Hacker News Reader

Comment by missblit | Hacker News Reader

> browsers no longer cache resources across top level sites.

Wait is this true? Definitely warrants some kind of citation. If no one's heard one way or another I might test it later because I'm pretty skeptical of this claim.

Edit: mind blown

View on HN

Yes, all modern browsers divide their cache per-site. Some large advertising companies like Taboola have abused caches to store unique identifiers. I won't be shocked if Google and Facebook have also used this, so Safari (from 2013, https://bugs.webkit.org/show_bug.cgi?id=110269), Firefox (depending on settings from 2018 and widely deployed in 2020, https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...) and Chrome (from 2020, https://developer.chrome.com/blog/http-cache-partitioning/) now separate caches.

The reasoning behind this is a privacy leak attack. Let’s say that you know that, say, your competitor is loading a specific asset at a specific version from a CDN. You can then attempt to load that asset as well, and using the Resource Timing API[1] see how long it takes to come down. If it’s 500ms+ you can guess that it’s a network load. If a lower number you could guess that instead it’s come from the cache. You could then target that user with that new knowledge. Safari realised this a long time ago, but it took Firefox and Chrome a while to catch up, or at least to decide that the harm outweighed the benefit.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Resource_Ti...

Yes, it seems like it is now true. https://developer.chrome.com/blog/http-cache-partitioning/

It's true and kind of asinine in my opinion, and actually makes setting up a Squid cache worthwhile again, potentially.

Wasn't it so that squid does not support https? If yes, there shouldn't be much to cache today.

https://developer.chrome.com/blog/http-cache-partitioning/

Reply on news.ycombinator.com