6 ms·

Yes. But not for just the reasons given in the link. When your page uses resources hosted outside your control, you are effectively giving a third-party acces

Yes. But not for just the reasons given in the link. When your page uses resources hosted outside your control, you are effectively giving a third-party access to your users. This applies equally to fonts, images from image hosting services, videos from youtube, etc, and especially to Javascript code (including analytics). At best, you are trading some bandwidth savings for allowing a third-party to analyze your traffic patterns and users in return - maybe that sounds like a good trade to you. But at worst, your are allowing a third-party (or the people that buy that third-party years from now) to break your site (removing images, etc) at any time, completely outside your control. That is not even considering malicious intent. Google is probably OK right now, but who knows? TL/DR : Host everything yourself

dvfjsdhgfv 9y ago
I always wonder how easily "the whole industry" tacitly agreed it's a good thing because of caching. Nowadays nobody sits down and calculates the weights of benefits and disadvantages, most people are just using CDNs because practically everyone else is doing just that.
- AndrewStephens 9y ago
  There was probably a time when it did matter, but I believe (without much evidence) that the benefits of CDNs are less now. * Hosting on decently fast machines is a lot cheaper. * Overall bandwidth is increasing * HTTP2 makes serving up resources cheaper and faster even without other changes. Before a page might request 100 resources and the browser would download them 8 at a time due to having a maximum number of connections to a server. * Browsers are getting smarter about loading resources in general * There used to be only a few big Javascript libraries that everyone tended to use (jQuery, etc). So your browser would download them once from the CDN and cache it for multiple sites. These days there are a lot more. Same with fonts. With hundreds of fonts available the chances of your page's fonts being in the cache is small. The only resources that I think might still be worth offloading to a specialized third-party would be video files, which are still too large to be easily hosted.
  - epicide 9y ago
    This doesn't take the user's connection into account. The user could have a really slow connection (think 3G mobile or worse). Any amount of caching helps tremendously here. Also, caching and fat pipes are just two benefits of CDNs. They also handle the multi-region issue.
    - AndrewStephens 9y ago
      > Also, caching and fat pipes are just two benefits of CDNs. They also handle the multi-region issue. If you are actually paying a CDN to host your stuff you can expect better service. Here we are talking about using resources from third-parties for "free".
      - epicide 9y ago
        I don't see how that goes against what I said. Those three main benefits apply to anything hosted on CDNs.
        AndrewStephens 9y ago
        Don't get me wrong, CDNs are very useful for hosting high-traffic sites. And if you are paying them money to host all your resources then you are effectively in control as far as the issue we are talking about in this thread. My argument is that, for smaller sites, the received wisdom used to be that letting google (or whoever) host myspecalfont.wcf, or bigjavascriptlibrary.js, or whatever in their CDN was a good idea since it made your site load faster. This was certainly true, up to a point, but is less important now, due to the factors I listed. Whether or not these factors make a difference to you is completely dependent on the details of your site.
  - dx034 9y ago
    Latency is still a factor. For any reasonably popular page with cloudflare in front of it, static files will be at the local edge. Requesting websites hosted in US-West from Europe is ~200ms latency, responses from the cloudflare edge here (London) usually have 20-30ms (TTFB). That can be a big difference, esp if you have spotty reception. If your users are all over the world this becomes even more important.
akanet 9y ago
The other big technical reason to self host Google fonts is wanting your website to load in China. The Google CDN is blocked there, in case anyone here is unaware.
- rahimnathwani 9y ago
  I live in China, and the CDN for Google Fonts (https://fonts.googleapis.com https://fonts.googleapis.com) works just fine from both my mobile and home internet connections. The site for searching for fonts (fonts.google.com) doesn't appear to work, but that's not relevant to the self-hosting discussion. If you also live in China, please try to load https://fonts.googleapis.com/css?family=Rozha+One https://fonts.googleapis.com/css?family=Rozha+One (ideally without VPN, and using your ISP's DNS server).
  - bjshepard 9y ago
    Works for me too.
  - akanet 9y ago
    YMMV of course, but when we used the fonts CDN a very large proportion of Chinese users could not access our website intermittently.
    - rahimnathwani 9y ago
      Past tense. Was that more than 2.5 years ago?
webjunkie 9y ago
1. Tracking is not really effective if the user agent caches the font aggressively. 2. Subresource integrity takes care that at least the file cannot be modified freely without you knowing. So there is only the case that the file either is there as you expect, or it is not available. Does that leave room for malicious intent? https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- hdhzy 9y ago
  Subresource integrity is a double edged sword because when a third party updates a resource then your page breaks. Of course you can build fallbacks by loading from your domain in case of errors but then you just doubled engineering effort and have rarely executed code paths in your source.
  - webjunkie 9y ago
    True. I'm not saying this solves the problem, but at least the "outside of your control" part is not absolute.
- AndrewStephens 9y ago
  Subresource integrity is OK, but in this case would have totally broken the site in a different way. If you want to make sure a resource can't change, host it yourself and don't change it.
jpdb 9y ago
Do you have any suggestions for self-hosted analytics?
- AndrewStephens 9y ago
  Not really. I sometimes use goaccess[1] to analyze log files but I haven't found a good replacement for Google analytics. [1] https://goaccess.io https://goaccess.io
- the_common_man 9y ago
  Piwik
- wongarsu 9y ago
  Piwik[1] is pretty good. For self-hosting, basic features are free and open source, some of the more advanced features are sold as plugins[2]. There's also OWA[3] if that's more to your taste 1 https://piwik.org/ https://piwik.org/ 2 https://plugins.piwik.org/premium https://plugins.piwik.org/premium 3 http://www.openwebanalytics.com/ http://www.openwebanalytics.com/
- etatoby 9y ago
  Piwik is a drop-in replacement for Google Analytics. But the problem with all of them is that they rely on Javascript beacons to track visits. With more and more people using ad- and privacy-blockers, more and more visitors just disappear from your stats. I still keep Awstats on some sites for this reason, and the difference between the Awstats numbers and the Google Analytics or Piwik ones is growing and picking up speed.
shp0ngle 9y ago
People are already giving access to third parties for all the sweet sweet ad income. People don't care.
davidcollantes 9y ago
I used to think that same way. I wanted to host everything myself, so I could control, and make sure everything ran the way I wanted. It took me a while -- not sure how long -- to realise no man is an island.
esistgut 9y ago
Do you know if self-hosting has any kind of impact on SEO?
juiyout 9y ago
My experience with Google Fonts has been that they are the slowest resource to load. So yes, host everything yourself.
featherverse 9y ago
> Google is probably OK Practically all relevant news headlines for the past 2 years suggests otherwise.

dvfjsdhgfv 9y ago

I always wonder how easily "the whole industry" tacitly agreed it's a good thing because of caching. Nowadays nobody sits down and calculates the weights of benefits and disadvantages, most people are just using CDNs because practically everyone else is doing just that.

AndrewStephens 9y ago
There was probably a time when it did matter, but I believe (without much evidence) that the benefits of CDNs are less now. * Hosting on decently fast machines is a lot cheaper. * Overall bandwidth is increasing * HTTP2 makes serving up resources cheaper and faster even without other changes. Before a page might request 100 resources and the browser would download them 8 at a time due to having a maximum number of connections to a server. * Browsers are getting smarter about loading resources in general * There used to be only a few big Javascript libraries that everyone tended to use (jQuery, etc). So your browser would download them once from the CDN and cache it for multiple sites. These days there are a lot more. Same with fonts. With hundreds of fonts available the chances of your page's fonts being in the cache is small. The only resources that I think might still be worth offloading to a specialized third-party would be video files, which are still too large to be easily hosted.
- epicide 9y ago
  This doesn't take the user's connection into account. The user could have a really slow connection (think 3G mobile or worse). Any amount of caching helps tremendously here. Also, caching and fat pipes are just two benefits of CDNs. They also handle the multi-region issue.
  - AndrewStephens 9y ago
    > Also, caching and fat pipes are just two benefits of CDNs. They also handle the multi-region issue. If you are actually paying a CDN to host your stuff you can expect better service. Here we are talking about using resources from third-parties for "free".
    - epicide 9y ago
      I don't see how that goes against what I said. Those three main benefits apply to anything hosted on CDNs.
      - AndrewStephens 9y ago
        Don't get me wrong, CDNs are very useful for hosting high-traffic sites. And if you are paying them money to host all your resources then you are effectively in control as far as the issue we are talking about in this thread. My argument is that, for smaller sites, the received wisdom used to be that letting google (or whoever) host myspecalfont.wcf, or bigjavascriptlibrary.js, or whatever in their CDN was a good idea since it made your site load faster. This was certainly true, up to a point, but is less important now, due to the factors I listed. Whether or not these factors make a difference to you is completely dependent on the details of your site.
- dx034 9y ago
  Latency is still a factor. For any reasonably popular page with cloudflare in front of it, static files will be at the local edge. Requesting websites hosted in US-West from Europe is ~200ms latency, responses from the cloudflare edge here (London) usually have 20-30ms (TTFB). That can be a big difference, esp if you have spotty reception. If your users are all over the world this becomes even more important.

akanet 9y ago

The other big technical reason to self host Google fonts is wanting your website to load in China. The Google CDN is blocked there, in case anyone here is unaware.

rahimnathwani 9y ago
I live in China, and the CDN for Google Fonts (https://fonts.googleapis.com https://fonts.googleapis.com) works just fine from both my mobile and home internet connections. The site for searching for fonts (fonts.google.com) doesn't appear to work, but that's not relevant to the self-hosting discussion. If you also live in China, please try to load https://fonts.googleapis.com/css?family=Rozha+One https://fonts.googleapis.com/css?family=Rozha+One (ideally without VPN, and using your ISP's DNS server).
- bjshepard 9y ago
  Works for me too.
- akanet 9y ago
  YMMV of course, but when we used the fonts CDN a very large proportion of Chinese users could not access our website intermittently.
  - rahimnathwani 9y ago
    Past tense. Was that more than 2.5 years ago?

webjunkie 9y ago

1. Tracking is not really effective if the user agent caches the font aggressively. 2. Subresource integrity takes care that at least the file cannot be modified freely without you knowing. So there is only the case that the file either is there as you expect, or it is not available. Does that leave room for malicious intent? https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

hdhzy 9y ago
Subresource integrity is a double edged sword because when a third party updates a resource then your page breaks. Of course you can build fallbacks by loading from your domain in case of errors but then you just doubled engineering effort and have rarely executed code paths in your source.
- webjunkie 9y ago
  True. I'm not saying this solves the problem, but at least the "outside of your control" part is not absolute.
AndrewStephens 9y ago
Subresource integrity is OK, but in this case would have totally broken the site in a different way. If you want to make sure a resource can't change, host it yourself and don't change it.

jpdb 9y ago

Do you have any suggestions for self-hosted analytics?

AndrewStephens 9y ago
Not really. I sometimes use goaccess[1] to analyze log files but I haven't found a good replacement for Google analytics. [1] https://goaccess.io https://goaccess.io
the_common_man 9y ago
Piwik
wongarsu 9y ago
Piwik[1] is pretty good. For self-hosting, basic features are free and open source, some of the more advanced features are sold as plugins[2]. There's also OWA[3] if that's more to your taste 1 https://piwik.org/ https://piwik.org/ 2 https://plugins.piwik.org/premium https://plugins.piwik.org/premium 3 http://www.openwebanalytics.com/ http://www.openwebanalytics.com/
etatoby 9y ago
Piwik is a drop-in replacement for Google Analytics. But the problem with all of them is that they rely on Javascript beacons to track visits. With more and more people using ad- and privacy-blockers, more and more visitors just disappear from your stats. I still keep Awstats on some sites for this reason, and the difference between the Awstats numbers and the Google Analytics or Piwik ones is growing and picking up speed.

shp0ngle 9y ago

People are already giving access to third parties for all the sweet sweet ad income. People don't care.

davidcollantes 9y ago

I used to think that same way. I wanted to host everything myself, so I could control, and make sure everything ran the way I wanted. It took me a while -- not sure how long -- to realise no man is an island.

esistgut 9y ago

Do you know if self-hosting has any kind of impact on SEO?

juiyout 9y ago

My experience with Google Fonts has been that they are the slowest resource to load. So yes, host everything yourself.

featherverse 9y ago

> Google is probably OK Practically all relevant news headlines for the past 2 years suggests otherwise.