codalume.com

measured from the outside

Performance — measured, then published

The front page, last run: 7 requests, 24,670 bytes on the wire, 18 ms to first byte, 0 third-party requests. A fast site is an engineering claim, and claims are cheap. This page publishes the measurement instead: page weight, request counts, TLS, compression and time-to-first-byte, taken from the live edge with curl — no external services, no synthetic-SaaS account, no third party anywhere in the pipeline.

source scripts/perf-measure.sh · measured 2026-10-21T21:35:42Z · live data

The two claims

Everything below is evidence. These two sentences are the position — and each one names what would prove it wrong.

claim 1 · measured

No third-party requests, ever

Nothing this site ships makes a request to a host we do not run. The measurement fetches every subresource each page references, classifies every host against a first-party allowlist, and publishes the full host list unedited. If the count were ever above zero, the script would exit non-zero and this page would show the number anyway.

third-party requests: 0 of 21 · hosts seen: codalume.com

claim 2 · by construction

No client-side framework

Every page is HTML rendered by the server (Axum + minijinja). The two small scripts are plain JavaScript enhancements — the contact form's fetch path and the nav toggle; a page is complete without either. The CSP says script-src 'self', so no other script could load even if someone tried.

framework requests: 0 · framework bytes: 0 · runtime: none

The run

curl from the homelab network against the public edge. TTFB is time-to-first-byte at the TCP+TLS edge (curl time_starttransfer, median of 3 samples) — a server-response proxy, not a browser render metric. Requests and bytes count the HTML plus every subresource the page references (stylesheet/icon/preload/script/img/svg-image, then url() inside fetched CSS), each unique URL fetched once per page. html/asset bytes are the decoded sizes; *_transfer_bytes are the on-the-wire sizes read from the Content-Length response header (curl decodes gzip/br bodies, so its size_download is the decoded size).

21
requests, three pages

HTML plus every referenced subresource, counted per page

0
third-party requests

must stay zero; the script fails loud otherwise

248,930 B
page weight, decoded

summed over the three pages, subresources included

68,083 B
page weight, on the wire

compressed transfer sizes from the response headers

TLSv1.3
TLS at the edge

TLS_AES_128_GCM_SHA256

HSTS on
strict transport security

max-age=31536000; includeSubDomains

Per page

One row per measured page; assets are listed under each.

page HTML HTML on the wire requests 3rd-party TTFB median encoding HTTP
/ 35,671 B 8,744 B 7 0 18 ms gzip HTTP/2
/incidents.html 19,000 B 5,020 B 7 0 25 ms gzip HTTP/2
/stats.html 28,110 B 6,541 B 7 0 25 ms gzip HTTP/2
transport

TLS & certificates

  • http → https: 301 https://codalume.com/
  • tls version: TLSv1.3
  • cipher: TLS_AES_128_GCM_SHA256
  • issuer: C=US, O=Let's Encrypt, CN=YR2
  • certificate valid until: Jan 18 21:29:48 2027 GMT
compression

How the bytes shrink

content-encoding as served to a client that advertises br and gzip. HTML answers gzip from the application; decoded sizes are what a browser parses, transfer sizes are what the network carries.

hsts: max-age=31536000; includeSubDomains

method

How this page measures

  • curl, grep, awk, sed — nothing else. No external service, no headless browser, no JS engine.
  • A request is the HTML plus every subresource the page references (stylesheet, icon, preload, script, image, then url() inside fetched CSS); each unique URL is fetched once per page.
  • TTFB is curl's time_starttransfer, median of three samples — time-to-first-byte at the TCP+TLS edge. It is a server-response proxy, not a browser render metric.
  • No RUM, on purpose: real-user monitoring means third-party JavaScript on the page, which is exactly the thing being claimed absent.
  • Measured from inside the lab network against the public edge — a visitor on a slower path may see a higher TTFB than the number published here.
honesty notes

What this page will not hide

  • An embarrassing number. If a measurement is slow or heavy, it is published anyway — that honesty is the page.
  • The date. Every measurement is stamped with the run time and shown next to the data.
  • The hosts. Every host a request went to is listed unedited; a third party would appear here before anywhere else.
  • Its own weight. This page is part of the claim and part of the measurement, like every other page.

The dataset itself is public at /assets/data/perf.json.