4 ms·
Had to enable 3 different external JS sources to get the page to work. I don't mind sites using CDNs but please try and reduce the surface for external threats!
by sleepychu 9y ago
Had to enable 3 different external JS sources to get the page to work. I don't mind sites using CDNs but please try and reduce the surface for external threats!
- therealmarv 9y agoare people doing this? What's the attack surface of a private hosted JS library vs. a well known TLS/SSL secured CDN for JS libraries? Threats are not restricted to CDNs.
- raverbashing 9y agoCDNs are much more reliable than your avg. 'stuff.com' hosted js. It shouldn't be an issue
- martinknafve 9y agoThat would depend on what CDN you use and how it works. If the CDN is just a caching CDN in front of your own site then the CDN typically won't be any more secure than your own site.
- deleted 9y ago[deleted]
- SchizoDuckie 9y agoThis is a falsehood i've seen repeated over and over. CDN's fail. You already have a connection to the 'stuff.com' self-hosted js. If your site is up but the cdn breaks you have another problem. Also the perf win for using a shared cdn version of for instance jquery is totally overstated. See discussions here too: https://news.ycombinator.com/item?id=11549131 https://news.ycombinator.com/item?id=11549131
- raverbashing 9y agoThanks, I stand corrected
- stupidcar 9y agoSecurity theater, nerd-style.
- lucideer 9y agoIn case it's of any help to you, I use https://github.com/Synzvato/decentraleyes https://github.com/Synzvato/decentraleyes which had 2 of these 3 CDNs cached. And the 3rd (unpkg - an npmjs.com mirror) seemed not to be a hard requirement as far as I could tell.
- ibotty 9y agoYou have subresource integrity. If in use, that only leaves the privacy implications of using a CDN.