abused for tracking and delivery malware, and then add-ons will (hopefully) appear to block this.

What, how is this a security nightmare? What's your threat model? You think I, the website operator, am the enemy? Then I can just window.location you. You think the website operator is hosting compromising links because they've been suckered? But then once you click them you're going to be compromised.

I swear to God, so many HN comments just say "security nightmare" for everything.

It's no different than any other javascript enabled browser + web page.

The modern web is pulling in the background all the time.

You'd have to go back decades for 1 click to equal 1 GET.

Funnily enough, HN therefore seems to be a time traveler from decades ago :)

7 requests per page load. No, I don't think so.

None of which are javascript-triggered.

The preloaded page won't get rendered until you click on it. Assuming that malware activates only by rendering, not simply by downloading, this seems safe.

You would also want to break out CDN requests versus http server requests; theoretically, CDN requests are cheaper than requests to your server fleet.

Sounds like that could fraud statistics like GA

>only the HTML is preloaded

They say two loads per click, so it sounds like you'll have 100% increase rate in requests less hovers under 65ms that click.

Reply on news.ycombinator.com