{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/preload/issues/139","repository_url":"https://api.github.com/repos/w3c/preload","labels_url":"https://api.github.com/repos/w3c/preload/issues/139/labels{/name}","comments_url":"https://api.github.com/repos/w3c/preload/issues/139/comments","events_url":"https://api.github.com/repos/w3c/preload/issues/139/events","html_url":"https://github.com/w3c/preload/issues/139","id":467510450,"node_id":"MDU6SXNzdWU0Njc1MTA0NTA=","number":139,"title":"Specifying Range in Link preload header for HTTP/2 Push","user":{"login":"roger-on-github","id":34751549,"node_id":"MDQ6VXNlcjM0NzUxNTQ5","avatar_url":"https://avatars2.githubusercontent.com/u/34751549?v=4","gravatar_id":"","url":"https://api.github.com/users/roger-on-github","html_url":"https://github.com/roger-on-github","followers_url":"https://api.github.com/users/roger-on-github/followers","following_url":"https://api.github.com/users/roger-on-github/following{/other_user}","gists_url":"https://api.github.com/users/roger-on-github/gists{/gist_id}","starred_url":"https://api.github.com/users/roger-on-github/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roger-on-github/subscriptions","organizations_url":"https://api.github.com/users/roger-on-github/orgs","repos_url":"https://api.github.com/users/roger-on-github/repos","events_url":"https://api.github.com/users/roger-on-github/events{/privacy}","received_events_url":"https://api.github.com/users/roger-on-github/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":20,"created_at":"2019-07-12T16:56:29Z","updated_at":"2019-08-07T20:27:35Z","closed_at":null,"author_association":"NONE","body":"Hi there preload folks. We would like a way to signal an HTTP Range when a resource is specified in a rel=preload Link header.\r\n\r\nOur use case for this is media delivery over HTTP, specifically the Low-Latency HLS design described here: https://developer.apple.com/documentation/http_live_streaming/protocol_extension_for_low-latency_hls_preliminary_specification\r\n\r\nLL-HLS makes use of HTTP/2 Push to eliminate one round trip per (partial) media segment download. (Client round trip times to media servers can exceed 100 (or even 200) ms, particularly on cellular networks, even in the U.S.  When playing at very low delay-from-live (2s or less), the client can only buffer around 1s ahead of the playhead (because that’s all there is). New segments must be loaded in a timely fashion to prevent playback from stalling. Reducing load time by 10% of the overall budget is a significant win.)\r\n\r\nThe LL-HLS spec includes a BYTERANGE attribute because there are some use cases (such as inserting prerecorded, prepackaged ads into a low-latency live stream) where it’s an advantage to deliver media segments as sub-ranges of larger resources. At the core protocol level, HTTP/2 can already push Range responses. But many HTTP caches (i.e. CDNs) rely on the Link header to communicate the push downstream. We need a way to inform the HTTP cache server of the range.\r\n\r\nA recent discussion on the IETF-HTTP-WG list suggests that we’re not the only ones interested in such a feature.\r\n\r\nIs this something that you guys could help out with?"},"comment":{"url":"https://api.github.com/repos/w3c/preload/issues/comments/519256253","html_url":"https://github.com/w3c/preload/issues/139#issuecomment-519256253","issue_url":"https://api.github.com/repos/w3c/preload/issues/139","id":519256253,"node_id":"MDEyOklzc3VlQ29tbWVudDUxOTI1NjI1Mw==","user":{"login":"rniwa","id":285965,"node_id":"MDQ6VXNlcjI4NTk2NQ==","avatar_url":"https://avatars0.githubusercontent.com/u/285965?v=4","gravatar_id":"","url":"https://api.github.com/users/rniwa","html_url":"https://github.com/rniwa","followers_url":"https://api.github.com/users/rniwa/followers","following_url":"https://api.github.com/users/rniwa/following{/other_user}","gists_url":"https://api.github.com/users/rniwa/gists{/gist_id}","starred_url":"https://api.github.com/users/rniwa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rniwa/subscriptions","organizations_url":"https://api.github.com/users/rniwa/orgs","repos_url":"https://api.github.com/users/rniwa/repos","events_url":"https://api.github.com/users/rniwa/events{/privacy}","received_events_url":"https://api.github.com/users/rniwa/received_events","type":"User","site_admin":false},"created_at":"2019-08-07T20:27:35Z","updated_at":"2019-08-07T20:27:35Z","author_association":"NONE","body":"> @yoavweiss Restricting the range attribute to the Link header would mean that it would have no browser (javascript) processing model, correct? That would prevent any javascript attacks. That seems to address all the concerns that were raised.\r\n\r\nNo, because the script can always create and insert a new link element with `rel=preload` and mount the same attack. Just allowing in link element is not a meaningful mitigation."}}
{"actor":{"display_login":"rniwa"}}