3 ms·
What about externally hosted JS libs or ad/tracking scripts? Yes, you can do without all of them, but I don't think that's the case on most sites.
by rbinv 11y ago
What about externally hosted JS libs or ad/tracking scripts? Yes, you can do without all of them, but I don't think that's the case on most sites.
- ryanlol 11y agoYou can (and mostly, should) do without externally hosted JS libs. Ad/tracking scripts is where it gets interesting though, although I'd argue for in-house analytics ads are often a major source of income and therefore business critical. In the end it just comes down to trust, but keep in mind that if you trust Intercom you're also trusting www.icb.co.uk (which just happens to have several persistent XSS vulnerabilities in their ticketing system that could be quite trivially be used to hijack intercom.io), AWS, gandi, google, linode (seriously?), optimizely. And that's just a quick 5 minute audit of the critical infrastructure providers for intercom.io, I strongly believe that if any of these were compromised the attacker could trivially take over any site that is including intercom code on their page. And don't forget, this could also be done recursively, for example optimizely uses edgecast. An attacker that compromises edgecast would be able to insert code into intercom.io. Google fares much better against such inspection, as it relies much less on external infrastructure providers. And since there's no real reason for intercom.io to require users to remotely include their code, I'd avoid using them until they fix their product.
- rbinv 11y agoThanks for elaborating. What do you mean by them "fixing their product"? Make it self-hosted/server-side?
- ryanlol 11y agoOnly the javascript code (and any html) would need to be self hosted. It could still communicate with intercoms API servers, just not load code from remote locations at runtime.