Patrick Meenan

Patrick Meenan

@patmeenan.com

Web performance geek on the Chrome team at Google. Formerly WebPageTest, Meta, Cloudflare, AOL...

2.1K followers168 following139 posts

Patrick Meenan
@patmeenan.com

Looking forward to sharing what we've seen work and where the challenges are. The real gold comes in the hallway conversations, comparing notes and brainstorming ideas. @perfnow.nl is the highest concentration of devs with web performance experience and interest you'll find.

performance.now() conference@perfnow.nl

With 2 years of rollouts, we've learned a lot about compression dictionaries and the Web. Patrick will cover what works, where the footguns are, how to maximize their effectiveness, and other experiments around compressing content on the web. @patmeenan.com at perfnow.nl

Patrick Meenan
@patmeenan.com

Synthetic perf testing was valuable for low-noise dev testing and regression detection but lost favor as RUM metrics improved. With AI, accurate, representative, low-noise lab testing is THE unlock to being able to have an agent hill-climb on perf improvements.

Patrick Meenan
@patmeenan.com

This applies to both sides. The site content and hosting as well as the browser itself. Accurate and representative are key though.

Patrick Meenan
@patmeenan.com

If you have web compression (and dictionary) topics you'd like to learn more about, drop them here and I'll see what I can do to make sure they're covered in my Perf.now talk in Nov: perfnow.nl/speakers.htm... Starting work on the outline and content now.

perfnow.nlperformance.now(); 19th and 20th of November 2026, AmsterdamOn 19th and 20th of November 2026, the web performance community will gather at performance.now() in Amsterdam to discuss today’s most important web performance insights.
Patrick Meenan
@patmeenan.com

My take on a modern (AI-curated) news feed (unbiased, fact-focused, multi-source de-duplicated and AI editorially curated). Tech stack, pipeline architecture, GitHub link and color commentary in the blog: blog.patrickmeenan.com/2026/09/07/n... Live site: news-tldr.com

blog.patrickmeenan.comnews-tldr.com - My take on an AI-curated news feed - Patrick Meenan's BlogI’m a news junkie (well, really an information junkie). Usually I consume it through a combination of listening to WTOP news radio when commuting and a Feedl...

Patrick Meenan reposted

Mateusz Krzeszowiak
@krzksz.bsky.social

We made Shopify storefronts faster with automatic Early Hints. By finding and preloading render-blocking resources, we improved p75 FCP by 76ms and LCP by 100ms. No merchant or theme changes required. performance.shopify.com/blogs/blog/f...

performance.shopify.comFaster Shopify storefronts with automatic Early HintsWe recently changed how Shopify uses Early Hints on storefronts. Instead of relying only on resource hints added by theme authors, we now scan generated HTML and automatically identify resources that ...
Patrick Meenan
@patmeenan.com

RUM is invaluable for the end-user ground truth, but being able to simulate/reproduce in a lab environment got 100x more useful with LLM's and agent harnesses. Agents are great at finding optimizations, even if complex (make sure to protect anything you care about with tests).

Patrick Meenan
@patmeenan.com

Finally, a CLI/module for testing compression dictionary deployments: blog.patrickmeenan.com/2026/07/26/t... Thanks to @programmingart.bsky.social @sergeyche.dev and @yoav.ws for not letting me continue to ignore building it 😂

blog.patrickmeenan.comTesting Compression Dictionary Deployments - Patrick Meenan's BlogRobin Marx has been asking me for a Compression Dictionary Transport (RFC 9842) test tool for a long time (since well before AI was actually useful for this...
Patrick Meenan
@patmeenan.com

I feel like the dog from "Up" with my side projects - Squirrel! Today's token-spending project - a 100% local, browser-based iOS messages search tool (from iOS backups). The Apple-provided search isn't great when you're looking for an old message. blog.patrickmeenan.com/2026/07/18/g...

blog.patrickmeenan.comExploring iOS Backups with Golemine - Patrick Meenan's BlogI was getting really frustrated with Apple’s search implementation for the “Messages” app (both on mobile and a MacBook) when trying to find specific message...

Patrick Meenan reposted

Alex Russell
@infrequently.org

If you make websites for a living, stop what you're doing and read this research by @tammyeverts.com; it shows what many of us have been saying for a long time: even if there is such a thing as "fast enough", it's generally *much* faster than you are targeting: embrace.io/blog/research-co…

embrace.ioNew research: The Core Web Vitals thresholds you trust might be wrong for your siteCore Web Vitals data from ten leading online retailers reveals that "good" for Google may not be good enough for your users or your business.
Patrick Meenan
@patmeenan.com

It has been a busy holiday weekend burning all the tokens... Waterfall-tools can now render performance API data (including resource timing, LOAF and JS self-profiling): blog.patrickmeenan.com/2026/07/05/n...

blog.patrickmeenan.comNew field browser performance and profiling tooling - rumcap - Patrick Meenan's BlogEver since browser vendors started exposing advanced performance telemetry APIs directly to the page, such as the Performance Timeline, Long Animation Frames...
Patrick Meenan
@patmeenan.com

Really excited to be speaking about compression on the web at perf now: perfnow.nl We have 2 years of production experience with compression dictionaries now and a better understanding of where the easy wins are, where the sharp edges are and a few other compression experiments.

perfnow.nlperformance.now(); 19th and 20th of November 2026, AmsterdamOn 19th and 20th of November 2026, the seventh edition of performance.now() will take place in Amsterdam—a single track conference, covering today’s most important web performance insights.
Patrick Meenan
@patmeenan.com

As always, I'm MOSTLY excited to talk 1:1 in the hallways with everyone though and compare notes on other performance tooling, work, trade tips on AI-assisted dev and tooling, and just generally catch up.

Patrick Meenan
@patmeenan.com

As much flack as Gemini 3.5 Flash gets for not being in the same league as Opus 4.8 and GPT 5.5, it still finds a LOT of real issues with their work. Using all 3 in concert for "fun" projects and I stand by my earlier assertions that they work best together, reviewing each other, not picking one.

Patrick Meenan reposted

Rob Palmer
@robpalmer.bsky.social

Bloomberg uses a lot of C++ & contributes to the standard as well as various industry conferences and libraries. I’m looking for an experienced engineer to join a distributed systems team in New York working on our core Deployment Infrastructure for the Bloomberg Terminal 🗽 🧵

Patrick Meenan reposted

daniel r(ooooooh) in nyc 🇺🇸
@danielroe.dev

wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed

github.comGitHub - WICG/cross-origin-storage: Explainer for the Cross-Origin Storage (COS) APIExplainer for the Cross-Origin Storage (COS) API. Contribute to WICG/cross-origin-storage development by creating an account on GitHub.

Patrick Meenan reposted

Barry Pollard
@tunetheweb.com

It's happening... We've asked Chromium API owners for permission to ship The Soft Navigation work to allow measuring of Core Web Vitals for SPAs!!

IntentToShip@intenttoship.dev

Blink: Intent to Ship: PerformanceSoftNavigation and InteractionContentfulPaint performance entry

groups.google.comBlink: Intent to Ship: PerformanceSoftNavigation and InteractionContentfulPaint performance entryBlink: Intent to Ship: PerformanceSoftNavigation and InteractionContentfulPaint performance entry

Patrick Meenan reposted

Barry Pollard
@tunetheweb.com

The Chrome DevTools team are doing a "papercuts" sprint where they try to address lots of small, irritating bugs and annoyances. Reply with crbug.com links (no bug, no fix—that's the deal!) and will see what we can do. No promises though as some may be features/too big/unclear how to solve.

crbug.comChromium
Patrick Meenan
@patmeenan.com

Has there been any movement on the legal/copyright side of AI and code (US)? I know fully-AI-generated things can't be copyrighted. Is that still the only part settled? How about AI-assisted? Commercial API subs indemnify but personal don't against copyright violation on generated code?

View full thread
Patrick Meenan
@patmeenan.com

Don't get me wrong, I love the tools and can't imagine working without them, I'm just concerned that the adoption may have gotten ahead of the legal frameworks.

Patrick Meenan
@patmeenan.com

I'm also assuming that the legal frameworks would either need to evolve if they don't currently handle the AI codegen side of things well or put the US at a massive competitive disadvantage against somewhere like China.

Patrick Meenan
@patmeenan.com

Has there been any movement on the legal/copyright side of AI and code (US)? I know fully-AI-generated things can't be copyrighted. Is that still the only part settled? How about AI-assisted? Commercial API subs indemnify but personal don't against copyright violation on generated code?

Patrick Meenan
@patmeenan.com

I assume indemnification, even on the commercial side, still means that company has to be around and capable of absorbing your loss/risk (and that feels like a massive risk they are all carrying if something goes sideways).

Patrick Meenan
@patmeenan.com

I find using different core models more useful than just picking one "best" one. It's like getting different perspectives. They all find things the others miss and approach a problem differently. Models from the same family or with different prompts are too similar.

Patrick Meenan
@patmeenan.com

Awesome writeup. My takeaway is really not so much that Mythos is hype as the AI security tooling in general is REALLY good so don't wait (you can bet the bad guys aren't). Chances are that your project (open or closed) hasn't been as hardened as curl has.

daniel:// stenberg://@bagder.mastodon.social.ap.brid.gy

#Mythos finds a #curl vulnerability yes, as in singular one. https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

daniel.haxx.seMythos finds a curl vulnerabilityyes, as in singular _one_. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model _Mythos_ is _dangerously good_ at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead trickle it out to a selected few companies for a while to allow a few good ones(?) to get a head start and fix the most pressing problems first, before the general populace would get their hands on it. The whole world seemed to lose its marbles. Is this the end of the world as we know it? An amazingly successful marketing stunt for sure. ## My (non-) access Part of the deal with _project Glasswing _was that Anthropic also offered access to their latest AI model to “Open Source projects” via Linux Foundation. Linux Foundation let their project Alpha Omega handle this part, and I was contacted by their representatives. As lead developer of curl I was offered access to the magic model and I graciously accepted the offer. Sure, I’d like to see what it can find in curl. I signed the contract for getting access, but then nothing happened. Weeks went past and I was told there was a hiccup somewhere and access was delayed. Eventually, I was instead offered that someone else, who has access to the model, could run a scan and analysis on curl for me using Mythos and send me a report. To me, the distinction isn’t that important. It’s not that I would have a lot of time to explore lots of different prompts and doing deep dive adventures anyway. Getting the tool to generate a first proper scan and analysis would be great, whoever did it. I happily accepted this offer. (I am purposely leaving out the identity of the individual(s) involved in getting the curl analysis done as it is not the point of this blog post.) ## AI scans of curl Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean _in addition to_ running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc). Primarily AISLE, Zeropath and OpenAI’s Codex Security have been used to scrutinize the code with AI. These tools and the analyses they have done have triggered somewhere between _two and three hundred_ bugfixes merged in curl through-out the recent 8-10 months or so. A bunch of the findings these AI tools reported were confirmed vulnerabilities and have been published as CVEs. Probably a dozen or more. Nowadays we also use tools like GitHub’s Copilot and Augment code to review pull requests, and their remarks and complaints help us to land better code and avoid merging new bugs. I mean, we still merge bugs of course but the PR review bots regularly highlight issues that we fix: our merges would be worse without them. The AI reviews are used _in addition_ to the human reviews. They help us, they don’t replace us. We also see a high volume of high quality security reports flooding in: security researchers now use AI extensively and effectively. Security is a _top_ _priority_ for us in the curl project. We follow every guideline and we do software engineering properly, to reduce the number of flaws in code. Scanning for flaws is just one of many steps to keep this ship safe. You need to search long and hard to find another software project that makes as much or goes further than curl, for software security. Steps involved in keeping curl secure ## May 6, 2026 It was with great anticipation we received the first source code analysis report generated with Mythos. Another chance for us to find areas to improve and bugs to fix. To make an even better curl. This initial scan was made on curl’s git repository and its master branch of a certain recent commit. It counted 178K lines of code analyzed in the src/ and lib/ subdirectories. The analysis details several different approaches and methods it has performed the search, and how it has focused on trying to find which flaws. A fun note in the top of the report says: > curl is one of the most fuzzed and audited C codebases in existence (OSS-Fuzz, Coverity, CodeQL, multiple paid audits). Finding anything in the hot paths (HTTP/1, TLS, URL parsing core) is unlikely. … and it correctly found no problems in those areas. Completely unscientific poll on Mastodon about people’s expectations for Mythos scanning curl ## The size of curl curl is currently 176,000 lines of C code when we exclude blank lines. The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Piece. On average, every single production source code line of curl has been written (and then rewritten) 4.14 times. We have polished on this. Right now, the existing production code in git master that still remains, has been authored by 573 separate individuals. Over time, a total of 1,465 individuals have so far had their proposed changes merged into curl’s git repository. We have published 188 CVEs for curl up until now. curl is installed in over _twenty million instances_. It runs on over _110 operating systems_ and _28 CPU architectures_. It runs in every smart phone, tablet, car, TV, game console and server on earth. ## Five findings became one The report concluded it found **five** “Confirmed security vulnerabilities”. I think using the term _confirmed_ is a little amusing when the AI says it confidently by itself. Yes, the AI thinks they are confirmed, but the curl security team has a slightly different take. Five issues felt like nothing as we had expected an extensive list. Once my curl security team fellows and I had poked on the this short list for a number of hours and dug into the details, we had trimmed the list down and were left with _one_ confirmed vulnerability. The other four were three false positives (they highlighted shortcomings that are documented in API documentation) and the fourth we deemed “just a bug”. The single confirmed vulnerability is going to end up a _severity low_ CVE planned to get published in sync with our pending next curl release 8.21.0 in late June. The flaw is not going to make anyone grasp for breath. All details of that vulnerability will of course not get public before then, so you need to hold out for details on that. The Mythos report on curl also contained a number of spotted bugs that it concluded were not vulnerabilities, much like any new code analyzer does when you run it on hundreds of thousands of lines of code. All the bugs in the report are being investigated and one bye one we are fixing those that we agree with. All in all about twenty bugs that are described and explained very nicely. Barely any false positives, so I presume they have had a rather high threshold for certainty. curl is certainly getting better thanks to this report, but counted by the volume of issues found, all the previous AI tools we have used have resulted in larger bugfix amounts. This is only natural of course since the first tools we ran had many more and easier bugs to find. As we have fixed issues along the way, finding new ones are slowly becoming harder. Additionally, a bug can be small or big so it’s not always fair to just compare numbers ## Not particularly “dangerous” My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing. This is just _one_ source code repository and maybe it is much better on other things. I can only tell and comment on what it found here. ## Still very good But allow me to highlight and reiterate what I have said before: AI powered code analyzers are _significantly_ better at finding security flaws and mistakes in source code than any traditional code analyzers did in the past. All modern AI models are good at this now. Anyone with time and some experimental spirits can find security problems now. The high quality chaos is real. Any project that has not scanned their source code with AI powered tooling will likely find huge number of flaws, bugs and possible vulnerabilities with this new generation of tools. Mythos will, and so will many of the others. Not using AI code analyzers in your project means that you leave adversaries and attackers time and opportunity to find and exploit the flaws you don’t find. ## How AI analyzers differ * They can spot when the comment says something about the code and then conclude that the code does not work as the comment says. * It can check code for platforms and configurations we otherwise cannot run analyzers for * It “knows” details about 3rd party libraries and their APIs so it can detect abuse or bad assumptions. * It “knows” details about protocols curl implements and can question details in the code that seem to violate or contract protocol specifications * They are typically good at summarizing and explaining the flaw, something which can be rather tedious and difficult with old style analyzers. * They can often generate and offer a patch for its found issue (even if the patch usually is not a 100% fix). ## More details from the report **Zero memory-safety vulnerabilities found.** Methodology note: this review is hand-driven analysis using LLM subagents for parallel file reads, with every candidate finding re-verified by direct source inspection in the main session before being recorded. The CVE to variant-hunt mapping was built from curl’s own vuln.json. No automated SAST tooling was used. This outcome is consistent with curl’s status as one of the most heavily fuzzed and audited C codebases. The defensive infrastructure (capped dynbufs everywhere, `curlx_str_number` with explicit max on every numeric parse, `curlx_memdup0` overflow guard, CURL_PRINTF format-string enforcement, per-protocol response-size caps, pingpong 64KB line cap) systematically closes the bug classes that would normally be productive in a codebase this size. Coverage now includes: all minor protocols, all file parsers, all TLS backends’ verify paths, http/1/2/3, ftp full depth, mprintf, x509asn1, doh, all auth mechanisms, content encoding, connection reuse, session cache, CLI tool, platform-specific code, and CI/build supply chain. ## AI finds existing kinds of errors It should be noted that the AI tools find the usual and established kind of errors we already know about. It just finds new instances of them. We have not seen any AI so far report a vulnerability that would somehow be of a novel kind or something totally new. They do not reinvent the field in that way, but they do dig up more issues than any other tools did before. ## More to find These were absolutely not the last bugs to find or report. Just while I was writing the drafts for this blog post we have received more reports from security researchers about suspected problems. The AI tools will improve further and the researchers can find new and different ways to prompt the existing AIs to make them find more. We have not reached the end of this yet. I hope we can keep getting more curl scans done with Mythos and other AIs, over and over until they truly stop finding new problems. ## Credits Thanks to Anthropic and Alpha Omega for providing the model, the tools and doing the scan for us. Thanks also to the individual who did the scan for us. Much appreciated! Top image by Jin Kim from Pixabay Thanks for flying curl. It’s never dull.

Patrick Meenan reposted

performance.now() conference
@perfnow.nl

We just sent out a TEST MAIL to our mailing list. Last year quite a few people didn't see the announcement mail and missed the early bird ticket sale. So this year we run a test first. If you're subscribed to our mailing list, please make sure you got the test mail. Or perfnow.nl/subscribe

Patrick Meenan reposted

Harry Roberts
@csswizardry.com

I’ve been working with a client who runs a lot of social media and ad campaigns, so we’ve been deploying the experimental `No-Vary-Search HTTP` header. It’s amazing to see it actually working! Read all about it here: csswizardry.com/2026/05/bett...

csswizardry.comBetter Browser Caching with No-Vary-Search – CSS WizardryNo-Vary-Search lets HTTP caches ignore irrelevant query parameters such as UTM tags, while still keeping meaningful ones like product variants in the cache key.

Patrick Meenan reposted

Barry Pollard
@tunetheweb.com

There's a new #webperf measurement API in the works! Check out this post looking at the work @jason-williams.co.uk and @jdapena.bsky.social have been putting into there Container Timing—available as an origin trail from Chrome 148 (rolling out next week). developer.chrome.com/blog/contain...

developer.chrome.comContainer Timing origin trial  |  Blog  |  Chrome for DevelopersTry out the Container Timing performance measurement API in origin trial from Chrome 148
Patrick Meenan
@patmeenan.com

Oof, and right after the "Copy Fail" CVE is announced. Hopefully this isn't a sign of things to come as a flood of CVE patches come out. Hope those in project Glasswing are prepared. Fixing is just the first step. @cloudflare.social is going to be busy onboarding.

Hacker News 100@hn100.atproto.rocks

Canonical/Ubuntu have been under DDoS for more than 15h https://status.canonical.com/#/incident/KNms6QK9ewuzz-7xUsPsNylV20jEt5kyKsd8A-3ptQEHpOd8VQ40ZQs-KD81fboQXeGZB94okNHdHBGlCv58Sw== https://news.ycombinator.com/item?id=47972213

status.canonical.comCanonical/Ubuntu have been under DDoS for more than 15hCanonical/Ubuntu have been under DDoS for more than 15h
Patrick Meenan
@patmeenan.com

Really interesting performance/conversion correlation study across a huge swath of Shopify sites. The usual log-normal distribution but strong impact even from 100ms deltas. Particularly interesting in that a lot of the platform is shared/controlled but still wide variety in experiences/content.

Mateusz Krzeszowiak@krzksz.bsky.social

One of the most important pieces about web performance that I've ever worked on is finally live. After a few months of work, my analysis of the correlation between site speed and conversion across the entire @Shopify platform is out: www.shopify.com/enterprise/b...

shopify.comStore Speed and Conversion: What the Data Shows (2026) - ShopifyHow does site speed relate to sales? Find out in this Shopify data deep dive.
Patrick Meenan
@patmeenan.com

I say it every year - if you're even the least bit interested or involved in web performance, this is THE place to be every year. It's the one trip I prioritize my travel budget for. The talks are awesome, but the hallway track is unbeatable. The concentration of experts in one place is insane.

performance.now() conference@perfnow.nl

performance.now() 2026 is coming. Ticket sales will open in May with cheap and ultra-cheap early bird tickets. These will be announced in our newsletter first. So subscribe via perfnow.nl/subscribe perfnow.nl

perfnow.nlperformance.now(); 19th and 20th of November 2026, AmsterdamOn 19th and 20th of November 2026, the seventh edition of performance.now() will take place in Amsterdam—a single track conference, covering today’s most important web performance insights.

Patrick Meenan reposted

Barry Pollard
@tunetheweb.com

Wanna measure Core Web Vitals for SPAs? It's been a long-standing gap, but one that we've been working hard to fill. We're approaching the final stages and have launched one last origin trial (🤞) as the "last call" before we ship it! More details: developer.chrome.com/blog/final-s...

developer.chrome.comFinal Soft Navigations origin trial starting in Chrome 147  |  Blog  |  Chrome for DevelopersTake a last chance to try out the Soft Navigations API before release with this final origin trial.

Patrick Meenan reposted

Tim Kadlec
@tkadlec.bsky.social

I'm very excited about this! Have seen some really significant impact in our tests. With the sizes of websites and JS payloads continuing to increase, this is both important and impactful.

Cloudflare@cloudflare.social

Today, we’re excited to give you a sneak peek of our support for shared compression dictionaries, show you how it improves page load times, and reveal when you’ll be able to try the beta yourself. https://cfl.re/42egXfC

blog.cloudflare.comShared Dictionaries: compression that keeps up with the agentic webToday, we’re excited to give you a sneak peek of our support for shared compression dictionaries, show you how it improves page load times, and reveal when you’ll be able to try the beta yourself.
Patrick Meenan
@patmeenan.com

Really excited to see the support for compression dictionaries that @cloudflare.social is working on. Great background on the feature as well.

Cloudflare@cloudflare.social

Today, we’re excited to give you a sneak peek of our support for shared compression dictionaries, show you how it improves page load times, and reveal when you’ll be able to try the beta yourself. https://cfl.re/42egXfC

blog.cloudflare.comShared Dictionaries: compression that keeps up with the agentic webToday, we’re excited to give you a sneak peek of our support for shared compression dictionaries, show you how it improves page load times, and reveal when you’ll be able to try the beta yourself.
Patrick Meenan
@patmeenan.com

Hmm, with Devtools protocol access, this could fill in for a synthetic testing pipeline. Might be interesting to hook it up to see if it can provide useful testing infrastructure. Obviously not as clean as real devices but much more flexible.

Cloudflare@cloudflare.social

Browser Rendering is now Browser Run, with Live View, Human in the Loop, CDP access, session recordings, and 4x higher concurrency limits for AI agents. https://cfl.re/4sFYx2j

cfl.reBrowser Run: give your agents a browserBrowser Rendering is now Browser Run, with Live View, Human in the Loop, CDP access, session recordings, and 4x higher concurrency limits for AI agents
Patrick Meenan
@patmeenan.com

I've been wanting to build a fully-JS client-based waterfall viewer for a really long time and, with the help of Gemini and Opus finally put one together. I prefer the term "AI-assisted development" rather than "vibe coding" given the amount of engineering, architecture and guidance involved.

Patrick Meenan
@patmeenan.com

It's scary how capable it is for < 100 kB. I'm particularly happy with the tcpdump decoder, handling stream rebuilding, TLS decryption, HTTP1,2 and 3 decoding (including UDP-based QUIC), DNS, DoH, DoT, HPACK, QPACK, Response body extraction and decompression.