Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
@hint/hint-performance-budget
Advanced tools
hint that that checks if a page passes a set performance budget
performance-budget
)A web performance budget is a group of limits to certain values that affect site performance that should not be exceeded in the design and development of any web project. This could be the total size of a page, size of images you are uploading, or even the number of HTTP requests that your webpage generates.
keycdn - web performance budget
As of January 2018, the average size of a website is 3,545kB:
Although the global average connection is 7.2Mb/s (check Akamai's state of the Internet 2017), "no bit is faster than one that is not sent" (quote by Ilya Grigorik). Web developers need to be mindful not only about the size of their sites, but also the number of requests, different domains, third party scripts, etc. The time required by a browser to download a 200kB file is not the same as 20 files of 10kB.
This hint calculates how long it will take to download all the
resources loaded initially by the website under a 3G Fast
network
(but that can be changed, see "Can the hint be configured?" section). If the load time is greater than 5 seconds,
the hint will fail.
To calculate the final load time, some assumptions and simplifications are done. While the real numbers might be different, the results should provide enough guidance to know if something needs more attention.
The reason for using predefined conditions and assumptions are:
The simplified formula to calculate the time is:
Time = (total number of requests * RTT) +
(number of different domains * RTT) +
(number of different secured domains * RTT) +
(number of redirects * RTT) +
(total number of requests * TCP slow-start phase) +
(total size of resources / bandwidth)
This is the list of things considered:
RTT
(Round-Trip Time) is fixed and changes depending on
the configured network. It assumes all servers respond instantly
and in the same amount of time.DNS lookup
: Every hostname resolution requires 1
RTT, imposing latency on the request and blocking the request while
the lookup is in progress.TCP handshake
: Each request requires a new
TCP connection. TCP connections require 1 RTT before starting to send
information to the server. There's no connection reuse and the maximum
number of connections to a domain (usually 6) is ignored.TCP slow-start phase
: The values used to
calculate the duration are:
cwnd
: 10 network segmentsrwnd
: 65,535 bytes (no TCP window scaling
)segment size
: 1460 bytes
After this phase, the full bandwidth of the connection is used to
download the remaining.TLS handshake
: New TLS connections usually require
two roundtrips for a "full handshake". However, there are ways of
requiring only 1 RTT like TLS False Start
and
TLS Session Resumption
. This hint assumes
the optimistic scenario.HTTP/2
.You can change the type of connection and/or the target load time
in the .hintrc
file, using something such as
the following:
{
"connector": {...},
"formatters": [...],
"hints": {
"performance-budget": ["error", {
"connectionType": "Dial",
"loadTime": 10
}],
...
},
...
}
The possible values and the associated speeds for connectionType
are:
Value | In | Out | RTT |
---|---|---|---|
FIOS | 20 Mbps | 5 Mbps | 4ms |
LTE | 12 Mbps | 12 Mbps | 70ms |
4G | 9 Mbps | 9 Mbps | 170ms |
Cable | 5 Mbps | 1 Mbps | 28ms |
3G | 1.6 Mbps | 768 Kbps | 300ms |
3GFast | 1.6 Mbps | 768 Kbps | 150ms |
DSL | 1.5 Mbps | 384 Kbps | 50ms |
3GSlow | 400 Kbps | 400 Kbps | 400ms |
3G_EM | 400 Kbps | 400 Kbps | 400ms |
2G | 280 Kbps | 256 Kbps | 800ms |
Edge | 240 Kbps | 200 Kbps | 840ms |
Dial | 49 Kbps | 30 Kbps | 120ms |
loadTime
needs to be a number greater than 1
and indicates the time
in seconds to load all the resources.
The default values are:
connectionType
: 3GFast
loadTime
: 5
This means that if the user changes the connectionType
but not the
loadTime
, the hint will use 5
as the target.
3GFast
network using the
established formula.3GFast
network
using the established formula.To use it you will have to install it via npm
:
npm install @hint/hint-performance-budget
Note: You can make npm
install it as a devDependency
using the
--save-dev
parameter, or to install it globally, you can use the
-g
parameter. For other options see npm
's
documentation.
And then activate it via the .hintrc
configuration file:
{
"connector": {...},
"formatters": [...],
"hints": {
"performance-budget": "error",
...
},
"parsers": [...],
...
}
FAQs
hint that that checks if a page passes a set performance budget
The npm package @hint/hint-performance-budget receives a total of 0 weekly downloads. As such, @hint/hint-performance-budget popularity was classified as not popular.
We found that @hint/hint-performance-budget demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.