4 ms·
If you need to let load external JS, you have failed as a webdeveloper. Just from a performance aspect: An additional DNS resolve, additional TCP handshake, ad
by gsich 8y ago
If you need to let load external JS, you have failed as a webdeveloper.
Just from a performance aspect:
An additional DNS resolve, additional TCP handshake, additional TLS, just to deliver a .js file that you could have easily served from the original website.
Not to mention the security aspect.
- tmikaeld 8y agoHow else would you suggest loading social media?
- megous 8y ago<a href="https://www.facebook.com/sharer/sharer.php?u=whateverurl">Like https://www.facebook.com/sharer/sharer.php?u=whateverurl">Li... on FB</a>
- markarichards 8y agoTools like http://panzi.github.io/SocialSharePrivacy/ http://panzi.github.io/SocialSharePrivacy/
- gsich 8y agoYou don't.
- GrumpyNl 8y agoHuh, isnt this where node and react are based on.
- foepys 8y agoPeople will argue that ajax.googleapis.com will be loaded anyways and that its jquery JS file will be cached but I'd argue that there are so many different JavaScript frameworks with so many different minor versions, that the caching aspect isn't that good. There are also at least a dozen different popular CDNs for this and everybody is using a different one. The only thing it got going for it, is the bandwidth savings for the original website.
- refoundglory 8y agoif you always prioritize performance over every other requirement, you've probably been wrong a lot.
- gsich 8y agoThe downvotes again confirm that this is indeed a correct assumption.
- markarichards 8y agoThe performance risks may not be so bad, if you're using a common CDN/library as it may be cached and save on download speeds: just hope most of your users don't have secure browsers, wiping caches regularly. But there is still a problem with loading third party JS, even beyond the SaaS type that you expect to change regularly (where SRI+CORS becomes difficult-impossible to control), just loading Bootstrap has risks. Although a good web developer hopefully knows how to add SRI, uses a validated third party library, will pick a fixed version and use a CDN with qualities as good as their hosting solution... they are rare to find and I doubt any data protection controller/officer responsible for GDPR should allow this risk. The developer might: forget to add SRI; pick a CDN that allows tracking (read https://www.maxcdn.com/dpa/); https://www.maxcdn.com/dpa/); pick a CDN registered or running servers outside of the EU. So, the data protection office therefore has to check the terms of services of the CDNs, audit them regularly and then ensure there is appropriate staff training and QA to put in SRI and validate it it as needed. Meanwhile, if the developer or data protection officer changes, there has to be enough documentation and process around to transition these practices to the next staff.. it all adds up. Man power is often more expensive than CPU, so chucking the JavaScript in static hosting the company has control of is likely less for the DPO to worry about.