This finding examines the sustainability of bundling and storage partitioning in web development. Bundling dependencies into a single file can improve efficiency, but it results in repeated downloads of resources, negatively impacting end-user experience. Partitioning client-side storage by origin benefits user privacy and security but increases storage, energy consumption, and bandwidth costs. The finding suggests experimenting with smart delays for cache fetches and bundling with delta transport as potential mitigations. The finding highlights the need for awareness of the hidden costs and sustainability risks and the benefits of reusing client-side resources.

This document is an early draft and does not reflect the consensus of the TAG.

## Introduction Improvements in both the performance and efficiency of modern computers, combined with tremendous advances in optimizations within web browsers have made it possible to run large web applications while providing a near-native user experience and performance. This allowed developers to essentially move towards a development pattern that enables code re-use from many small packages. The downside of the agility gained by this pattern is that when this practice was first introduced, transporting many small files was not efficient, and modules were not readily available. Bundling all of these dependencies into a single file and compressing it became a common practice for both transport efficiency and easier dependency management, analogous to static linking in native development. The unfortunate side effect of this practice is that it results in the user having to download duplicate code, as the browser is unable to determine if a given bundle contains a specific library. Additionally, various privacy and security issues identified with client-side storage mechanisms have been mitigated by the introduction of storage partitioning, also known as double-keying. [[PARTITIONING]] [[COSI]] [[TIMING]] [[XS-LEAKS]] While necessary, this has had the negative effect of increased transport costs. The repeated downloads of resources can mean increased delay, energy consumption, storage bloat, and data cost to the end user. ## Transport Sustainability on the Web Platform We want to increase broader community awareness of the hidden costs and sustainability risks introduced by bundling and storage partitioning. Neither transport nor computation is free; these are costs that both the content provider and the user ends up paying. Also, different user populations pay different comparative costs for transport. Having to download chunks of code that are largely duplicated repeatedly is detrimental to the end-user experience. A simple thought experiment would be to think about how many times jQuery has been downloaded since its introduction; and how much we could have saved users in data packet fees if there was some level of re-use on the client side. ## Benefits and Costs of Storage Partitioning The effort to partition all client-side storage mechanisms began [in 2013](https://bugs.webkit.org/show_bug.cgi?id=110269). There are two kinds of attacks that storage partitioning mitigates: 1. Without storage partitioning, Site A can infer that a user has visited Site B, and can discover state from Site B specific to the user, by embedding resources from Site B. [[COSI]] [[TIMING]] [[XS-LEAKS]] 2. Without storage partitioning, a site that provides a service to many other sites by being embedded onto them can track users across those sites. [[PARTITIONING]] Storage partitioning has been quite successful at addressing these attacks, but the tradeoffs made are considerable. Loading resources separately for each origin results in: - Lessened benefit of different websites loading shared resources from a CDN, which is not well understood by developers. - Additional storage space is required to store these cached resources. - Additional packages are transferred over the wire, which, in many scenarios, can be an actual financial burden for users. - Additional energy is consumed as extra CPU cycles are used for decoding, parsing, and executing resources. - Additional bandwidth used must be paid for by users, intermediaries, and content providers. ## The Hidden Cost of Bundling Bundling lowers latency, lowers the transport cost by reducing the number of requests and makes the package atomic, but the hidden cost is the unused payload and the recurring cost of it during an update. There is also the inherent risk of “write amplification”, where even a single byte change in a web application requires downloading the entire application from scratch. There is a definite cost associated with this, both from the end of providing the application, as well as receiving the application. When HTTP/2 [[RFC9113]] was introduced, attempts were made to alleviate the need for bundling using Server Push, but the performance gain was not noticeable enough to justify the complexity cost. The introduction of HTTP/3 [[RFC9114]], based on QUIC [[RFC9000]] may provide new solutions to these issues. ## Angles for Experimentation We cannot compromise on the security and privacy guarantees that double keying provides. Additionally, no immediate replacements provide equivalent conveniences and functionality that bundling provides as of the time of writing. If we move the ecosystem to be unbundled, the cost of transport will go up. However, we cannot simply remove double keying to alleviate that cost. One potential way forward could be to experiment with mechanisms that emulate the effects of double-keyed caching through a software layer but not necessarily trigger the wire transport. One potential avenue could involve a noising layer on top of a single-keyed cache, which adds enough noise to prevent attacks that rely on timing (e.g., artificial delays) or metadata (e.g., adding noise in latent state). ## Call to Action Unfortunately, the solution to this is largely an unsolved problem and the web platform does not yet have all the machinery needed to solve this problem. We would like to see experts from the community to experiment with different approaches to find a more sustainable solution and eventually propose a solution that reduces the costs while preserving the security and privacy guarantees we have today.