The document discusses various topics related to web front-end performance optimization. It begins with an overview of what happens from entering a URL to a browser receiving and rendering a page. It then covers specific topics like bandwidth and latency, network protocols like DNS, TCP/IP, HTTP/1.1, caching, and how data is rendered by the browser through HTML, CSS, and JavaScript. Specific techniques are provided for optimizing aspects like reducing DNS lookups, HTTP requests, content size, and avoiding things that hurt JavaScript engine optimization.
The document discusses developing with vert.x. It provides steps for creating a URL shortener including developing modules with static web server and MongoDB, testing modules individually, creating an API server using EventBus, deploying modules with scripts, and easily testing with auto-deploy. It also briefly explains some key features of vert.x like asynchronous programming, modularity, and polyglot programming.
This document discusses caching strategies for Rails applications, including:
1. Using Rails caching for queries, pages, assets, and fragments to improve performance.
2. Configuring Cache-Control headers, compression, and CDNs like Fastly for efficient caching.
3. Techniques for caching dynamic content at the edge using surrogate keys and purging cached responses.
Learn from Fastly veteran Cassandra Dixon on some of the most common customer issues we see — such as why things aren’t caching, misconfigured origins, issues with intermediary proxies, and VCL snafus — and the best ways to resolve them. We’ll also discuss our unique approach to debugging — using seemingly mundane tools to diagnose issues in creative ways — and how you can apply these methods to your own organization to get the most out of Fastly’s offerings.
This document outlines an agenda for discussing JavaScript at the backend using Node.js. The agenda includes explaining what Node.js is, installing Node.js, writing a simple "Hello World" program, running Node.js applications, exploring core Node.js modules like the file system and HTTP modules, and handling HTTP requests. Key points are installing Node.js from its website, using the file system and HTTP modules to interact with files and create an HTTP server, and using a request handler to return different responses based on the URL. The presenter is introduced as an author who works with JavaScript, Node.js, and related technologies.
Webinar: Architecting Secure and Compliant Applications with MongoDBMongoDB
?
High-profile security breaches have become embarrassingly common, but ultimately avoidable. Now more than ever, database security is a critical component of any production application. In this talk you'll learn to secure your deployment in accordance with best practices and compliance regulations. We'll explore the MongoDB Enterprise features which ensure HIPAA and PCI compliance, and protect you against attack, data exposure and a damaged reputation.
Get an overview of HashiCorp's Vault concepts.
Learn how to start a Vault server.
Learn how to use the Vault's postgresql backend.
See an overview of the Vault's SSH backend integration.
This presentation was held on the DigitalOcean Meetup in Berlin. Find more details here: https://www.meetup.com/DigitalOceanBerlin/events/237123195/
Design & Performance - Steve Souders at Fastly Altitude 2015Fastly
?
Fastly Altitude - June 25, 2015. Chief SpeedCurver Steve Souders explains how design and web performance are more interconnected than ever before. Users want a fast website with a rich design, but sometimes the interplay between design and performance feels like a fixed sum game: one side's gain is the other side's loss. Design and performance are indeed connected, but it's more like the yin and yang. They aren't opposing forces, but instead complement each other. Bringing these processes together produces experiences that are rich and fast.
Video from the talk: http://fastly.us/Altitude2015_Design-Performance
Steve's bio: Steve Souders is a co-founder at SpeedCurve, where he develops web performance services. His book, High Performance Web Sites, explains his best practices for performance; it was #1 in Amazon's Computer and Internet bestsellers. His follow-up book, Even Faster Web Sites, provides performance tips for today's Web 2.0 applications. Steve is the creator of many performance tools and services including YSlow, the HTTP Archive, Cuzillion, Jdrop, SpriteMe, ControlJS, and Browserscope. He serves as co-chair of Velocity, the web performance and operations conference from O'Reilly, and is co-founder of the Firebug Working Group.
MongoDB World 2016: From the Polls to the Trolls: Seeing What the World Think...MongoDB
?
YouGov uses MongoDB to store semi-structured survey response data across a globally distributed sharded cluster. They implement tag-aware sharding to partition data by region and leverage migration managers to update schemas across versions. This allows them to provide low-latency reads, scale throughput, and support dynamic surveys worldwide through MongoDB-as-a-Service.
In a dynamic infrastructure world, let's stop pretending credentials aren't public knowledge in an organization and just assume that they have already been leaked, now what?
Chickens & Eggs: Managing secrets in AWS with Hashicorp VaultJeff Horwitz
?
Presented to the Philly DevOps Meetup November 29, 2016.
Managing secrets is hard. It’s even harder in the cloud. At Jornaya (formerly LeadiD), we chose Hashicorp Vault to manage our secrets in AWS, and I’d like to share our experience with everyone.
Presentation done at the November meeting of the Sudoers Barcelona group (https://www.meetup.com/sudoersbcn/).
HashiCorp Vault (https://www.vaultproject.io/)
"Vault és una eina per emmagatzemar i gestionar secrets. Veurem què ofereix, com instal·lar-la, utilitzar-la i operar-la, i la nostra experiència."
Content caching is one of the most effective ways to dramatically improve the performance of a web site. In this webinar, we’ll deep-dive into NGINX’s caching abilities and investigate the architecture used, debugging techniques and advanced configuration. By the end of the webinar, you’ll be well equipped to configure NGINX to cache content exactly as you need.
View full webinar on demand at http://nginx.com/resources/webinars/content-caching-nginx/
This document provides an overview of HashiCorp Vault for securely storing, accessing, and managing secrets. It discusses how Vault can be used to securely store secrets like API keys, passwords, and certificates. The document outlines Vault's architecture, data storage options, authentication methods, policies for access control, and integrating systems using Vault. It also provides an agenda for a demonstration of Spring Cloud Vault integration for retrieving database credentials from Vault and using them to connect to a MySQL database.
In this workshop, we’ll interactively demonstrate lightweight threat modeling techniques to elicit and qualify risks against a typical CDN-fronted web application. We’ll then perform attacks against an example web application and demonstrate how the Fastly edge cloud can mitigate security risks.
Deploying VMware vCloud Hybrid Service with Puppet - PuppetConf 2013Puppet
?
The document discusses automating the deployment of a VMware vCloud Hybrid Service (vCHS) using Puppet. It describes using Puppet to deploy and configure the various vCHS components through their respective APIs, including vCenter, vShield, and vCloud Director. It addresses challenges in automating these components and proposes treating everything as a native Puppet resource, with a "transport" resource to handle connecting to the different component APIs over SSH or REST.
Sounds daunting right? But there is always a case where your organisation has either a custom, or third party system that you could leverage generating secrets for, or maybe an IAM system that doesn't quite fit on the ones included in Vault. Well, a couple of months ago I went from "no go" to writing my first plugin from Vault, and I'd like to tell you how I did it. This talk doesn't require you to know go, but it does require a minimal level of understanding of object oriented programming.
Automatically unseal Vault clusters as a Keybase team. We want to automate the unseal of our on-premise Vault clusters. How can we securely distribute Shamir unseal keys to the team so we can unseal our Vault when we are on-call? How did we initialize our production system in a such way that 2 out 4 people are needed to "unseal the Vault"?
We are using Keybase.io, and automated Vault on Consul cluster, with an Ansible/Vagrant environment to teach and practice.
- Vagrant (tested on Mac)
- Consul OSS
- Vault OSS
- Keybase (vault operator init, vault unseal, KBFS)
- Ansible (Brian Shumate's roles, custom roles)
- Packer (hardened Centos 7)
@bbaassssiiee
https://github.com/dockpack/keybase_unseal
https://github.com/dockpack/vault_dojo
Vault is a tool for securely accessing secrets like API keys and passwords. It allows for [1] generating short-term credentials to access services like AWS, [2] easy revocation of credentials, and [3] auditing of secret access. Vault uses a seal/unseal process where secrets are encrypted at rest requiring threshold of keys to unseal. The document discusses best practices like using tokens for authentication, safeguarding storage backends, and setting up high availability.
Gazelle - Plack Handler for performance freaks #yokohamapmMasahiro Nagano
?
1) Gazelle is a fast PSGI/Plack HTTP server written in Perl and C code.
2) Benchmarks show it can handle 3x more requests per second than other servers for simple applications.
3) Its speed comes from optimizations like using accept4, writev system calls, and being written mostly in fast C code via XS.
На сегодняшний день такие популярные анализаторы, как OWASP ZAP и Burp Suite, не всегда хорошо справляются с задачей автоматического сканирования приложений. Нередко они не могут найти какие-то специфические директории, автоматически отправить запрос без участия человека. И чаще данные инструменты запускаются локально. При этом, если в компании хорошо работает команда по автоматизации тестирования, их работу можно взять за основу динамического анализа и фазинга.
Как бонус, обсудим разницу Burp Suite Professional и Burp Suite Enterprise с точки зрения CI/CD и подключения автоматизированных тестов.
The document describes what ServiceStack is and provides examples of its capabilities. It begins by asking what ServiceStack is, where it came from, and what it does. It then discusses how earlier attempts at SOA failed and what ServiceStack learned from those experiences. Key points are that ServiceStack focuses on message-based services, code-first POCOs, and maximum productivity. Examples show how ServiceStack simplifies common tasks like JSON serialization, ORM, caching, and more.
->It?s web server is able to handle a HUGE number of connections out of the box
->Various libraries can be run on browser, the same as in the server
->Very friendly to Websockets (real-time web apps)
->Lots of libraries are being ported to it from other langs.
->Express, inspired in ruby?s Sinatra; is very light on memory but also very powerful
Vault is a tool for securely accessing secrets. It encrypts and stores secrets and enforces strict access controls. Secrets have a limited lifetime and must be renewed. Vault supports dynamic secret generation, revocation of access, and audit logging. It uses Shamir's secret sharing algorithm to split encryption keys across Vault servers for high availability.
Elasticsearch is an open source search and analytics engine that is distributed, horizontally scalable, reliable, and easy to manage. The document discusses how to install and interact with Elasticsearch using various Java clients and frameworks. It covers using the standard Java client directly, the Jest HTTP client, and Spring Data Elasticsearch which provides abstractions and dynamic repositories.
This document provides an overview and summary of a Node.js workshop presented by Tom Hughes-Croucher. The workshop covers:
1. Why use server-side JavaScript and how Node.js enables this through its event-driven and non-blocking architecture.
2. An introduction to Node.js, including how to install Node.js and build basic HTTP servers.
3. More advanced Node.js topics like modules, events, streams, debugging, and popular frameworks like Express.js.
4. Exercises are provided to help attendees get hands-on experience building Node.js applications.
Nginx is a web server that is faster, uses less memory and is more stable than Apache under load. It is better suited for Rails applications and cloud computing. Nginx acts as a proxy, routing requests to application servers. It can perform request filtering, like caching requests, and authentication checks without modifying Rails application code using custom Nginx modules. This allows separating infrastructure concerns from application logic.
Hideo Kimura from DeNA presented on the MBGA Open Platform and the Hermit gadget server. The key points are:
- The MBGA Open Platform uses OpenSocial 0.9 and allows third party developers to build gadgets and integrate them into social networks.
- Hermit is the gadget server implemented in Perl using PSGI and Plack. It uses pluggable modules and can handle high volumes of requests through lighttpd and FCGI.
- Future directions include supporting OpenSocial 1.0, developing template APIs, and integrating additional authentication methods.
Aditya - Hacking Client Side Insecurities - ClubHack2008ClubHack
?
Hacking Client Side Insecurities discusses discovering clients on the internet and intranet through techniques like fingerprinting embedded devices and HTTP server fingerprinting. It then covers various client side attack patterns such as pluggable protocol handlers, JavaScript jacking, HTTP verb jacking, insecure cookie design, cross-site request forgery attacks targeting both browsers and embedded devices, and traffic hijacking attacks. The document provides demonstrations of these attacks and discusses exploiting client-side insecurities through the manipulation of protocols and scripts.
MongoDB World 2016: From the Polls to the Trolls: Seeing What the World Think...MongoDB
?
YouGov uses MongoDB to store semi-structured survey response data across a globally distributed sharded cluster. They implement tag-aware sharding to partition data by region and leverage migration managers to update schemas across versions. This allows them to provide low-latency reads, scale throughput, and support dynamic surveys worldwide through MongoDB-as-a-Service.
In a dynamic infrastructure world, let's stop pretending credentials aren't public knowledge in an organization and just assume that they have already been leaked, now what?
Chickens & Eggs: Managing secrets in AWS with Hashicorp VaultJeff Horwitz
?
Presented to the Philly DevOps Meetup November 29, 2016.
Managing secrets is hard. It’s even harder in the cloud. At Jornaya (formerly LeadiD), we chose Hashicorp Vault to manage our secrets in AWS, and I’d like to share our experience with everyone.
Presentation done at the November meeting of the Sudoers Barcelona group (https://www.meetup.com/sudoersbcn/).
HashiCorp Vault (https://www.vaultproject.io/)
"Vault és una eina per emmagatzemar i gestionar secrets. Veurem què ofereix, com instal·lar-la, utilitzar-la i operar-la, i la nostra experiència."
Content caching is one of the most effective ways to dramatically improve the performance of a web site. In this webinar, we’ll deep-dive into NGINX’s caching abilities and investigate the architecture used, debugging techniques and advanced configuration. By the end of the webinar, you’ll be well equipped to configure NGINX to cache content exactly as you need.
View full webinar on demand at http://nginx.com/resources/webinars/content-caching-nginx/
This document provides an overview of HashiCorp Vault for securely storing, accessing, and managing secrets. It discusses how Vault can be used to securely store secrets like API keys, passwords, and certificates. The document outlines Vault's architecture, data storage options, authentication methods, policies for access control, and integrating systems using Vault. It also provides an agenda for a demonstration of Spring Cloud Vault integration for retrieving database credentials from Vault and using them to connect to a MySQL database.
In this workshop, we’ll interactively demonstrate lightweight threat modeling techniques to elicit and qualify risks against a typical CDN-fronted web application. We’ll then perform attacks against an example web application and demonstrate how the Fastly edge cloud can mitigate security risks.
Deploying VMware vCloud Hybrid Service with Puppet - PuppetConf 2013Puppet
?
The document discusses automating the deployment of a VMware vCloud Hybrid Service (vCHS) using Puppet. It describes using Puppet to deploy and configure the various vCHS components through their respective APIs, including vCenter, vShield, and vCloud Director. It addresses challenges in automating these components and proposes treating everything as a native Puppet resource, with a "transport" resource to handle connecting to the different component APIs over SSH or REST.
Sounds daunting right? But there is always a case where your organisation has either a custom, or third party system that you could leverage generating secrets for, or maybe an IAM system that doesn't quite fit on the ones included in Vault. Well, a couple of months ago I went from "no go" to writing my first plugin from Vault, and I'd like to tell you how I did it. This talk doesn't require you to know go, but it does require a minimal level of understanding of object oriented programming.
Automatically unseal Vault clusters as a Keybase team. We want to automate the unseal of our on-premise Vault clusters. How can we securely distribute Shamir unseal keys to the team so we can unseal our Vault when we are on-call? How did we initialize our production system in a such way that 2 out 4 people are needed to "unseal the Vault"?
We are using Keybase.io, and automated Vault on Consul cluster, with an Ansible/Vagrant environment to teach and practice.
- Vagrant (tested on Mac)
- Consul OSS
- Vault OSS
- Keybase (vault operator init, vault unseal, KBFS)
- Ansible (Brian Shumate's roles, custom roles)
- Packer (hardened Centos 7)
@bbaassssiiee
https://github.com/dockpack/keybase_unseal
https://github.com/dockpack/vault_dojo
Vault is a tool for securely accessing secrets like API keys and passwords. It allows for [1] generating short-term credentials to access services like AWS, [2] easy revocation of credentials, and [3] auditing of secret access. Vault uses a seal/unseal process where secrets are encrypted at rest requiring threshold of keys to unseal. The document discusses best practices like using tokens for authentication, safeguarding storage backends, and setting up high availability.
Gazelle - Plack Handler for performance freaks #yokohamapmMasahiro Nagano
?
1) Gazelle is a fast PSGI/Plack HTTP server written in Perl and C code.
2) Benchmarks show it can handle 3x more requests per second than other servers for simple applications.
3) Its speed comes from optimizations like using accept4, writev system calls, and being written mostly in fast C code via XS.
На сегодняшний день такие популярные анализаторы, как OWASP ZAP и Burp Suite, не всегда хорошо справляются с задачей автоматического сканирования приложений. Нередко они не могут найти какие-то специфические директории, автоматически отправить запрос без участия человека. И чаще данные инструменты запускаются локально. При этом, если в компании хорошо работает команда по автоматизации тестирования, их работу можно взять за основу динамического анализа и фазинга.
Как бонус, обсудим разницу Burp Suite Professional и Burp Suite Enterprise с точки зрения CI/CD и подключения автоматизированных тестов.
The document describes what ServiceStack is and provides examples of its capabilities. It begins by asking what ServiceStack is, where it came from, and what it does. It then discusses how earlier attempts at SOA failed and what ServiceStack learned from those experiences. Key points are that ServiceStack focuses on message-based services, code-first POCOs, and maximum productivity. Examples show how ServiceStack simplifies common tasks like JSON serialization, ORM, caching, and more.
->It?s web server is able to handle a HUGE number of connections out of the box
->Various libraries can be run on browser, the same as in the server
->Very friendly to Websockets (real-time web apps)
->Lots of libraries are being ported to it from other langs.
->Express, inspired in ruby?s Sinatra; is very light on memory but also very powerful
Vault is a tool for securely accessing secrets. It encrypts and stores secrets and enforces strict access controls. Secrets have a limited lifetime and must be renewed. Vault supports dynamic secret generation, revocation of access, and audit logging. It uses Shamir's secret sharing algorithm to split encryption keys across Vault servers for high availability.
Elasticsearch is an open source search and analytics engine that is distributed, horizontally scalable, reliable, and easy to manage. The document discusses how to install and interact with Elasticsearch using various Java clients and frameworks. It covers using the standard Java client directly, the Jest HTTP client, and Spring Data Elasticsearch which provides abstractions and dynamic repositories.
This document provides an overview and summary of a Node.js workshop presented by Tom Hughes-Croucher. The workshop covers:
1. Why use server-side JavaScript and how Node.js enables this through its event-driven and non-blocking architecture.
2. An introduction to Node.js, including how to install Node.js and build basic HTTP servers.
3. More advanced Node.js topics like modules, events, streams, debugging, and popular frameworks like Express.js.
4. Exercises are provided to help attendees get hands-on experience building Node.js applications.
Nginx is a web server that is faster, uses less memory and is more stable than Apache under load. It is better suited for Rails applications and cloud computing. Nginx acts as a proxy, routing requests to application servers. It can perform request filtering, like caching requests, and authentication checks without modifying Rails application code using custom Nginx modules. This allows separating infrastructure concerns from application logic.
Hideo Kimura from DeNA presented on the MBGA Open Platform and the Hermit gadget server. The key points are:
- The MBGA Open Platform uses OpenSocial 0.9 and allows third party developers to build gadgets and integrate them into social networks.
- Hermit is the gadget server implemented in Perl using PSGI and Plack. It uses pluggable modules and can handle high volumes of requests through lighttpd and FCGI.
- Future directions include supporting OpenSocial 1.0, developing template APIs, and integrating additional authentication methods.
Aditya - Hacking Client Side Insecurities - ClubHack2008ClubHack
?
Hacking Client Side Insecurities discusses discovering clients on the internet and intranet through techniques like fingerprinting embedded devices and HTTP server fingerprinting. It then covers various client side attack patterns such as pluggable protocol handlers, JavaScript jacking, HTTP verb jacking, insecure cookie design, cross-site request forgery attacks targeting both browsers and embedded devices, and traffic hijacking attacks. The document provides demonstrations of these attacks and discusses exploiting client-side insecurities through the manipulation of protocols and scripts.
This document summarizes Hadi Hariri's presentation on embracing HTTP and APIs. The presentation discussed how HTTP can be used as the single interface for both web applications and APIs, allowing them to be developed and maintained as a single system. Key points included how common REST principles like using different HTTP verbs for CRUD operations and returning JSON representations can be applied, as well as best practices for APIs like supporting content negotiation, caching, and hypermedia through links to available actions and related resources.
The document appears to be notes for a book on web application security. It includes an index listing chapter topics such as HTTP, sessions, and the same origin policy. Chapter sections discuss the basics of HTTP requests and responses, status codes, headers, methods, and REST vs SOAP. Other topics covered include how sessions are implemented using cookies to maintain state, same origin policy restrictions, and an appendix about TLS/SSL.
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ BehaviourSoroush Dalili
?
Although web application firewall (WAF) solutions are very useful to prevent common or automated attacks, most of them are based on blacklist approaches and are still far from perfect. This talk illustrates a number of creative techniques to smuggle and reshape HTTP requests using the strange behaviour of web servers and features such as request encoding or HTTP pipelining. These methods can come in handy when testing a website behind a WAF and can help penetration testers and bug bounty hunters to avoid drama and pain! Knowing these techniques is also beneficial for the defence team in order to design appropriate mitigation techniques. Additionally, it shows why developers should not solely rely on WAFs as the defence mechanism.
Finally, an open source Burp Suite extension will be introduced that can be used to assess or bypass a WAF solution using some of the techniques discussed in this talk. The plan is to keep improving this extension with the help of the http.ninja project.
Ocean is an XMPP-based real-time communication framework suite. It uses a subset of the XMPP protocol to provide push-friendly delivery of messages, presence, and other content. The framework includes components for front servers, clustering, HTTP binding, and planned P2P audio/video chat. Handler classes implement event handlers to interface with persistent data stores and services.
Code for Startup MVP (Ruby on Rails) Session 1Henry S
?
First Session on Learning to Code for Startup MVP's using Ruby on Rails.
This session covers the web architecture, Git/GitHub and makes a real rails app that is deployed to Heroku at the end.
Thanks,
Henry
This document summarizes a presentation about optimizing server-side performance. It discusses measuring performance metrics like time to first byte, optimizing databases through techniques like adding indexes and reducing joins, using caching with Memcached and APC, choosing fast web servers like Nginx and Lighttpd, and using load testing tools like JMeter to test performance before deployment. The presentation was given by a senior engineer at Wayfair to discuss their experiences optimizing their platform.
JUDCon 2013- JBoss Data Grid and WebSockets: Delivering Real Time Push at ScaleC2B2 Consulting
?
JUDCon 2013 Presentation by Mark Addy, C2B2 Senior Consultant- JBoss Data Grid and WebSockets: Delivering Real Time Push at Scale
The real time web is coming with WebSockets in HTML 5. The big question is how to deliver event driven architectures for WebSockets at scale. This session delivered by the experienced middleware consultant provides an insight on how combining JBoss Data Grid with WebSockets can deliver enterprise scale push to web devices. The session first provides an introduction to WebSockets and delves into typical JBoss Data Grid architectures and how they deliver linear scalability and high availability. We then look at the event capabilities inherent in JBoss Data Grid that when hooked up to a WebSockets server can deliver data grid updates in real time to HTML 5 mobile devices.
This document discusses different types of SharePoint sandboxes and provides guidance on developing solutions for the SharePoint sandbox environment. It covers the online dedicated, on-premise, and online sandboxes. It provides an overview of the design process, guidelines, and tools like MSOCAF for developing sandboxed solutions. It also discusses topics like the sandbox execution environment, supported artifacts, API scope, and monitoring solutions in the sandbox. The document aims to educate developers on sandbox concepts and best practices for designing sandbox-compatible solutions.
Windows 8 apps can access data from services in several ways:
- They can call ASMX, WCF, and REST services asynchronously using HttpClient and retrieve responses.
- They can access oData services using the oData client library.
- They can retrieve RSS feeds using SyndicationClient and parse the responses.
- They can perform background transfers using BackgroundDownloader.
- They can update tiles periodically by polling a service and setting updates.
This document discusses techniques for footprinting and profiling enterprise applications and networks. It covers identifying web application components, virtual hosts, and default applications using tools like nmap and nc. The document shows how to identify name servers and perform reverse lookups to discover additional hosts. Methods for profiling Ajax frameworks, web services, and entry points are presented. The goal of these techniques is to map assets to entry points to understand application architecture and potential vulnerabilities.
AWS re:Invent 2016: Amazon CloudFront Flash Talks: Best Practices on Configur...Amazon Web Services
?
In this series of 15-minute technical flash talks you will learn directly from Amazon CloudFront engineers and their best practices on debugging caching issues, measuring performance using Real User Monitoring (RUM), and stopping malicious viewers using CloudFront and AWS WAF.
This is the slide I shared on the second community offline party of Horizon-Dalian. The topic is about restful web, and I started from web service and web history, telling people what the REST might be, and then gave six bindings of REST style.
This document provides a summary of key concepts related to web application technologies. It discusses HTTP and HTTP requests/responses, including common headers. It also covers client-side technologies like HTML, CSS, JavaScript, and how they interact with the server via HTTP. On the server-side, it discusses programming languages and frameworks like Java, ASP.NET, PHP, and common databases. It also covers concepts like cookies, sessions, and different encoding schemes used to transmit data.
This document discusses sandboxes in SharePoint, including online dedicated sandboxes, on-premise sandboxes, and SharePoint online sandboxes. It covers the design process, guidelines, and tools for developing sandboxed solutions, including the Microsoft Online Customization Analysis Framework (MSOCAF). Challenges and approaches for authentication and data access in SharePoint online sandboxes are also summarized. The document aims to provide guidance for developing custom solutions in a sandboxed environment.
13. DNS
!
; <<>> DiG 9.8.3-P1 <<>> +trace www. @8.8.8.8
;; global options: +cmd
. 18409 IN NS j.root-servers.net.
. 18409 IN NS b.root-servers.net.
;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 127 ms
!
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
;; Received 491 bytes from 202.12.27.33#53(202.12.27.33) in 318 ms
!
. 172800 IN NS dns..
. 172800 IN NS ns2..
. 172800 IN NS ns3..
. 172800 IN NS ns4..
. 172800 IN NS ns7..
;; Received 201 bytes from 192.31.80.30#53(192.31.80.30) in 409 ms
!
www.. 1200 IN CNAME www.a.shifen.com.
a.shifen.com. 1200 IN NS ns5.a.shifen.com.
a.shifen.com. 1200 IN NS ns4.a.shifen.com.
a.shifen.com. 1200 IN NS ns3.a.shifen.com.
a.shifen.com. 1200 IN NS ns2.a.shifen.com.
a.shifen.com. 1200 IN NS ns1.a.shifen.com.
;; Received 228 bytes from 220.181.37.10#53(220.181.37.10) in 30 ms
42. PreloadScanner
<!—— GOOD ——>
<script src=/slideshow/web-2014/37087385/“large.js”></script>
<script src=“ad.js” async></script>
!
<!—— BAD ——>
<script src=/slideshow/web-2014/37087385/“large.js”></script>
<script>
var s = document.createElement(‘script’);
s.src = “ad.js”;
document.head.appendChild(s);
</script>
43. 书写?高效的 CSS selectors
? Avoid a universal key selector.
? Make your rules as speci?c as possible.
? Remove redundant quali?ers.
? Avoid using descendant selectors, especially
those that specify redundant ancestors.
? Use class selectors instead of descendant
selectors.
https://developers.google.com/speed/docs/best-practices/rendering#UseEf?cientCSSSelectors
71. with statement
function containsWith() {
return 3;
with({}) {}
}
!
containsWith();
%OptimizeFunctionOnNextCall(containsWith);
containsWith();
var status = %GetOptimizationStatus(containsWith);
console.log(status === 2);
72. debugger
var DEBUG = false;
function main() {
if (DEBUG) {
debugger;
}
require(“./biz1”);
require(“./biz2”);
require(“./biz3”);
require(“./biz4”);
}
var DEBUG = false;
function main() {
require(“./biz1”);
require(“./biz2”);
require(“./biz3”);
require(“./biz4”);
}
73. arguments
function fn1(a, b) {
b = b || 10;
return a + b;
}
!
function fn2() {
var args = [].slice.call(
arguments);
}
function fn3(a, opt_b) {
var b = opt_b || 10;
return a + b;
}
!
function fn4() {
var args = [];
for(var i = 0;
i < arguments.length;
i ++ ){
args[i] = arguments[i];
}
}
74. for-in
function nonLocalKey1() {
var obj = {}
for(var key in obj);
return function() {
return key;
};
}
!
var key;
function nonLocalKey2() {
var obj = {}
for(key in obj);
}
function nonLocalKey3() {
var obj = {}
for(var key in obj);
}
75. 数据的渲染
? HTML & CSS
? 没有什么特殊注意的内容
? 控制代码的体积,选择合理的HTML结构
? JavaScript Engine
? JS引擎的性能越来越好
? Make it happy!