inian

A shoutout to Fastify[1] here. It has lived up to its claim of being one of the fastest Node frameworks from our initial benchmarking. We plan to add the benchmarking scripts to our benchmarking repo[2] soon.

The entire Fastify ecosystem (and associated modules like pino) has a focus on performance which is great. For example, the file-handling middleware[3] uses Node streams by default, instead of buffering files in memory. This made it easy to use streams across our entire codebase. Besides performance, this keeps the footprint small which ensures consistent performance even for users on our smallest server configuration.

[1] https://www.fastify.io/

[2] https://github.com/supabase/benchmarks

[3] https://github.com/fastify/fastify-multipart

I absolutely agree. Connecting via Postgrest happens already over SSL. But to secure direct connections to the database, this is critical. We have the basic infrastructure for this in place already and will be rolling this out to all projects by the end of the next week :)

AWS Aurora speaks the Postgres (and MYSQL) protocol and I don't even think it is fully Postgres under the hood.

We use Postgres Row Level Security to implement the authorization. You can create your own policies from the dashboard too. You can read more about it here: https://supabase.io/blog/2020/08/05/supabase-auth

I have been bitten by Firebase scalability restrictions before, so good to see alternatives coming up. How do you compare to Supabase (http://supabase.io/)?

Same thing happening on Github - https://www.youtube.com/watch?v=4zG0AZRZD6Q https://jakearchibald.com/2016/fun-hacks-faster-content/

Google is depreciating the xss auditor anyway - https://portswigger.net/daily-swig/google-deprecates-xss-aud...

Might help - https://developer.chrome.com/devtools/docs/blackboxing

I have constantly heard that they can't reliably measure the performance of a website unless it is AMP. I don't buy this argument at all. Google already has mentioned to using site speed for as a minor ranking factor, why can't they use the same methodology for putting websites in the carousell too?

Also, they have Real user data for over a million websites - https://developers.google.com/web/updates/2017/12/crux

This is a way better indicator of site speed as opposed to if the site is AMP or not. Would be so cool if Google used this data as a pre condition to put sites into the carousell!

They do..for over a million websites! https://developers.google.com/web/updates/2017/12/crux

This data is a much better indicator of how fast a page is vs if it is AMP or not.

Starting from Node.js 8.7.0, you can build a fully featured HTTP/2 server using just the Node core. You can use advanced features like HTTP/2 PUSH and Node also exposes a compatibility API with HTTP/1.1 to easily migrate your application to HTTP/2.

> I think the author would benefit from learning about how web frameworks work, or perhaps how web specs mandate that your browser works.

Haha, he is the creator of Ember.js. I think he knows a thing or two about web frameworks ;)

Updated numbers with Dev versions of other browsers - https://twitter.com/bmeurer/status/871962560324657153

The difference in speed is much lesser. Wonder how this will all change by the time their technical preview actually makes it to stable.

So the argument is Linux is more secure now because hackers aren't paying enough attention to it. That is no reason to gloat about how Microsoft is bad in terms of security.

How is Linux immune to wannacry like attacks?

I had filed an intervention to prevent websites from disabling the paste functionality in password fields - https://github.com/WICG/interventions/issues/41

I find it surprising that they are still going strong on AMP. I tend to club AMP along with Instant Articles, etc. Any thoughts on as to why this is the case?

this was in relation to Project Feather of the Youtube - the Youtube website did not even load before for them and when it did, they started watching more videos even though it took more than 20 seconds to load!

I meant without downloading a 40 MB binary upfront.

Exactly why a website makes more sense. You get the latest version by just reloading the page.

Prev and prev to prev HN discussions https://news.ycombinator.com/item?id=12888921

If only it were as simple as that. AMP websites get a place in the search carousel of Google. So even if your website loads faster than an AMP page, it would not be placed in the carousel - and that's Google forcing companies to adopt AMP even if they already have a fast website.

We need tools to help developers build fast websites. If all websites were as fast as AMP and Instant Articles, these platforms would become obsolete. It is in our hands as developers to take back control and make the web as decentralised as possible.

It would be cool if you could share your findings here too! - https://github.com/google/guetzli/issues/10

This can be achieved just by using the publicly available HTTP Archive data set and Google's Big Query to search it.

My issue is with the no-modification part. This is the exact argument he gives for not using some software - that users are not free to modify the software and hence it is malicious.

From what I see, copyleft strictly allows for modification too, as long as the derived work also is licensed under the same terms. His clause prevents any modification.

I can say the same argument about commercial software. They do not want you to modify their software for you to inject say malware in them. Just cos they don't want you to do that, it doesn't make their software not free.

"Verbatim copying and redistribution of this entire page are permitted provided this notice is preserved." - Stallman's blog is not giving me the freedom to distribute the blog as please. It is infringing on my freedom.

Anyone else find this ironic / hilarious?