You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Tony Anecito <ad...@yahoo.com> on 2009/03/19 21:30:59 UTC
[users@httpd] Reducing js file sizes...
Hi All,
Does anyone know of a module that would strip out the js file comments? Would be a great thing to have.
Thanks,
-Tony
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Reducing js file sizes...
Posted by "Anthony J. Biacco" <ab...@formatdynamics.com>.
Ditto on the module, but check out ShrinkSafe based on rhino
(http://shrinksafe.dojotoolkit.org). It's a java jar.
-Tony
---------------------------
Manager, IT Operations
Format Dynamics, Inc.
303-573-1800x27
abiacco@formatdynamics.com
http://www.formatdynamics.com
-----Original Message-----
From: Brian Mearns [mailto:mearns.b@gmail.com]
Sent: Thursday, March 19, 2009 2:59 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Reducing js file sizes...
On Thu, Mar 19, 2009 at 4:30 PM, Tony Anecito <ad...@yahoo.com>
wrote:
>
> Hi All,
>
> Does anyone know of a module that would strip out the js file
comments? Would be a great thing to have.
>
> Thanks,
> -Tony
>
Not aware of a module specifically, but there are a number of programs
with and without source code floating around that do this. The keyword
you want to search for in "minify". I'm sure you could easily set up
an external filter to use one of them, or simply use a cgi script to
do it, and then your src can be included through that script, e.g.:
<script type='text/javscript'
src='/cgi-bin/minify.cgi?/url/to/myscript.js'></script>
-Brian
--
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server
Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reducing js file sizes...
Posted by Brian Mearns <me...@gmail.com>.
On Fri, Mar 20, 2009 at 3:49 AM, André Warnier <aw...@ice-sa.com> wrote:
> Brian Mearns wrote:
>>
>> On Thu, Mar 19, 2009 at 4:30 PM, Tony Anecito <ad...@yahoo.com> wrote:
>>>
>>> Hi All,
>>>
>>> Does anyone know of a module that would strip out the js file comments?
>>> Would be a great thing to have.
>>>
>>> Thanks,
>>> -Tony
>>>
>>
>> Not aware of a module specifically, but there are a number of programs
>> with and without source code floating around that do this. The keyword
>> you want to search for in "minify". I'm sure you could easily set up
>> an external filter to use one of them, or simply use a cgi script to
>> do it, and then your src can be included through that script, e.g.:
>> <script type='text/javscript'
>> src='/cgi-bin/minify.cgi?/url/to/myscript.js'></script>
>>
> Would that not prevent browser-level caching of the javascript ?
> If yes, that would probably more than cancel any advantage of the
> "minification", no ?
>
>
I don't see any specific reason it would. I believe caches work based
on the URL, including the query string, so it would identify each
script included in this was as a separate cacheable page. You may have
to generate some appropriate cache headers in the script, at a minimum
you'd want to generate a Date header.
Other than that, I think you'd be fine. You could probably test it
(even with just a simple CGI script before investing time in setting
up the minifier) by visiting a script, navigating away from it, then
putting your browser in offline mode. If you're able to revisit the
page in offline mode, that should mean it's cached.
Did you have some specific reason in mind why this would affect caching?
-Brian
--
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reducing js file sizes...
Posted by Brian Mearns <me...@gmail.com>.
On Mon, Mar 23, 2009 at 12:55 PM, Doug McNutt <do...@macnauchtan.com> wrote:
> At 11:46 -0400 3/23/09, Brian Mearns wrote, and I snipped a bit:
>>
>> As long as we're on this topic, I'd like to step up on my soap box for
>> a minute and beseech my fellow web developers to use minification
>> thoughtfully. Reducing network traffic and speeding up load time is
>> definitely a worthwhile goal, but we should always bear in mind that
>> the web should be an open place to exchange ideas and techniques. Few
>> things about web developing are more frustrating than seeing something
>> cool on a person's page, and viewing the source only to find it's been
>> minified to the point of obfuscation. If there are legitimate security
>> concerns, then obviously that's a separate matter, but if the purpose
>> is just minification, I think it'd be a real nice touch to precede the
>> minified content with a brief comment indicating the URL for the
>> original (unminified) source. Okay, I'll stop preaching now.
>
> From another point of view I am really frustrated by the way my banks and
> brokers use JavaScript in their login schemes. It appears that the goal is
> security through obfuscation which is never a good idea.
>
> I like to automate downloads of bank balances and security positions in the
> early morning with a cron job. I typically use curl to access the site using
> my perfectly legal login name and password. With the likes of a perl script
> calling curl its usually easy to implement.
>
> But when the programmers use JavaScript to create cookies that are modified
> in code before referring to an external - to them - site for some kind of
> pulse checking it does get to be a PITA. If I couldn't read their JavaScript
> I would be hard pressed to emulate what a browser does.
>
> And programmers who use JavaScript to check each letter as it is typed in a
> way that makes it impossible even with a browser to copy and paste login
> information are enough to make me change brokers.
>
> Minified for 2400 baud connections, perhaps. Make it optional but don't make
> my scripts even harder to prepare.
>
> --
> -> Stocks are getting pelloreid <-
>
Agreed, security through obscurity is a good way to /reduce/ the
number of attacks, but it is not a valid defense against them.
Thanks for the input.
-Brian
--
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reducing js file sizes...
Posted by Doug McNutt <do...@macnauchtan.com>.
At 11:46 -0400 3/23/09, Brian Mearns wrote, and I snipped a bit:
>As long as we're on this topic, I'd like to step up on my soap box for
>a minute and beseech my fellow web developers to use minification
>thoughtfully. Reducing network traffic and speeding up load time is
>definitely a worthwhile goal, but we should always bear in mind that
>the web should be an open place to exchange ideas and techniques. Few
>things about web developing are more frustrating than seeing something
>cool on a person's page, and viewing the source only to find it's been
>minified to the point of obfuscation. If there are legitimate security
>concerns, then obviously that's a separate matter, but if the purpose
>is just minification, I think it'd be a real nice touch to precede the
>minified content with a brief comment indicating the URL for the
>original (unminified) source. Okay, I'll stop preaching now.
From another point of view I am really frustrated by the way my banks
and brokers use JavaScript in their login schemes. It appears that
the goal is security through obfuscation which is never a good idea.
I like to automate downloads of bank balances and security positions
in the early morning with a cron job. I typically use curl to access
the site using my perfectly legal login name and password. With the
likes of a perl script calling curl its usually easy to implement.
But when the programmers use JavaScript to create cookies that are
modified in code before referring to an external - to them - site for
some kind of pulse checking it does get to be a PITA. If I couldn't
read their JavaScript I would be hard pressed to emulate what a
browser does.
And programmers who use JavaScript to check each letter as it is
typed in a way that makes it impossible even with a browser to copy
and paste login information are enough to make me change brokers.
Minified for 2400 baud connections, perhaps. Make it optional but
don't make my scripts even harder to prepare.
--
-> Stocks are getting pelloreid <-
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reducing js file sizes...
Posted by Brian Mearns <me...@gmail.com>.
On Mon, Mar 23, 2009 at 11:10 AM, Boyle Owen <Ow...@six-group.com> wrote:
>> -----Original Message-----
>> From: André Warnier [mailto:aw@ice-sa.com]
>>
>> Would that not prevent browser-level caching of the javascript ?
>> If yes, that would probably more than cancel any advantage of the
>> "minification", no ?
>
> I don't know for certain the OP's motivation but it may not be just to save bandwidth...
>
> There is a security imperative for cleaning up JS - comments, and even variable names, can reveal details about your server's implementation that may assist an attacker. You can (should?) go the whole hog and obfuscate the code too (re-write variables to "a", "b", "c" etc, remove white-space, etc..)
>
> Rgds,
> Owen Boyle
> Disclaimer: Any disclaimer attached to this message may be ignored.
>
I don't really see how JavaScript could reveal anything about your
server...it's client side, so it shouldn't have anything to do with
your server. I mean, if you're writing things in your comments like
"// Oh yeh, the password to my server is foobar", then that's a whole
other matter, but you probably deserve what you get for that anyway.
Other than that, I'm very curious to know what sort of security
concerns you're thinking of, perhaps it's something I need to address
in my own code.
Anyway, for the OP and others, if your concern /is/ response time, one
thing to keep in mind is balancing network traffic transmission time
with minification processing. If you reduce transmission time from 1
second to half a second, but it takes 3 seconds to do the
minification, you've gained nothing but freeing some bandwidth on the
pipe (which is courteous of you, but probably not what you want). I
think this of particular concern with some of the "better" (read, more
thorough) minifiers which parse the entire script and rewrite it with
small arbitrary variable names, etc., as opposed to just filtering it
like JSMin does. These certainly lead to smaller scripts, but take a
significant amount of extra time to run.
I think a nice alternative is to use a filter that will run the
minification as necessary but simultaneously pipe the output to a file
on the server. For each additional request, it can just check to see
if the minified file is out of date compared to original, and if not,
it can read directly from that file. There will be an initial time
penalty on the first request after modifying the original script, but
from there on out, it /should/ (I think, I haven't actually tested
this) be significantly faster than re-running the minifier while still
getting the reduced size and making sure it's always up to date (as
opposed to serving the minified content statically and having to
remember to regenerate it yourself when you make changes to your
original).
As long as we're on this topic, I'd like to step up on my soap box for
a minute and beseech my fellow web developers to use minification
thoughtfully. Reducing network traffic and speeding up load time is
definitely a worthwhile goal, but we should always bear in mind that
the web should be an open place to exchange ideas and techniques. Few
things about web developing are more frustrating than seeing something
cool on a person's page, and viewing the source only to find it's been
minified to the point of obfuscation. If there are legitimate security
concerns, then obviously that's a separate matter, but if the purpose
is just minification, I think it'd be a real nice touch to precede the
minified content with a brief comment indicating the URL for the
original (unminified) source. Okay, I'll stop preaching now.
-Brian
--
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Reducing js file sizes...
Posted by Boyle Owen <Ow...@six-group.com>.
> -----Original Message-----
> From: André Warnier [mailto:aw@ice-sa.com]
>
> Would that not prevent browser-level caching of the javascript ?
> If yes, that would probably more than cancel any advantage of the
> "minification", no ?
I don't know for certain the OP's motivation but it may not be just to save bandwidth...
There is a security imperative for cleaning up JS - comments, and even variable names, can reveal details about your server's implementation that may assist an attacker. You can (should?) go the whole hog and obfuscate the code too (re-write variables to "a", "b", "c" etc, remove white-space, etc..)
Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored.
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. If you receive this message in error, please notify the sender urgently and then immediately delete the message and any copies of it from your system. Please also immediately destroy any hardcopies of the message.
The sender's company reserves the right to monitor all e-mail communications through their networks.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reducing js file sizes...
Posted by André Warnier <aw...@ice-sa.com>.
Brian Mearns wrote:
> On Thu, Mar 19, 2009 at 4:30 PM, Tony Anecito <ad...@yahoo.com> wrote:
>> Hi All,
>>
>> Does anyone know of a module that would strip out the js file comments? Would be a great thing to have.
>>
>> Thanks,
>> -Tony
>>
>
> Not aware of a module specifically, but there are a number of programs
> with and without source code floating around that do this. The keyword
> you want to search for in "minify". I'm sure you could easily set up
> an external filter to use one of them, or simply use a cgi script to
> do it, and then your src can be included through that script, e.g.:
> <script type='text/javscript'
> src='/cgi-bin/minify.cgi?/url/to/myscript.js'></script>
>
Would that not prevent browser-level caching of the javascript ?
If yes, that would probably more than cancel any advantage of the
"minification", no ?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reducing js file sizes...
Posted by Brian Mearns <me...@gmail.com>.
On Thu, Mar 19, 2009 at 4:30 PM, Tony Anecito <ad...@yahoo.com> wrote:
>
> Hi All,
>
> Does anyone know of a module that would strip out the js file comments? Would be a great thing to have.
>
> Thanks,
> -Tony
>
Not aware of a module specifically, but there are a number of programs
with and without source code floating around that do this. The keyword
you want to search for in "minify". I'm sure you could easily set up
an external filter to use one of them, or simply use a cgi script to
do it, and then your src can be included through that script, e.g.:
<script type='text/javscript'
src='/cgi-bin/minify.cgi?/url/to/myscript.js'></script>
-Brian
--
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org