Better HTTP/2 Prioritization for a Faster Web(blog.cloudflare.com)
blog.cloudflare.com
Better HTTP/2 Prioritization for a Faster Web
https://blog.cloudflare.com/better-http-2-prioritization-for-a-faster-web/
11 comments
well h2 for development is really hard since basically you need to create a certificate, because no major browser implements h2 over plaintext. i mean a lot of people can live with that and just insert a development certificate into their trust chain, but some people do not understand that and others work in more restricted environments. so basically fully controlling and developing with h2 is basically not as easy as it was with http/1.
For server development the hard part is simulating realistic network conditions. For example, on localhost, you'll never witness any prioritization happening, because you'll never grow a queue of responses still waiting to be sent down.
Browser Dev tools pretty much cover that in one click these days.
Getting a valdid certificate with letsencrypt is, once you’re a tiny bit familiar with certbot, a matter of minutes.
Has anyone just published a valid certificate for a domain name that resolves to 127.0.0.1?
For your own use, you can obtain a certificate via DNS validation, or by pointing your DNS A records to a server with a public IP.
When you publish the private key online, anyone can revoke the certificate, or the CA themselves will.
When you publish the private key online, anyone can revoke the certificate, or the CA themselves will.
It seems like this is another example of every aspect of web development getting more complicated, favoring the larger players. On the other hand, it's good that in this case, any website could just buy the results of that expertise.
You are not wrong - in reality we have had a tiered internet for years now, where big sites pay for faster transfers over better routes.
However nothing says you actually have to use these fancy services. Everyone wants a quick loading site but the drawback of an extra 100ms are minimal. Almost everyone should be more concerned with good site design and minimizing client-side dependencies if they want good performance.
However nothing says you actually have to use these fancy services. Everyone wants a quick loading site but the drawback of an extra 100ms are minimal. Almost everyone should be more concerned with good site design and minimizing client-side dependencies if they want good performance.
Why would you say extra 100ms is a minimal drawback? Google obsesses over load time because faster load time means more ad dollars generated.
700ms vs 800ms is the difference between acceptable and a slow loading web site.
700ms vs 800ms is the difference between acceptable and a slow loading web site.
https://www.google.com/ has 2.76s load time for me. Gmail 6.33s. Amazon 1.41s. Aliexpress 2.69s. Seems like entire Internet is slow?
It matters for websites, but only after fixing many other problems with performance and usability.
For an individual user, it doesn't matter to me if I use a website a bit less because it's a little slower. That might even be an improvement, since I was probably using the Internet too much anyway.
For an individual user, it doesn't matter to me if I use a website a bit less because it's a little slower. That might even be an improvement, since I was probably using the Internet too much anyway.
> It matters for websites, but only after fixing many other problems with performance and usability.
Or does it? Once you fix major performance, usability problems and it starts to feel fast - other efforts become kind of pointless and may even become sources of performance, usability problems themselves.
Or does it? Once you fix major performance, usability problems and it starts to feel fast - other efforts become kind of pointless and may even become sources of performance, usability problems themselves.
It's important to remember that with the death of net neutrality in the US, this may not be the case forever.
I would compare it more to RSS vs. more complicated protocols like WebSub. HTTP/1.0, like RSS, isn't going away; and when you're a smaller player, it's really all you need. It's only the larger players that actually have requirements that make optimizations like HTTP/2 necessary for their operating expenses to stay sane, rather than just "nice-to-have but an unnoticeable blip on their margins."
"Web pages are made up of dozens (sometimes hundreds) of separate resources that are loaded and assembled by the browser into the final displayed content."
Could that be the reason that that the web needs to be "faster" (despite tremendous advances in CPU, storage, bandwidth and network speeds)?
The dozens (sometimes hundreds) of separate resources are loaded by default.
What is their purpose? Where do they come from? Are all of them necessary?
What if an advanced user could tell the browser to only load certain resources from certain sources?
For example, maybe skip certain ads and tracking, as specified by the user.
Perhaps do not load the Facebook "Like" buttons (images), but load all other images.
Control exactly which Javascripts to load.
In addition to the options that browsers now provide, provide more fine-grained controls.
Could that make the web faster?
A bonus would be if these user-defined, fine-grained browser settings could be saved in a portable, interoperable format, e.g. to external media, in addition to being able to save them to "the cloud" (which may be servers run by advertising-supported browser authors). Browser authors do not need to know which resources users may wish to block.
Could that be the reason that that the web needs to be "faster" (despite tremendous advances in CPU, storage, bandwidth and network speeds)?
The dozens (sometimes hundreds) of separate resources are loaded by default.
What is their purpose? Where do they come from? Are all of them necessary?
What if an advanced user could tell the browser to only load certain resources from certain sources?
For example, maybe skip certain ads and tracking, as specified by the user.
Perhaps do not load the Facebook "Like" buttons (images), but load all other images.
Control exactly which Javascripts to load.
In addition to the options that browsers now provide, provide more fine-grained controls.
Could that make the web faster?
A bonus would be if these user-defined, fine-grained browser settings could be saved in a portable, interoperable format, e.g. to external media, in addition to being able to save them to "the cloud" (which may be servers run by advertising-supported browser authors). Browser authors do not need to know which resources users may wish to block.
It used to be that websites would optimize their icons by putting them all in a single gif. But this isn't supposed to be necessary anymore.
Humans don't naturally optimize down to the byte level, be it a whole foods cashier who takes an extra 30 seconds to bag your groceries, an airline who's pilot needs to use the restroom and delays takeoff, or whatever other situation where convenience takes precedent.
When and how often should human hours be spent to optimize machine hours? Sometimes clearly, but should they always? Where is the line? I think these questions define the whole javascript bloat problem, there is no clear answer so it varies company-by-company and developer-by-developer to the detriment of all involved.
When and how often should human hours be spent to optimize machine hours? Sometimes clearly, but should they always? Where is the line? I think these questions define the whole javascript bloat problem, there is no clear answer so it varies company-by-company and developer-by-developer to the detriment of all involved.
> Humans don't naturally optimize down to the byte level,
Who said bytes? You did. Other commenters including myself have mentioned megabytes (ie. six orders of magnitude larger). Nobody said bytes AFAICS.
> When and how often should human hours be spent to optimize machine hours
Oooh, perhaps I can help! Being as I'm currently trying to shave 200 to 300 milliseconds at a time off one stage of a simulation, taking 2 to 6 hours for each optimisation. So 4 to 5 orders of magnitude more programmer time than machine time. That way larger models can be used, and all of multiple multiple sites will benefit, and less of their time will be spent waiting (see disclosure below).
It's not actually that difficult an inequality to solve, except when haystacks of JS and advert crud are pushed on us by advertisers etc. whose money is made by wrecking the commons for their profit so don't want to know.
“It is difficult to get a man to understand something, when his salary depends on his not understanding it.” - Upton Sinclair
disclosure, I'm actually doing this unpaid as I'm getting back into work after illness, however if I wasn't there they'd get someone else in, paid, as it needs doing.
Who said bytes? You did. Other commenters including myself have mentioned megabytes (ie. six orders of magnitude larger). Nobody said bytes AFAICS.
> When and how often should human hours be spent to optimize machine hours
Oooh, perhaps I can help! Being as I'm currently trying to shave 200 to 300 milliseconds at a time off one stage of a simulation, taking 2 to 6 hours for each optimisation. So 4 to 5 orders of magnitude more programmer time than machine time. That way larger models can be used, and all of multiple multiple sites will benefit, and less of their time will be spent waiting (see disclosure below).
It's not actually that difficult an inequality to solve, except when haystacks of JS and advert crud are pushed on us by advertisers etc. whose money is made by wrecking the commons for their profit so don't want to know.
“It is difficult to get a man to understand something, when his salary depends on his not understanding it.” - Upton Sinclair
disclosure, I'm actually doing this unpaid as I'm getting back into work after illness, however if I wasn't there they'd get someone else in, paid, as it needs doing.
80%, if not more, of what you describe is do-able with Raymond Hill's uMatrix [0]. And yes, it does make the web faster and safer, though it breaks certain websites.
--
[0] https://github.com/gorhill/uMatrix/blob/master/README.md
--
[0] https://github.com/gorhill/uMatrix/blob/master/README.md
True, there are ad-ons to address such browser deficiencies. The question is why browsers do not have these capabilities natively. Clearly, a large number of users want them.
Note that the 20% in your estimate are quite significant.
As for "breaking websites", perhaps in the evolution of a web to be faster, those "certain websites" with too many third-party dependencies should be selected against, not for.
Another interesting question is whether something like HTTP/2 developed by an advertising company encourages the inclusion of more third-party resources, perhaps in the form of advertising and tracking, or does it encourage less, in the form of smaller, faster, safer websites? It appears to be overkill for the later.
Note that the 20% in your estimate are quite significant.
As for "breaking websites", perhaps in the evolution of a web to be faster, those "certain websites" with too many third-party dependencies should be selected against, not for.
Another interesting question is whether something like HTTP/2 developed by an advertising company encourages the inclusion of more third-party resources, perhaps in the form of advertising and tracking, or does it encourage less, in the form of smaller, faster, safer websites? It appears to be overkill for the later.
Firefox seems to be in the process of gradually implementing a lot of user privacy and control measures.
>The question is why browsers do not have these capabilities natively.
Money.
Money.
> What is their purpose?
Icons.
> Where do they come from?
They are designed.
> Are all of them necessary?
No, but also yes.
Icons.
> Where do they come from?
They are designed.
> Are all of them necessary?
No, but also yes.
I block all JS and have a comprehensive blocklist for just about every ad service there is. Stuff usually loads damn fast (ok, when not broken by JS missing, an acceptable price to me, I get speed and safety for free). I always recommend people try it.
It's fast enough except when webbish types do stupid things.
Just yesterday I was looking at a Scientific American article which was held up by an entirely pointless 2.6MB gif, this one <https://static.scientificamerican.com/blogs/cache/file/80C44....
Quanta articles are bloody nuts too, check this shit, a 4MB animation that tells you nothing. Fucking nothing. Absolfuckinglutely sweet FA. (Edit, forgot link; here: <https://www.quantamagazine.org/mathematicians-discover-the-p...)
We have a fast web, what we also have are idiots - technical solutions to idiocy aren't solutions.
(NB 'scuse swearing)
It's fast enough except when webbish types do stupid things.
Just yesterday I was looking at a Scientific American article which was held up by an entirely pointless 2.6MB gif, this one <https://static.scientificamerican.com/blogs/cache/file/80C44....
Quanta articles are bloody nuts too, check this shit, a 4MB animation that tells you nothing. Fucking nothing. Absolfuckinglutely sweet FA. (Edit, forgot link; here: <https://www.quantamagazine.org/mathematicians-discover-the-p...)
We have a fast web, what we also have are idiots - technical solutions to idiocy aren't solutions.
(NB 'scuse swearing)
Downvoted for the bad language perhaps? I'd accept that.
Or downvoted for recommending a blocklist to cap off ad networks? Or to disable JS to speed things up and increase my safety without new protocols? Or asking not to have my browsing turned into an Awesome Experience by web designers that don't understand the web is a means to an end for its users, not a way of life? Or something else?
Or downvoted for recommending a blocklist to cap off ad networks? Or to disable JS to speed things up and increase my safety without new protocols? Or asking not to have my browsing turned into an Awesome Experience by web designers that don't understand the web is a means to an end for its users, not a way of life? Or something else?
I don't know about the downvotes on your original comment, but comments complaining about being downvoted will always attract more downvotes.
I didn't complain, I asked why. It may well be down to my rather abrasive style, in which case I'd apologise and try to be less so next time.
Or it may be down to me being factually wrong, which I also need to know cos how else does one learn.
Or maybe someone doesn't like what I said which is very much another thing. But I wasn't complaining.
Or it may be down to me being factually wrong, which I also need to know cos how else does one learn.
Or maybe someone doesn't like what I said which is very much another thing. But I wasn't complaining.
I didn't downvote you, but your post did annoy me. This is an interesting article about HTTP/2.
Yes, we know people should make smaller web pages with less javascript and ads, and we could all install a bunch of plugins to achieve that, but multiple replies like yours do seem to appear on every single post that has anything to do with network traffic, and don't really contribute (in my opinion) to the discussion at hand.
Yes, we know people should make smaller web pages with less javascript and ads, and we could all install a bunch of plugins to achieve that, but multiple replies like yours do seem to appear on every single post that has anything to do with network traffic, and don't really contribute (in my opinion) to the discussion at hand.
> I didn't downvote you, but your post did annoy me. This is an interesting article about HTTP/2.
Thanks, that's a nice, constructive criticism and I appreciate it. My post was in retrospect not exactly a piece of precision, so let me try again if I may...
I recently worked on a "big data" project that wasn't. It was a car crash because the "big data" conponents were thrown together with a very expensive cluster (>£100,000) of machines. The end result crawled because the lead programmer didn't gave a clue. I am pretty sure I could have got minimum 100X the performance for ~5% of the price.
When I'm asked to optimise something (a common request) I first ask, is this doing the right thing - is this really a technical problem at all? Can we just not do it? Followed by, what are you doing that makes this so much less than the theoretical max performance?
(Edit: the point was the big data components (apache spark, mesos etc) weren't necessary because we didn't have big data at all, and performance was dire because he didn't know how to use those components)
What we have here is a social problem of web devs simply not understanding their job, combined with the problem of advertisers who I loathe but seem to be a product of many user's desire to not pay a single penny upfront. Both of these are non-tech problems. This article is pushing a tech solution, but should it, really?
I don't think being abrasive was a good move by me, but you say "...should make smaller web pages with less javascript and ads [and my post doesn't]really contribute (in my opinion) to the discussion at hand" but I think it does. I think it central, actually. Or what problem is this new protocol solving?
Thanks, that's a nice, constructive criticism and I appreciate it. My post was in retrospect not exactly a piece of precision, so let me try again if I may...
I recently worked on a "big data" project that wasn't. It was a car crash because the "big data" conponents were thrown together with a very expensive cluster (>£100,000) of machines. The end result crawled because the lead programmer didn't gave a clue. I am pretty sure I could have got minimum 100X the performance for ~5% of the price.
When I'm asked to optimise something (a common request) I first ask, is this doing the right thing - is this really a technical problem at all? Can we just not do it? Followed by, what are you doing that makes this so much less than the theoretical max performance?
(Edit: the point was the big data components (apache spark, mesos etc) weren't necessary because we didn't have big data at all, and performance was dire because he didn't know how to use those components)
What we have here is a social problem of web devs simply not understanding their job, combined with the problem of advertisers who I loathe but seem to be a product of many user's desire to not pay a single penny upfront. Both of these are non-tech problems. This article is pushing a tech solution, but should it, really?
I don't think being abrasive was a good move by me, but you say "...should make smaller web pages with less javascript and ads [and my post doesn't]really contribute (in my opinion) to the discussion at hand" but I think it does. I think it central, actually. Or what problem is this new protocol solving?
The protocol is solving a real world problem. They are trying to apply a technological solution to a real world problem.
Many problems could be solved if we could just make every Web developer and company in the whole world take size / data security / accessibility more seriously, but human history suggests that ain't happening, without in practice introducing laws.
Many problems could be solved if we could just make every Web developer and company in the whole world take size / data security / accessibility more seriously, but human history suggests that ain't happening, without in practice introducing laws.
Or someone just didn't like your comment and downvoted it. There's no test you have to pass to be a moderator. Nobody comes back later and checks your work. Some people may even have agendas with their voting.
Downvotes are inevitable when you start making comments regularly, don't worry about them too much. It's all fake Internet points in the end.
Downvotes are inevitable when you start making comments regularly, don't worry about them too much. It's all fake Internet points in the end.
Yep, there's a bit of fishiness going on here, it's not just my stuff that's being consistently getting downvotes.
I guess I'm being that guy who just won't let things go, so thanks for the reminder to chill out, upvoted!
I guess I'm being that guy who just won't let things go, so thanks for the reminder to chill out, upvoted!
I always upvote comments that encourage turning off javascript, but there's quite an HN population that thinks you're living in the 60s and deserve to be left behind if you don't run every program a website downloads :)
The web is quite fast already, if you don't weigh down your web pages with tens of megabytes of crap...
So their main improvement over Chrome is that chrome doesn't benefit from progressive images -- they load images in sequence instead of parallel. Sounds like a simple fix. (If you actually know the images are progressive.)
Yep, hopefully a lot of the default improvements will make their way into all of the browsers. Until then, this also evens the field across all of the browsers but for me the really exciting part is exposing it to Workers so sites can customize the logic specific to their needs. Boosting the priority of hero images or async scripts that are important for the site but the browser's default logic has no way to know. Priority hints (also Chrome-only currently) will eventually bring that to browsers natively.
Full disclosure, I'm the article author and I also spent several years on the Chrome team working on the resource loading/scheduler so it's probably not too surprising that there are similarities.
Full disclosure, I'm the article author and I also spent several years on the Chrome team working on the resource loading/scheduler so it's probably not too surprising that there are similarities.
From my understanding the better policy will be to prioritise the smallest assets first. To me it seems counter-intuitive but apparently it proves out in theory and testing: https://www.cs.cmu.edu/~harchol/Papers/usits1.pdf
More dramatic improvement might be possible if streams can be interrupted and resumed (which is something protocols like RSocket support): https://www.cs.cmu.edu/~harchol/Papers/MIT-LCS-TR-767.pdf
Apologies if you're already familiar with these.
More dramatic improvement might be possible if streams can be interrupted and resumed (which is something protocols like RSocket support): https://www.cs.cmu.edu/~harchol/Papers/MIT-LCS-TR-767.pdf
Apologies if you're already familiar with these.
These papers are interesting, thanks for sharing.
However, the primary axiom is of a web server that is serving static content that is located on the device. That, in a sense, gives almost infinite time and knowledge to deciding prioritisation of work.
For HTTP proxies that have to fetch resources from some other server, the time and knowledge window becomes much shorter. Decision making needs to be done quickly in order to minimise the latency of returning anything. And the upstream server may response in unexpected ways.
This is the challenge for today's CDN deployments. And developing a solution that works for the huge variety of how websites are developed is the really interesting bit.
However, the primary axiom is of a web server that is serving static content that is located on the device. That, in a sense, gives almost infinite time and knowledge to deciding prioritisation of work.
For HTTP proxies that have to fetch resources from some other server, the time and knowledge window becomes much shorter. Decision making needs to be done quickly in order to minimise the latency of returning anything. And the upstream server may response in unexpected ways.
This is the challenge for today's CDN deployments. And developing a solution that works for the huge variety of how websites are developed is the really interesting bit.
I'm not sure I follow. Proxies don't have much time to reorder from an upstream on the first time writing through to their downstream. But once it's in their local cache it would become possible to apply the smallest-first logic, wouldn't it?
This depends on how the proxy is configured to behave. One common pattern is to have a protocol terminating proxy talk to the client. Other component(s) sit behind this and they could be other parts of the system, tiers of caches or tiers of CDNs.
Even if the proxy does cache locally to memory or disk. Without infinite space, there will be some chance of cache eviction and a need to fetch from the upstream again.
Our scenarios are different ends of a broad spectrum, and there's a lot in between. Which is why getting prioritisation right is a hard nut to crack.
Even if the proxy does cache locally to memory or disk. Without infinite space, there will be some chance of cache eviction and a need to fetch from the upstream again.
Our scenarios are different ends of a broad spectrum, and there's a lot in between. Which is why getting prioritisation right is a hard nut to crack.
I am not sure it is a good idea to trust the server to decide what is more important. I can easily imagine ads taking higher priority than actual content, just look at the pop-ups that interrupt reading.
Browsers and protocol should start concentrating on how to secure users from the very sites they visit.
Browsers and protocol should start concentrating on how to secure users from the very sites they visit.
Prioritization works within a single HTTP/2 connection. Ads are generally served by a 3rd party, and while there are some limited ways of sharing HTTP/2 connections across origins, I don't think any ad servers offer such a close integration.
Besides, sites already have blunt tools they can use if they really wanted to force ads to load first. This feature is more for site developers who care about performance. Instead of tweaking the markup and adding hints to help browsers request resources in the right order, they can now set the priorities directly and precisely.
Besides, sites already have blunt tools they can use if they really wanted to force ads to load first. This feature is more for site developers who care about performance. Instead of tweaking the markup and adding hints to help browsers request resources in the right order, they can now set the priorities directly and precisely.
We've got a solution to this as well! It's interesting enough to get its own blog post: https://news.ycombinator.com/item?id=19910926
As someone who has implemented HTTP/2 too (for the apparently unpopular .NET ecosystem) I am guilty of totally missing out on the prioritization feature too.
There's definitely some good ideas and use-cases in the article that make it more worthwhile!
Some things I'm wondering about:
The proposed strategy seems to prefer sometimes sending single resources in a sequential fashion instead of lots of resources in parallel. Doesn't that essentially bring the communication back into a HTTP/1.1 style with less parallelism - and only with the benefit of no extra connections? And how well does the approach fit together with browsers flow control windows? If a browser set a small flow control window per stream then sending only a single object at a time wound still require lots of round-trips for flow control window updates - which might make it worse than HTTP/1.1. However I heard at some time that browsers have configured huge flow control windows. If that's true it seems more likely to work out (and the default strategy where HTTP/2 prefers parallelism over throughput seems worse).
There's definitely some good ideas and use-cases in the article that make it more worthwhile!
Some things I'm wondering about:
The proposed strategy seems to prefer sometimes sending single resources in a sequential fashion instead of lots of resources in parallel. Doesn't that essentially bring the communication back into a HTTP/1.1 style with less parallelism - and only with the benefit of no extra connections? And how well does the approach fit together with browsers flow control windows? If a browser set a small flow control window per stream then sending only a single object at a time wound still require lots of round-trips for flow control window updates - which might make it worse than HTTP/1.1. However I heard at some time that browsers have configured huge flow control windows. If that's true it seems more likely to work out (and the default strategy where HTTP/2 prefers parallelism over throughput seems worse).
Would love to enable HTTP2 on Cloudflare on our site, but there seems to be a bug with it in Cloudflare where it randomly stops requests, and we're stuck in an endless support loop so we have to disable it on our PWA which would have huge benefits for it.
Can you get in touch? [email protected]. I’d love to get to the bottom of this.
Don't some of these browsers display a best-approximation font, while the actual font file is downloading, while others display no text until the font file is available? That seems like an awfully big distinction which is omitted here.
It is more site-dependent than browser dependent but by default (unless the dev overrides) most browsers will leave the text blank for 3 seconds after the font is discovered before falling back. In most (all?) of the cases in the blog post, the actual font loading is within that 3-second window, the issue is that the layout-blocking content (preventing the browser from discovering the font) is what is slow.
I don't know that their assumption about bandwidth getting maximized period is correct.
[deleted]
In HTTP/2 we've reached a good level of interoperability, but bolting on HTTP/2 on top of a server architected for HTTP/1 is not enough. We have room for optimizations and maturity.