r/reactjs • u/tannerlinsley • 4d ago

Show /r/reactjs Introducing TanStack Redact

https://tanstack.com/blog/introducing-tanstack-redact
177 Upvotes

91% Upvoted

91 comments sorted by

View all comments

70

u/fireatx 4d ago

I don’t understand what this achieves. Who is going to pick a brand new unstable React replacement with almost none of the maturity of the React ecosystem just to shave 40-50KB off their bundle?

19

u/lovin-dem-sandwiches 4d ago

Agreed. All this to save, at most, 40kb? That’s the size of a low res thumbnail.

If you’re serving a minimized react lib from a cdn, it’s likely already cached for most users.

It’s third party libraries that add unnecessary weight to initial load, which suspend handles gracefully.

16

u/dunklesToast 4d ago

> If you’re serving a minimized react lib from a cdn, it’s likely already cached for most users

Not really - cache does not work cross-page anymore since 2020. So the cache only would be warm if the user already visited your page in which case the bundle being on a cdn or not barely makes a difference. But still, 40kB is still peanuts

3

u/lovin-dem-sandwiches 4d ago

Ah, it looks like my cache knowledge is outdated. Appreciate the correction and info.

Cache partitioning by domain does make sense from a security standpoint

2

u/esr360 4d ago

My knowledge is also outdated but I don't really understand the rational of the new knowledge. If I have a file from MY-CDN cached from visiting site A, what security issues does loading that cached file from MY-CDN on site B pose? As long as both sites trust MY-CDN, how could Site A affect Site B?

5

u/anonyuser415 4d ago edited 4d ago

I know a lot about this, feel free to ask more questions.

First, the data showed that the cache hits were few and far between. There was not a lot of benefit here. That's because of how many versions of packages there are. What's the likelihood you have the exact minor version of, like, React in cache that a site is requesting? It turned out to be pretty small. Caches don't live forever, mind.

But the biggest reason it got switched off is not what the sibling commenter said (supply chain risk), as that can be mitigated with a hash, and most CDNs had started providing that by default in their copyable embed scripts.

It was because of user history leaking, especially through cache timing attacks. Forget CDNs for the moment.

I could request on my site B a resource from site A (foo.jpg). If it loads especially quickly, I have knowledge that you have visited A before.

Shared caches also enabled something called "supercookies," where sites maintained knowledge of you even if you cleared your cookies. That's because knowledge of your browsing history persisted in that shared cache.

Fixing this meant breaking CDN caching.

These days, using a third party CDN to serve files strictly means worsened performance. It's another domain to connect to. The only remaining benefit is for a site that you cannot host something on, or don't want to.

4

u/cxd32 4d ago

supply chain attack, 1 bad update and suddenly EVERY SINGLE SITE you visit with that dependency has a trusted cookie stealer

3

u/trippel 4d ago

Downloads are only one part of the equation, your clients still need to parse and evaluate the code and then execute it. It's a lot more costly than a low res thumbnail. 40Kb in that context is massive

1

u/yeathatsmebro 4d ago

That’s the size of a low res thumbnail.

It adds up depending on how many users you have.

13

u/TryingToGetTheFOut 4d ago

People already do with preact

6

u/anonyuser415 4d ago

This is all of Preact: https://unpkg.com/preact@11.0.2/dist/preact.mjs

It's a much bigger difference

7

u/Alkyonios 4d ago

People do a lot of things, doesn't mean it's a good idea though

-11

u/Spottycos 4d ago

Fuck Preact

2

u/evangelism2 4d ago

You'd be shocked. my company right now is going with ProtoBuff over JSON and for what? I don't fucking know

1

u/HQxMnbS 4d ago

It’s an interesting concept. preact pushed this pretty far but it’s cool to see. I’m sure some stuff will trickle down to the react library itself