Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!npeer01.iad.highwinds-media.com!feed-me.highwinds-media.com!cyclone01.ams2.highwinds-media.com!news.highwinds-media.com!voer-me.highwinds-media.com!eweka.nl!lightspeed.eweka.nl!193.141.40.65.MISMATCH!npeer.de.kpn-eurorings.net!npeer-ng0.de.kpn-eurorings.net!newsfeed.arcor.de!newsspool2.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Content-Type: text/plain; charset="UTF-8"
Message-ID: <7119181.6SbzJH45o2@PointedEars.de>
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Reply-To: Thomas 'PointedEars' Lahn <usenet@PointedEars.de>
Organization: PointedEars Software (PES)
Date: Mon, 03 Jun 2013 14:50:38 +0200
User-Agent: KNode/4.10.2
Content-Transfer-Encoding: 8Bit
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Subject: Re: Parallel Download Abstraction
Newsgroups: comp.lang.javascript
References: <09cc7047-18cd-4c88-8093-8b699dbc5ff3@k6g2000yqh.googlegroups.com> <3159554.1y7rF9eUTa@PointedEars.de> <f50022ff-b69e-4edf-a563-14b6490485a8@gw5g2000vbb.googlegroups.com> <1672892.tfqf7eurea@PointedEars.de> <4cf2860f-135f-4895-8296-ed560062633c@k4g2000yqb.googlegroups.com> <1813184.oRGPi3HU2c@PointedEars.de> <dadb129a-4df5-485e-bb65-2be367236bc6@l1g2000yqf.googlegroups.com> <3050803.YGT5ROo5qm@PointedEars.de> <67edc324-cf87-4629-9337-ad7dd038d0ec@t9g2000yqd.googlegroups.com>
MIME-Version: 1.0
Lines: 158
NNTP-Posting-Date: 03 Jun 2013 14:50:39 CEST
NNTP-Posting-Host: bbbc566f.newsspool4.arcor-online.net
X-Trace: DXC=9khMIj`IcWfEB;5>eE0T7m4IUK<Cl32<a4Fo<]lROoRa8kF<OcfhCOk0bK78=TXjmnDZm8W4\YJNlb@mF9jNikdeBoKGPB=12AghLb3S?CHXJe
X-Complaints-To: usenet-abuse@arcor.de
X-Received-Bytes: 8780
Xref: csiph.com comp.lang.javascript:20124

Michael Haufe (TNO) wrote:

> On Jun 1, 8:10 am, Thomas 'PointedEars' Lahn <PointedE...@web.de>
> wrote:
>> Michael Haufe (TNO) wrote:
> 
> [...]
> 
>> Thank you.  Using your testcases and the Chrome Developer Tools'
>> “Network” tab, in 10 out of 10 cases I can confirm parallel (“P”)
>> uncached download for the document.write() approach in
>>
>> "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko)
>> Chrome/27.0.1453.93 Safari/537.36"
>>
>> I cannot confirm your observations for the “normal” way (static script
>> elements [1]) there.  In most cases scripts are downloaded uncached
>> sequentially (“S”) instead, as demonstrated in the video by Tony
>> Gentilcore (Co-Creator of the Google PageSpeed Tools) in what looks like
>> IE 9 (referred above).
>>
>> Uncached run #   |  1  2  3  4  5  6  7  8  9 10
>> -----------------+------------------------------
>> normal/inline    |  P  S  S  S  P  S  S  S  S  S
>> document.write() |  P  P  P  P  P  P  P  P  P  P
>>
>> [1]
>> <https://thenewobjective.com/tests/parallel-downloads/inline-script.html>
> 
> I reinstalled the VM and revisited the tests. In case of formatting
> issues, the below table is available here: <https://
> thenewobjective.com/tests/parallel-downloads/browser-results.txt>
> 
> Static:  <script>
> Dynamic: document.write
> S: Sequential download
> P: Parallel download
> 
>                             Run #
> Browser  Type     1  2  3  4  5  6  7  8  9  10
> […]
> ------------------------------------------------
> Ch 27    Static   P  P  P  P  P  P  P  P  P  P
>          Dynamic  P  P  P  P  P  P  P  P  P  P
> 
> If you wish to duplicate my results using the HTTPAnalyzer/debugbar
> tools, use the http protocol of my domain or you'll get an empty log.
> 
> I also renamed inline-script.html to static-script.html

I find it strange how we can obtain so different results.  What are the 
values of navigator.userAgent with you, and which add-ons have you installed 
and enabled?  Rest assured I tested diligently, where “uncached” means 
holding down the Reload button and selecting “Empty cache and Hard Reload”.

I have the following Chrome extensions installed and enabled in _Chromium_ 
27 (see above):

- AdBlock 2.5.63
- Awesome Screenshot: Capture & Annotate 3.4.4
- colorPicker 0.9 0.9.90
- Docs PDF/PowerPoint Viewer (by Google) 3.10
- FlashBlock 1.2.11.10
- Google Chrome to Phone Extension 2.3.1
- Google Translate 1.2.4
- Link Checker 1.3.
- Novell Moonlight 3.99.0.3
- Smooth Gestures 0.17.7
- SmoothGestures: Plugin 0.8
- SmoothGestures: Plugin 0.9.1
- Stop Autoplay for YouTube. 0.11.5.24
- Table Capture 1.9
- Turn Off the Lights 2.2
- Web Developer 0.4.3
- WebSite Analysis Application 1.5.1
- YSlow 3.1.2
- Zattoo++ 0.6.1.3 (an extension I created that is only triggered on
  zattoo.com)

There is indication that the AdBlock extension slows things down as I could 
not reproduce sequential download when it was disabled, and got it several 
times (but not exclusively) when it was enabled.  On the other hand, it 
might be just that Chromium's HTTP connection slots were exhausted at the 
time.

See also:

<http://PointedEars.de/tmp/chromium-script-sequential.png>

In any case, it means that you cannot rely on parallel download.
 
>> >> The MSDN Library library suggests that Element::appendChild() has been
>> >> supported since MSHTML 5.x (1999/2000); caniuse.com and the local DOM
>> >> Support Matrix provide no pertinent information yet.
>>
>> >> Previously there were .insertAdjacentHTML() and .innerHTML, although I
>> >> am not sure if the earlier UAs would load scripts included this way
>> >> (and I cannot test it).
>>
>> > If memory serves correct, I think Firefox restricted this behavior
>> > around version 3 for XSS security (This may only be for html from a 3rd
>> > party though). It couldn't hurt to test.
>>
>> I have just tested it in
>>
>> "Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
>> Iceweasel/18.0.1"
>>
>> in the Firebug 1.11.4 console on <http://en.wikipedia.org/wiki/Castling>
>> (which I happened to have visited last there) with
>>
>>   /* Kids, don't try this at home! */
>>   var script = document.createElement("script");
>>   script.src = "http://PointedEars.de/scripts/object.js";
>>   document.body.appendChild(script);
>>
>> It works (jsx.object is available then).  If you think about it, you
>> *had* to be mistaken about a general restriction for cross-origin
>> scripts: if you had been correct, for example the Google Maps API would
>> have stopped working
>> except on the Google Maps web site from Firefox 3.0 on.  And a lot of web
>> trackers, including Google Analytics, would suddenly have failed.
>>
>> You will find inserting “script” elements documented as a way to work
>> around the SOP in MDN –
>>
>> <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Same_origin_p...>
>>
>> – and elsewhere.  XSS is a different issue:
>>
>> <https://developer.mozilla.org/en-US/docs/Security/CSP/Introducing_Con...>
> 
> I found what I was thinking of:
> 
> <https://developer.mozilla.org/en-US/docs/Web/API/
> element.innerHTML#Security_considerations>
> 
> innerHTML w/ <script> doesn't work.

ACK.  But it is a weak defense against XSS, and a specious argument from 
you:

- You have argued that you were using document.write() becaue you would not
  only target “modern browsers”.

- I have showed that even IE 5 would support document.body.appendChild(),
  also mentioning that there were fallbacks other than document.write()
  for even *older* versions (IE 4), among them .innerHTML.

- You have argued that Firefox 3+ would not execute scripts when included
  with .innerHTML.

But Firefox has supported document.body.appendChild() from its first 
version, and I have showed that, barring further measures, it is still 
loading scripts cross-domain when included this way.

-- 
PointedEars