I just added https://github.com/D-Programming-Language/dlang.org/pull/770, which generates minified css files. This is because in the near future css files will become heftier (more documentation comments, more detailed styles etc).

The disadvantage is that now one needs to be online to generate documentation. Thoughts?


Andrei

On Friday, 16 January 2015 at 17:40:40 UTC, Andrei Alexandrescu wrote:
> I just added https://github.com/D-Programming-Language/dlang.org/pull/770, which generates minified css files. This is because in the near future css files will become heftier (more documentation comments, more detailed styles etc).
>
> The disadvantage is that now one needs to be online to generate documentation. Thoughts?

I would advise against this. If added, it should be opt-in.

I see the following issues:

- The service in question might be occasionally down, or might be shut down completely at some point. This makes it an additional point of failure.

- High website load or poor Internet speeds will increase the time needed to build the website.

- We can't know for sure that at some point the owners of cssminifier.com won't decide to inject evil code in the output. Even if you trust the owners, the service might get hacked with the same outcome.

- As the request goes over HTTP, you also need to trust every peer between your machine and the website to not perform a MITM attack.

I think relying on a random 3rd-party service is acceptable for an amateur or hobbyist website, which we are not. Instead, I suggest adding an optional (opt-in) rule which invokes an offline CSS minifier.

On 1/16/15 9:58 AM, Vladimir Panteleev wrote:
> On Friday, 16 January 2015 at 17:40:40 UTC, Andrei Alexandrescu wrote:
>> I just added
>> https://github.com/D-Programming-Language/dlang.org/pull/770, which
>> generates minified css files. This is because in the near future css
>> files will become heftier (more documentation comments, more detailed
>> styles etc).
>>
>> The disadvantage is that now one needs to be online to generate
>> documentation. Thoughts?
>
> I would advise against this. If added, it should be opt-in.

Thanks for the feedback.

> I see the following issues:
>
> - The service in question might be occasionally down, or might be shut
> down completely at some point. This makes it an additional point of
> failure.

To counter that I was thinking of:

curl -X POST -s --data-urlencode 'input@$<' http://cssminifier.com/raw >$@ || cp $< $@

This is nice modulo possible delays due to slow timeouts.

I should also add that we already connect online to fetch LATEST from github. Incidentally today that takes forever :o).

> - High website load or poor Internet speeds will increase the time
> needed to build the website.

Actually that's not the case in my experience. Did you build the site recently, i.e. with dub in tow? Build time is dominated by running dub, and it's impossible to run it on only the modified portions of the site. make -j on my laptop takes one full minute without doing anything online. Running a few curls in parallel with that have plenty of time to finish.

Then dub generates 286 MB worth of stuff, which takes a long time to rsync. (For perspective: the pre-dub site, images and all, was 19 MB.) I'm not sure whether rsync gets further confused by the necessity of wiping all files and generating them again, whether they're identical or not.

I confess I'm unhappy with dub. I was hoping for a turnkey solution that also opens up new possibilities. Sadly it adds its own problems, and those it solves I know how to do simpler with ddoc and tooling around it. As things are, I found myself with another project in my lap that I need to babysit.

> - We can't know for sure that at some point the owners of
> cssminifier.com won't decide to inject evil code in the output. Even if
> you trust the owners, the service might get hacked with the same outcome.

Good point. We could, of course, store the converted css and inspect it before uploading, but seems a bit like meteor insurance to me.

> - As the request goes over HTTP, you also need to trust every peer
> between your machine and the website to not perform a MITM attack.
>
> I think relying on a random 3rd-party service is acceptable for an
> amateur or hobbyist website, which we are not. Instead, I suggest adding
> an optional (opt-in) rule which invokes an offline CSS minifier.

That's a rather dim view of online services :o). What would be a trustworty offline CSS minifier?

Overall I'm unconvinced of your arguments and I think we should move forward with https://github.com/D-Programming-Language/dlang.org/pull/770 or a variation thereof.


Andrei

On 1/16/15 9:58 AM, Vladimir Panteleev wrote:
[snip]

Just made css minification opt-in. -- Andrei

On Fri, Jan 16, 2015 at 10:16:55AM -0800, Andrei Alexandrescu via Digitalmars-d wrote:
> On 1/16/15 9:58 AM, Vladimir Panteleev wrote:
> >On Friday, 16 January 2015 at 17:40:40 UTC, Andrei Alexandrescu wrote:
> >>I just added https://github.com/D-Programming-Language/dlang.org/pull/770, which generates minified css files. This is because in the near future css files will become heftier (more documentation comments, more detailed styles etc).
> >>
> >>The disadvantage is that now one needs to be online to generate documentation. Thoughts?
> >
> >I would advise against this. If added, it should be opt-in.
[...]

I also advise against this. I do run documentation builds a lot when working on PRs -- to verify the generated docs are satisfactory, for example. Sometimes I work on PRs when I don't have a network connection. It would really, *really* suck if I can't do any useful work unless I have a stable connection. (Not to mention, sometimes I have to work behind firewalls, which can make otherwise reliable internet hosts unreliable.)

Please make this opt-in. Otherwise I will really lose a lot of motivation to work on docs. It's already bad enough that the dlang.org repo depends on all sorts of external tools, like kindle, latex, etc., most of which I don't (immediately) care about. Fortunately, the 'html' target of the makefile allows me to successfully generate the HTML docs without installing all sorts of software that I otherwise never use.

If you feel absolutely compelled to use an online minifier, can you at least make it possible to build the docs *without* it? And I mean a dedicated build target that bypasses that step completely; half-hearted hacks like waiting for the connection to timeout is not a viable option because it would just slow things down to the point I would probably just give up and throw away any doc contributions.


T

-- 
Nearly all men can stand adversity, but if you want to test a man's character, give him power. -- Abraham Lincoln

On Fri, Jan 16, 2015 at 10:37:38AM -0800, Andrei Alexandrescu via Digitalmars-d wrote:
> On 1/16/15 9:58 AM, Vladimir Panteleev wrote:
> [snip]
> 
> Just made css minification opt-in. -- Andrei

Thanks!!


T

-- 
"Maybe" is a strange word.  When mom or dad says it it means "yes", but when my big brothers say it it means "no"! -- PJ jr.

On Friday, 16 January 2015 at 18:16:55 UTC, Andrei Alexandrescu wrote:
> What would be a trustworty offline CSS minifier?

http://yui.github.io/yuicompressor/

Its only dependency is Java.

Usage: java -jar yuicompressor-*.jar --type css < input.css > output.css

On Friday, 16 January 2015 at 18:16:55 UTC, Andrei Alexandrescu wrote:
> I should also add that we already connect online to fetch LATEST from github. Incidentally today that takes forever :o).

We (and a lot of other people) already trust GitHub. Also, GitHub is HTTPS-only.

> That's a rather dim view of online services :o).

This is not so much about online services in general, but more about online services created by some random guy which process code that will end up on our website. If the website was created by a generally trusted organization, transferred data securely, and/or operated on e.g. plain text, then some of my points would not apply.

> What would be a trustworty offline CSS minifier?

FWIW, YUI compressor is what I use for DFeed.

On 1/16/15 12:40 PM, Andrei Alexandrescu wrote:
> I just added
> https://github.com/D-Programming-Language/dlang.org/pull/770, which
> generates minified css files. This is because in the near future css
> files will become heftier (more documentation comments, more detailed
> styles etc).
>
> The disadvantage is that now one needs to be online to generate
> documentation. Thoughts?

Almost all browsers support gzip transfer of files. You'd get much better mileage with just gzipping the file.

-Steve

On 1/16/15 10:40 AM, H. S. Teoh via Digitalmars-d wrote:
> On Fri, Jan 16, 2015 at 10:37:38AM -0800, Andrei Alexandrescu via Digitalmars-d wrote:
>> On 1/16/15 9:58 AM, Vladimir Panteleev wrote:
>> [snip]
>>
>> Just made css minification opt-in. -- Andrei
>
> Thanks!!

Glad it works for you. Vladimir, is opt-in okay with you as a first step toward a more secure solution? -- Andrei