4 ms·
You need to be careful about user privacy with things like this. You're leaking user information to third party services, and you need to make this clear to you
by ig1 17y ago
You need to be careful about user privacy with things like this. You're leaking user information to third party services, and you need to make this clear to your users, especially if you're dealing with anything that could be considered at all sensitive.
- appathy 17y agoTrue, although its not any different than running Analytics or Adwords.
- ig1 17y agoYep, but those are more concious business decisions. This is the kind of thing someone might decide to do on a whim without thinking of the repercussions and make suitable adjustments to privacy polices, etc.
- jackowayed 17y agoCare to explain yourself? All using a CDN for JS libraries does is have the same exact code get to the user faster and not eat your bandwith. Unless the CDN threw some extra code in, which someone would eventually notice (seriously marring the company's reputation), it doesn't send any info to the company hosting the code. But it is a good point. You should make sure you really trust the company hosting the code for you. Edit: Oh, right. When I read the comment I was thinking more of it letting them steal all of the info on the page, or something, which would be doable if they inserted extra code.
- Willie_Dynamite 17y agoYou've never heard of access logs?
- harpastum 17y agoI think the OP's point was that you're giving all of the traffic information to the CDN, i.e. they can monitor the people that you're sending to them.
- pyre 17y ago> Edit: Oh, right. When I read the comment I was thinking more of it letting them steal all of the info on the page, or something, which would be doable if they inserted extra code. Stealing info from the page is still possible. It would be hard to crowd-source the detection of such things if they were either: 1) randomly inserted into <1% of all requests; 2) they were targeted at specific IPs/IP ranges; or 3) they were targeted at requests coming from specific sites.
- stilist 17y agoI’d sort of assumed the traffic information was one of Google’s primary motivations for hosting all these libraries.
- jamesbritt 17y agoI particularly annoyed by banks doing this. I assume can trust the bank itself, but why would I want to also pull down content and scripts from cdn.whoknowswhere.com or tangentialservice.com? If I'm signed in, doing monetary transactions, I don't want to deal with any other domain but the primary.
- jhancock 17y agoI installed a firewall at a doctor's office last week. I set the defaults to block pretty much everything so I could whitelist sites the office staff truly needed. The following Monday, I sat around and whitelisted things as the staff stumbled on what they needed. I was amazed at how many third party sites were being hit from health insurance and government sites. This stuff is supposed to be secure, but everything from login to home page to submitting claims had requests to third party domains. I'd say less than half of these third party requests appeared to CNDs.