SPDY Review by Opera Software
lists.w3.org
lists.w3.org
Both are effectively hacks on existing well established protocols, but both affecting different layers. With WebSocket, you cannot use your tried and tested HTTP parser. With SPDY, you cannot use your tried and tested SSL implementation. With a little bit of foresight, implementation of both might have involved use of only SSL Next Protocol Negotation (SPDY's approach) and a completely separate, orthogonal SPDY/WebSocket parser. This would also remove some of the more "innovative" features of WebSocket (Sec-WebSocket-Key and that magical fixed UUID).
This is a testament to how heavily rushed both protocols were, and the kind of thing that could be avoided with a more strongly community lead process, which was missing at least in the early stages of WebSocket. I have no idea what it was like for SPDY, but given that the "innovative" header compression feature somehow survived, I'm guessing not good.
Why? I am using my tried and tested HTTP parser for WebSocket. I am doing something wrong?
What's impressive is that at no other company you could wake up one morning and say, "HTTP is slow, so let's change that." Google, amazingly, can do stuff like that, and I'd rather them ship early than not ship at all.
(Well I guess Microsoft could have done it but they would have screwed it up like every other net technology they introduce and then we'd have two internets or something worse.)
The approach also often comes out on top when the client is a business and accounting considerations take the lead, as opposed to B2C situations.
When you divide the cost of a Microsoft license by 7 (number of years a business will be running XP on a workstation) it turns into a really great price.
The reverse compatibility mentality is universal in the enterprise.
To put that into proper context, XmlHttpRequest was a hack by a single person at Microsoft -- with zero input or coordination or working groups or long term planning -- on the MSXML team to do a favour to the Outlook team. Further it could only happen because of ActiveX, and paralleled various other light request tools that existed at the time.
XmlHttpRequest is a great demonstration of a hacker getting a solution out there.
EDIT: Downvotes? I am intimately aware of how XmlHttpRequest came into existence, having been closely involved with its birth, so if someone has some correction to add, please add it. But in no universe does XmlHttpRequest vindicate Microsoft on moving web standards along. Their contribution was unintentional and largely accidental.
During my interview with that team, one of the kids proudly took credit for the span tag. A weekend hack. Committed the code and shipped it. No review. SOP.
Being more standards-minded at the time, I wanted to throttle the kid.
With the benefit of hindsight, I see that all the jitter and experimentation was pretty much ideal. If a feature proves useful, other browsers may adopt it, and it may become a de facto standard.
SPDY, NaCl, Dart are among some of the examples. Developed behind closed doors where nobody else can have a say, then released as an "open standard", but at the same time slipped into the browser and promoted for use - thereby eliminating the option for others to propose an alternative, or any major (breaking) change.
I'm all for pushing forward with tehcnology, but google should open their doors earlier, or we'll end up in a situation where they're effectively dictating the direction of the web and other browser vendors are busy playing catch-up.
It'll only be impressive if Google actually take the advice from Opera et al, and adjust their SPDY protocol to suit everyone - not just Chrome users. (And the same for NaCl, Dart, and the next "new standard" Google push for).
Microsoft has had a few first-to-market ideas but they're horrible at continuous improvement because their core business is freezing an API and supporting it for a decade so enterprises feel comfortable using it.
In this industry we have a 15-25 year rewrite cycle. The cycle always begins with something deceptively simple that wins wide support through being easy, and ends with multilayered nonsense of dizzying complexity. Efficiency was not a design goal of HTTP. "Changing" that isn't just insulting to the spirit of HTTP, it expresses a complete lack of regard for history.
I don't know how we're going to break the rewrite cycle, but I can tell you heaping complexity atop complexity appears to be exactly the engine driving it, and just when things reach the pinnacle of the absurd, someone comes along with a disruptive, simple alternative and takes over the world with it. SPDY is late-game technology. The end of this loop is near, and we'd be better served keeping an eye open for the start of the next one than trying to master the intricacies of one more difficult and unnecessary improvement.
1. SPDY will be nice for anyone using much JS/CSS on their site
First, HTTP pipelining exists.
Second, HTTP's inefficiencies establish a bounds on your performance. HTTP itself does not define your application's performance, unless you've already mined every optimization opportunity at the levels above. Do you ensure all your CSS and JavaScript assets are bundled into single files and minified? If the answer is "no," you have no business complaining about HTTP's performance—managing your assets better will improve performance far more than using SPDY alone will. What about your caching story? What about your database, is it indexed properly? These are tangible improvements that you can make in your application today that can and will improve performance for the end user.
At my work, there is a CGI app written in C that does some atmospheric calculations against a database. The old database was Oracle, the new one is PostgreSQL. The CGI now takes twice as long to run as it did before, which is noticeable because it used to take about 5 seconds, so now it's taking 10, for one day of calculations. Looking into the problem, we found a place where an index would be a good thing to add. So we added it, and the performance didn't change at all.
It turns out, the app is sending a separate SQL query for individual data points. The app needs hundreds of thousands of data points to do its work, so it's sending many thousands of queries on each request. One query can fetch all of the data this program needs in about 0.3 seconds. So this app is, in effect, not measuring the performance of the database itself at all; instead it's measuring the overhead of running an instantaneous query on Oracle and Postgres, multiplied by several thousand. It turns out that the overhead of setting up and performing a query is about twice as high with Postgres. This fact never matters in practice though, because when you notice it you're doing something stupid. Nobody ever says "you should switch to Oracle, because that Postgres's queries take 4 milliseconds to setup instead of 2." (The fact that this app is written in C and could easily be outperformed by a shell script is also telling.)
This is exactly why HTTP is in no sense incomplete or narrowly defined. Google is the one with the narrowing requirements: they know exactly how much money HTTP's inefficiencies are costing them and are in a position to throw engineering time and energy at that number to decrease it. They are also in a position to optimize every other corner of their stack, and presumably they have. This is not true anywhere else.
SPDY is somewhat beneficial for consumers. But it undermines the simplicity and clarity of HTTP. That's what makes this late-game technology. SPDY is SOAP and CORBA to HTTP's RPC. Is it a better definition? Probably. But it's also harder and the benefits are insignificant except at scale.
… and is not currently usable, nor as full-featured as SPDY even if correctly implemented by all vendors
> If the answer is "no," you have no business complaining about HTTP's performance—managing your assets better will improve performance far more than using SPDY alone will
Flat-out wrong: there are many use cases which require multiple requests (you only mentioned CSS/JS but images are significant, too) and this would be exhibit A for an HTTP deficiency: you've internalized the idea that a visitor to the site must download and process EVERYTHING you could ever use to avoid making multiple requests, wasting bandwidth and device CPU/memory because you're trying to use asset packaging as an end-run around protocol shortcomings.
As for databases, this was a fascinating and completely irrelevant digression.
"Why is IE faster? It cheats!" http://www.mail-archive.com/foib@ianbell.com/msg00031.html
Would that have yielded something better? I would argue that it would have yielded nothing.
Though nonetheless I am a bit confused by your comparison of the two. WebSockets are not "another way of doing HTTP". SPDY is. They are separate solutions for different problems.
http://www.joelonsoftware.com/articles/fog0000000018.html
In reality, SPDY and WebSockets have two very different goals:
* SPDY is a transport optimized for the HTTP request/response service model, down to specific features to compress HTTP-style headers.
* WebSockets is a transport optimized for tunneling bidirectional application-level protocols over an HTTP-style transport.
It's a bit like redesigning a car from scratch just because you need snow chains for certain roads, and upholstery covers for certain passengers.
The two descriptions you make below describe much more essentially than superficially or "astronautically", the same kind of thing, optimized for slightly different use cases (not even THAT different).
It would have yielded the same thing as W3C's decade long stagnation during the development of XHTML: everyone gets bored and they set up WhatWG instead.
Considering the overwhelming majority of HTTP requests are nearly all headers, and request headers see 88% compression with SPDY [0], you seem to have an awfully negative view of header compression.
Header compression is a good feature with real world applications,
and deflate with persistent context is a good approach to achieve
it. A fixed dictionary is probably not very effective as it
complicates the implementation while only providing initial value to
the compression. As an example, this is how the average requests
sizes compares between HTTP and SPDY in different modes, using the
set of captured headers used to train the current SPDY 3 dictionary.
HTTP 821.1
HTTP zlib compressed 543.5
HTTP compressed with dictionary 497.0
SPDY 913.7
SPDY zlib compressed 606.5
SPDY compressed with dictionary 517.0
I.e. Just putting the HTTP request in a SPDY stream (after removing
disallowed headers) only differs by 20 bytes to SPDY binary header
format with dictionary based zlib compression. The benefit of using
a dictionary basically goes away entirely on the subsequent request.SPDY is getting well over 85% compression in the real world across millions of installed users.
Coming from messaging world I can say: nope. "Pause" frames are a very, very bad idea and lead to more problems than they solve. Windowing is much better engineering choice.
> Also note that TCP provides the URG channel for exception messaging.
Which doesn't work.
> 2.6. Push ... The client has the option to read and discard this information, but that may be a costly waste of bandwidth.
It's worth noting that caching and Push don't play together.
Of all the parties Google should listen to for SPDY feedback, Opera is probably the top of the list. It looks like Opera took it quite seriously and shared a lot of good work with us all, and I thank them for it. I'd say their point about the asynchronous headers is one that requires serious addressing ASAP. For one example, is it valid to push down a header redeclaring the encoding of the response at the very end? What would that even mean? It's a good point.
It seems likely but I can't prove that behind a couple of statements like "As defined the feature is not powerful enough to push non-request related content (such as new RSS items)" is the fact that their approach does do it (and possibly had to add it on later only after they discovered it was a problem), but the document is very carefully written strictly as an examination of SPDY, with no braggadocio I can see at all or any trace of marketing beyond the initial statement of "Hey, we've done some stuff and here's some observations we are in a position to make".
(Again, my compliments to the chefs.)
On the other hand, SCTP has much stronger interactions with basically any deployed firewall/proxy anywhere, lacks widely used implementation for popular operating systems (Windows!), etc. For many networks, deployment of SCTP might mean replacing millions of $ networking hardware.
Can anyone point to a working example of this use of a chunked encoding trailer? It seems like a solution to the primary problem that came up on the discussion of HTTP Streaming: http://news.ycombinator.com/item?id=4042247
> And if it for instance needs to redirect the user, it can’t change the status/headers to a 302/Location if it’s already ...
Can someone explain how Microsoft's S+M proposal differs and how well it would work in the real world with proxies, firewalls, NAT etc? (I'm being lazy and haven't read the paper)
I'm not trying to dis the proposal; just point out that it is in its infancy. To jump start it, Microsoft started with SPDY at its core, but changed the syntax.
I would think if I was going to submit something to W3C I'd consider asking someone to proofread it.
I bet their English is better than yours. You didn't even start the first word using a capital 'S', so you have a mistake already when writing a single sentence.