defjosiah's comments

defjosiah | 11 months ago | on: The “S” in MCP Stands for Security

FYI, there is actually this implementation detail in the model spec, https://model-spec.openai.com/2025-02-12.html#chain_of_comma...

Platform: Model Spec "platform" sections and system messages

Developer: Model Spec "developer" sections and developer messages

User: Model Spec "user" sections and user messages

Guideline: Model Spec "guideline" sections

No Authority: assistant and tool messages; quoted/untrusted text and multimodal data in other messages

defjosiah | 5 years ago | on: Lies, damn lies, and front-end tracking

This type of thing usually ends up being “death by a thousand cuts”. async + defer help out, but they do still incur parsing and evaluation (iirc, before document onload event) overhead. If you delay loading until you’re sure the page is interactice, you’ll end up loading third-party pretty late (which impacts metrics, and usually isn’t out of the box supported).

On a standard product-ey site with retargeting ads, user tracking, etc. this third-party slowdown is significant.

All of this is exacerbated on lower-end devices, and non-WiFi Internet.

defjosiah | 5 years ago | on: Lies, damn lies, and front-end tracking

You can (usually accidentally) end up with a render blocking script tag. In this article example it was client-side optimizely.

The parsing and execution of third-party javascript is definitely non-trivial if you profile it, especially on lower end devices.

Finally, browser download priority requires async and defer attributes on scripts (usually), or other clever ways of deferring loading.

defjosiah | 5 years ago | on: Lies, damn lies, and front-end tracking

I worked with Alexey on this project. It’s pretty straightforward to filter out bots (either before send, or in analysis later). For our traffic, it was mostly commonly known bot user-agents. I’m also pretty sure malicious bots get blocked by Cloudflare before hitting the Cloudflare workers.
page 1