navsurf.com

Every entry is one step in the chain, and what it is allowed to assume

Origins · the flagship piece

Everything in the chain still answers to a machine that sat under a desk in Geneva

Tim Berners-Lee wrote the first server on a NeXT cube at CERN, and the protocol it spoke is recognisably the one still in use. Nothing that followed was allowed to break it.

The first serverLong readRead the piece

A data-centre aisle in cold blue light, cabinets closing on a single figure at the far end
Stage 01 · OriginsThe rooms changed completely; the sequence inside them did not. Every stage below still ends in a building like this one, running a protocol first spoken by a workstation under a desk.

The register

Six stages · in order · what each one is allowed to assume
Read down. Each stage hands its output to the next.
NoStageAllowed to assumeWaits forSpecification
01 Origins

One machine at CERN, and a rule that outlived it: nothing already published may be broken.

 That whatever shipped before it is permanent. Nothing. The other five stand on this row. HTML Standard
WHATWG · W3C
02 Resolution

The name is read right to left — root, registry, then the servers holding the record. Each step answers with a pointer.

 That a nearer resolver has already asked. A referral at each level; a cached answer to expire. RFC 1034
RFC 1035
03 Trust

A chain of certificates has to terminate in a root the machine already holds.

 That the roots it shipped with are still worth trusting. A complete chain; a clock that agrees. RFC 8446
CA/B Forum BRs
04 Rendering

Bytes become a tree while the document is still arriving, then wait for the rules.

 That a script it has not reached may rewrite the tree. Every blocking stylesheet, script and font. HTML Standard
DOM Standard
05 The Cascade

Which rule wins is a score, not reading order.

 That a later rule may still override this one. The last applicable stylesheet. CSS Cascade
CSS Fonts
06 Where Browsers Differ

Where the specification declined to say, three engines answered separately.

 Nothing. A conformance suite to prove agreement. Engine behaviour
Conformance suites

The chain, drawn once

Not to scale · nothing here is timed
[ 01 ORIGINS · SETTLED LONG BEFORE ANY OF THIS ] BROWSER address typed 02 RESOLUTION RESOLVER keeps answers ROOT referral only TOP-LEVEL DOMAIN another referral AUTHORITATIVE holds the record cached — until the TTL expires 03 TRUST SOCKET + TLS chain verified against a root already stored 04 RENDERING BYTES in chunks rules arrive last 05 THE CASCADE tree, still growing [ 06 WHERE BROWSERS DIFFER · ALL OF THE ABOVE, IMPLEMENTED THREE TIMES ]

Where to start

Three pieces · the rest are in the register
A developer's screen showing a waterfall timing chart with staggered bars

The critical path

Before a pixel can be drawn the browser must build two trees, combine them and know the rules. A stylesheet on a slow origin holds a blank window in a document that has otherwise fully arrived.

Rendering · long read
 A browser certificate detail panel open on screen with the chain visible

The certificate chain

Your browser trusts a small set of roots. Everything else is vouched for down a chain from one of them.

Trust
 A CSS rule written out large on a whiteboard with parts circled in marker

Specificity

A scoring system decides which rule wins, and it is not the one that appears last.

The Cascade

Stage 06

The same document does not become the same page everywhere

Three pieces on divergence

Font loading
Blink and Gecko swap in a substitute face; WebKit has historically kept the text invisible for longer.
A missing link
Given an incomplete certificate chain, some clients repair it from what they have seen before and others refuse.
Trust stores
Mozilla ships its own root list; Apple and Microsoft maintain theirs.

Set and published with the support of

Marks only, in the order they were added