13 ms·
Public CDNs Are Useless and Dangerous
- Hizonner 4y ago"Host your dependencies yourself"? How about "don't put so much goddamned bloat in your Web pages"?
- patates 4y agoAre you suggesting that all dependencies are bloat or am I misinterpreting your comment?
- elashri 4y agoI agree, most website can get rid of many JS files and will not make it less functional.
- usrn 4y agoThe marketing team won't have their shiny graphs though.
- pmoriarty 4y ago...and think of all the tracking and fingerprinting they'd have to sacrifice.
- nerdponx 4y agoIn a lot of cases, removing the JS would make the site more functional. Imagine how much nicer online shopping would be if you had mostly-static HTML pages.
- Veen 4y agoFunctional for whom? Most websites exist to make money for the people who make them, including news sites. All that crap serves the publisher's functional goals.
- elashri 4y agoI meant functional from technical side. But I get your point, It is just a wish more than a realistic view
- wccrawford 4y agoLike many other foot-guns, this is still great for novices to get started and learn the ropes without dealing with a lot of production-level problems. In an ideal world, everyone would learn best practices from the start and never create a bug in their code. But that isn't how humans work, and there needs to be some grease easing the process at the start. So they still serve a function, even if it's not the one that the CDNs imagined at the start.
- deepstack 4y agoif someone can't figure how to put a file on the server, or install package then they shouldn't be in tech or software development.
- krastanov 4y agoNo need to gatekeep. We can show a bit more empathy to the teens (or older folks) that are trying this for the first time in their life. Compartmentalization of concerns is an important part of pedagogy.
- aftergibson 4y agoHow would anyone learn? I agree when it comes to anything with stakes or deployments to production, but everyone starts somewhere and copy pasting a url from a CDN is one less headache when you’re playing with something totally new.
- deepstack 4y agoAnd that is how we ended with the mess in this article. We are not doing kinder garden here, it is software development. And if one can't grasp idea of files on server (a very basic) then why are you even doing software development? The whole software development process has being watered down to included people who don't really want to do software development. I'm sure if one is passionate about it, they will figure this out.
- blowski 4y agoTo my absolute shame, about 15 years ago, I made this comment about a junior dev on my team. That junior dev is now a much better developer than me. We’re all on a journey in our careers. Those of us with more knowledge and experience can and should help those with less, instead of gatekeeping and lecturing.
- cbg0 4y agoOverly sensationalized title, like the author points out as well in the article. Your site will be fast and your users will be safe as long as you use SRI with any content you're adding from a public CDN.
- zinekeller 4y agoHuh? The advice is clearly written as: if it's beneficial compile your JS and if not host the libraries yourself (especially if you're using a CDN for your own website anyways).
- chrisweekly 4y agoSRI?
- cbg0 4y agohttps://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... If you copy the tags from cdnjs.com this attribute will be added automatically.
- PaulHoule 4y agoI have never been sure that public CDNs were a win, even back in the day. The issue is this: many sites would download files from 10+ different domains and a single ‘long-tail’ DNS query, increasingly likely if you have more domains, will cause more delay than you could possibly save by using multiple servers.
- Gigachad 4y agoThere was common knowledge that cdns were great because they would have predownloaded copies on the users cache from other sites. But one group tested it and found that it’s so infrequent that the user has the exact version of jquery from the same cdn that you may as well ignore the chance.
- kevingadd 4y agoFor more than a few years it's been guaranteed that it won't be cached, because caches are now partitioned per-website. The CDN offers no caching advantage at all
- robin_reala 4y agoAnd by “more than a few years” you mean “nine years”, in the case of Safari (which is usually somewhere between a third and a half of web traffic depending on your userbase).
- littlecranky67 4y agoAn often overlooked issue is TCP congestion window scaling; For HTTP/1.1 it can be beneficial to serve all resources from a single host as you will likely have "hot" (=larger scaled congestion window) tcp connections to that host. In contrast, if you serve resources from 3-4 different hosts, the TCP congestion windows needs to scale up for each inididual host, which takes a couple of round trips before maximum throughput is achieved. However, there is no silver bullet here, whether or not this is faster or slower depends on a myriad of connection/link parameters.
- weird-eye-issue 4y agoDon't forget DNS lookups which is probably a bigger factor
- littlecranky67 4y agoThis is actually a pro-CDN argument, as most CDNs use anycast IPs and long-lived DNS entries, so it is more likely that a user will have that DNS entry cached plus the tcp path might be considered already "hot". But again, the myriad of different parameters do not allow for generalized "its always better to do X" statements.
- weird-eye-issue 4y agoUhh, if you load foo.com then when your browser goes to load foo.com/static.js there is a 100% chance it doesn't need to make another DNS lookup.
- littlecranky67 4y agoYou are absolutely right. But if you i.e. load foo.com/ which is just 10kb of HTML, you have a very good chance that your TCP congestion window is not yet scaled to match your actual path bandwidth, so transferring foo.com/static.js might take longer than from a CDN or a "hot" tcp connection. On the other hand, if you load too many ressources from either foo.com or mycdn.com, you might hit the TCP multiplexing limits (6 TCP connections in browsers) and stall loading. Equally distributing resources across foo.com and mycdn.com will give you 2x6 TCP connections, so a stall is less likely. It really depends on a ton of factors, your network link, the amount of resources and their size, OS parameters etc. So there is no general rule of thumb here.
- Neil44 4y agoMost websites and web apps spend so much time on server side CPU per page load that offloading a few static requests makes next to no difference. The CDN thing is way down the list of changes you can make to improve performance in most cases.
- weird-eye-issue 4y agoNot true especially for CSS and JS required for the page to even render
- Neil44 4y agoServing a static css or js is fractions of a ms in cpu time though, generating a dynamic page is 10’s-100’s of ms
- weird-eye-issue 4y agoWhy are you so concerned with CPU time and not the end user's experience?
- Neil44 4y agoWe are talking about the end user experience in terms of time taken to display the page, of which the largest part for a dynamic page is usually cpu time on the server not minute optimisations of static objects. It's not the lowest hanging fruit.
- weird-eye-issue 4y agoThis just isn't true at all. The amount of time it takes to download, parse, and execute modern JavaScript payloads is usually longer than a page's TTFB. Then there is also the parsing of HTML and CSS and actually painting the page. For "most websites" if cached appropriately then server CPU time is minimal in most cases
- jshawl 4y ago>Meanwhile, if your caching reverse-proxy goes down, you have the option to immediately put a different caching service in front of your site, or temporarily serve static content from your servers directly, and get things working again with no code changes or backend deployments required I think I'd prefer deploying a new CDN link to updating DNS. "No code changes or backend deployments" makes the assumption that DNS is a manual change (not terraform, etc.)
- MattIPv4 4y agoTwo of the things that this article calls out are security & privacy. It's worth keeping in mind that you can and should be using SRI when loading remote resources like this, which will go a long way to protect you. And, you can set attributes like referrerpolicy to ensure that privacy is maintained as much as possible. (cdnjs, that I maintain and is referenced in the article, does both of these by default if you copy a script/link tag from our site.)
- lelandfe 4y agoFor the curious, SRI = SubResource Integrity. It’s a hash of the file, and browsers will not use the file if there’s a mismatch: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... (ps, I dislike the name; you don’t encounter the term “subresource” anywhere else in webdev. It’s a “subresource” of the HTML document resource, eyeroll)
- nerdponx 4y agoIf we're baking file hashes into the HTML... is there any work out there that goes the extra mile and uses IPFS as your CDN?
- viraptor 4y agoDepends what you mean by that precisely. But you can load things from cloudflare's ipfs gateway without doing anything special otherwise. Directly from ipfs - not without extensions.
- nybble41 4y agoYou could include js-ipfs[0] and fetch all your resources from IPFS without going through a gateway. However, this approach would make the site fully dependent on JavaScript. A PWA with a Service Worker could perhaps implement its own client-side "gateway", translating public gateway URLs into direct IPFS access. Without the Service Worker (or without JS) it would fall back to using the gateway. [0] https://js.ipfs.io/ https://js.ipfs.io/
- night-rider 4y agoIt always annoys me when a site hangs when it tries to load something from fonts.googleapis.com. Developers need to use a system font stack which loads fonts from the system itself instead of remote web fonts. On a fast connection you don’t notice it, but you will notice it on a slow connection, and the majority are on slow connections. Developers need to deliberately use slow connections and see just how responsive their site is. Don’t develop on a hyper fast connection because you assume the site loads super quick and overlook latency issues. I think you can emulate slow connections in browser devtools so there is that.
- littlecranky67 4y ago[deleted]
- eatonphil 4y agoWhat are the issues? I freaked out for a second because I'm pretty sure I host materialicons font files and css files. I checked the docs though and it seems like self-hosting is within the license. Maybe material icons are different or maybe I'm misreading this page. https://developers.google.com/fonts/docs/material_icons https://developers.google.com/fonts/docs/material_icons
- zinekeller 4y agoThat's plain wrong. Sure, if you used Monotype's there will be issues (because they're so litigious), but Google Fonts only hosts open-source fonts so there's no reason to just search the correct font and host that instead (unless you somehow manually tweaked the URL to get Product Sans: that's illegal even if you loaded it from Google's CDNs).
- usrn 4y agoIt's custom fonts that don't share metrics with built in fonts. If they don't do that the page content jumps around when the fonts load. Custom fonts were a terrible idea, I wish browsers would just drop support for them. EDIT: Unless there's a way to include metrics outside the font there really isn't a way to prevent reflows when it loads other than blanking the entire page until then.
- JohnHaugeland 4y agoIt's wild watching people say things like "back in the day, XYZ was a best practice." Best Practice does not mean "advice that I believe in." Best practices are legally binding documents issued by insurers.
- mikechalmers 4y agoIt depends on the context, often it simply means "the accepted method" within an organisation or a community.
- deleted 4y ago[deleted]
- SketchySeaBeast 4y agoI wasn't aware that SOLID was created by an insurer. That explains the naming of the "L".
- billpg 4y ago"...cached content is no longer shared between domains. This is known as cache partitioning..." But why?
- red_trumpet 4y agoIirc, privacy considerations. A website could detect a cache hit/miss by measuring the time until the resource becomes available.
- Gigachad 4y agoIt was some privacy issue where you could determine visited sites by timing the download iirc.
- mikeholler 4y agohttps://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/
- Avamander 4y agoYou could infer browsing habits from that using timing data.
- _nhynes 4y agoThe comment on IPFS is a bit idealistic. > There is no single service that can go down [...] > Each piece of content is loaded entirely independently, [...] Both of these statements can be true, but in fact, what ends up happening is someone puts their site on a pinning service like Piñata or Infura, and then it's right back to being centralized and trackable. Filecoin helps decentralize who pins, but even then, one ends up using a pretty interface like web3.storage since using the real service is just too much overhead for just pushing a page. I'm personally a big fan of IPFS, but I'd use it to make an entire site reliable for users who care to self-pin.
- oehpr 4y ago>and then it's right back to being centralized and trackable. I haven't been following IPFS very closely recently, but this doesn't track for me at all. So people pin some content on a big node. Once you download it, now it's on YOUR node, and your friend can still get it off you. Your node is just as authoritative as the big one. They disappear and IPFS can carry on. I remember people criticizing NFT's using IPFS links as "not solving anything" and I was truly truly baffled at why anyone would think that. You could easily hold on to your image on a thumb drive, or absolutely any method of backing content up. If every single copy on the internet got nuked, you could just publish from your usb drive again and suddenly it's back up, available for all to see. More to the point, anyone could do that. So anyone (including you) with even a slight motivation to preserve that data could authoritatively do so. disclaimer: I do not like NFT's. I don't like them practically, I don't like them abstractly, and I don't like them culturally. It's just this is one criticism thrown at NFTs I don't agree with, IPFS makes this aspect work.
- i5heu 4y agoWell I like CloudFlare Pages a lot. Very much performance for the time invested.
- jerf 4y agoThis also strikes me as another "You're Not Google" example. With modern computers, where even the smallest instance currently available on AWS would have been a beefy system when this advice was first diffused into the community, CDNs are probably solving a problem you don't have in 2022. If you have 10MB of static files to serve, and they're decently cached, you're looking at the ability to serve on the order of 50-100 new users per second with very realistic setups nowadays that would still be generally considered "entry level" in the modern environment, while in the meantime consuming almost no resources on the server because serving static files is really easy. And that's just straight off the "main server". If you've run the numbers, and that's a problem, hey, great, more power to you! There's web sites where that's a problem. But, you know, remember that 100 new users per sec is a scale of nearly 10,000,000 per day. Is that really your scale? There's an awful lot of sites, even busy, productive, and profitable sites, that are looking more at the "1 new user loading a fresh copy of these things per second", if not one per minute. I remember working with "servers" in the low hundreds of megahertz, on software stacks a lot less optimized than today. Shifting around your static serving could do something then. Today? Choking even a single CPU server's capability to serve static content takes some doing. By the time that's your core problem, you'll know. (There's still a lot of "best practices" banging around the community from the "low hundreds of megahertz" period of time. At the risk of goring some sacred oxes, I also consider the obsession with total statelessness to date from this era. While one must still be careful with it, judicious application of state in the modern era can be very helpful. It's less panic-inducingly terrifying when I can afford the equivalent of entire servers dedicated to each individual user, where "server" is defined as "a server class machine from the time this advice first percolated out". The software engineering considerations around state are relevant and must be considered, but the solution of "zero! none! never! not any!" is no longer the only viable or best choice.)
- sleepydog 4y agoWhile I agree we should not assume a cdn is necessary, as far as user traffic is concerned, not all seconds are created equal. Those pesky users have a habit of making requests at the same time, like they're in cahoots with one another. Whether it's because they're all in the same time zone and they just got home from work, or the clock struck midnight and your fire sale has begun, you don't provision for average qps, you provision for peak qps. This does not negate your argument, in fact for many use cases doing your own caching could be a better way to meet increased demand (certainly a cheaper way). CDN-related issues can be incredibly difficult to troubleshoot, too, especially without a support contract.
- outloudvi 4y ago1. Anything beyond control may cause problems. For the security part: add SRI to whatever you care about, please. 2. Could we, in 2022, get rid of the troublesome Referer?
- skrebbel 4y agoPublic CDNs are super handy when you're quickly whipping something up. I feel like the DX is under-appreciated in discussions about this. Eg skypack is just awesome, it lets you import any npm package onto a website as if it was a proper es6 module. Google fonts is amazing in similar ways. Dangerous, fine, but I empathically disagree with calling that "useless".
- easrng 4y agoSee also: https://esm.sh https://esm.sh - lots of options https://jspm.dev https://jspm.dev - does import maps (with a polyfill) https://generator.jspm.io/ https://generator.jspm.io/ https://esm.run https://esm.run - jsdelivr hosted esm builds but only ones already uploaded to npm
- ctur 4y agoThis article has a lot of good points and suggestions for site creators, but for consumers, there is something you can use: the Decentraleyes browser addon (https://decentraleyes.org/ https://decentraleyes.org/). It basically intercepts calls to well-known centralized CDNs and serves it locally from the browser without issuing any network calls whatsoever.
- vaylian 4y ago> When talking about caches, I'm primarily suggesting a paid caching reverse-proxy service, like Cloudflare, Fastly, Cloudfront, Akamai, etc I'm confused. Where is the difference between using these companies as CDN providers versus using them as cache providers? The only minor difference that I can see is that my server would provide the original copy for every cached item, but this does not mitigate the risk of cache poisoning and the privacy risks that you also encounter with CDNs.
- pimterry 4y agoThe difference is that they host content that's under your control - they're not a _public_ CDN. I.e. a CDN service that you don't control at all, which hosts a fixed set of libraries or resources, like Google Fonts or CDNjs.
- Dan_JiuJitsu 4y agoSure. Run my own DDOS protection? I'll pass.
- xigoi 4y agoI'm developing a markup language that compiles to HTML and (among other things) allows easily inserting LaTeX equations. Currently they're rendered using KaTeX, which requires custom fonts. Is there a way to make it work without a CDN? I don't want to sacrifice the convenience of being able to quickly write down some math and having it compiled into a single HTML file, so requiring the user to put the fonts somewhere and link them separately is unfortunately not an option.
- ARandomerDude 4y ago> Most importantly: cached content is no longer shared between domains. This is known as cache partitioning and has been the default in Chrome since October 2020... TIL.
- advisedwang 4y agoInterestingly the Google Hosted Libraries ToS[1] says: > Our systems are designed to remove HTTP referer information before logging, to avoid associating requests with any individual website using the Google Hosted Libraries. So they at least are claiming the CDN is not used to snoop on traffic paterns. [1] https://developers.google.com/speed/libraries/terms https://developers.google.com/speed/libraries/terms