3 ms·

It's for the best. Cache partitioning solves a browser history leak described in Timing Attacks on Web Privacy[0] The permutations of different CDNs and asset

It's for the best. Cache partitioning solves a browser history leak described in Timing Attacks on Web Privacy[0] The permutations of different CDNs and asset versions meant the cache hit rate was low anyway.[1][2] [0] https://www.cs.umd.edu/~jkatz/TEACHING/comp_sec_F04/downloads/web-timing.pdf https://www.cs.umd.edu/~jkatz/TEACHING/comp_sec_F04/download... (PDF) [1] https://zoompf.com/blog/2010/01/should-you-use-javascript-library-cdns/ https://zoompf.com/blog/2010/01/should-you-use-javascript-li... [2] https://web.archive.org/web/20111123170325/http://statichtml.com/2011/google-ajax-libraries-caching.html https://web.archive.org/web/20111123170325/http://statichtml...

dspillett 5y ago
> The permutations of different CDNs and asset versions meant the cache hit rate was low anyway. A CDN with DCs in a number of locations and appropriate DNS setup at least has the advantage of local delivery which can have more than zero significance if you have an international audience and you really need low latency. But if you are in that category then you probably won't (or shouldn't) be loading a bunch of stuff from a CDN or otherwise. And I wouldn't source script from a 3rd party anyway, I never saw the security tradeoff as worth it.
- ptx 5y ago
  > And I wouldn't source script from a 3rd party anyway, I never saw the security tradeoff as worth it. Doesn't subresource integrity [1], i.e. specifying the expected hash of the script, solve those security issues? Unless you need to support Internet Explorer, I suppose. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
  - dspillett 5y ago
    I want aware that had become so well supported. Something to remember for later. Though for personal projects I'll stick with self-hosting, and in DayJob we unfortunately still have to support IE11 to an extent (and beyond that some of our clients strictly whitelist everything and will reject a 3rd party they can't fully audit, ruling out CDNs for those at least, every with SRI).
eternityforest 5y ago
People should be able to select their own privacy/performance tradeoff.

dspillett 5y ago

> The permutations of different CDNs and asset versions meant the cache hit rate was low anyway. A CDN with DCs in a number of locations and appropriate DNS setup at least has the advantage of local delivery which can have more than zero significance if you have an international audience and you really need low latency. But if you are in that category then you probably won't (or shouldn't) be loading a bunch of stuff from a CDN or otherwise. And I wouldn't source script from a 3rd party anyway, I never saw the security tradeoff as worth it.

ptx 5y ago
> And I wouldn't source script from a 3rd party anyway, I never saw the security tradeoff as worth it. Doesn't subresource integrity [1], i.e. specifying the expected hash of the script, solve those security issues? Unless you need to support Internet Explorer, I suppose. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- dspillett 5y ago
  I want aware that had become so well supported. Something to remember for later. Though for personal projects I'll stick with self-hosting, and in DayJob we unfortunately still have to support IE11 to an extent (and beyond that some of our clients strictly whitelist everything and will reject a 3rd party they can't fully audit, ruling out CDNs for those at least, every with SRI).

eternityforest 5y ago

People should be able to select their own privacy/performance tradeoff.