6 ms·

...Which those CDN provide support as well: https://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js https://ajax.googleapis.com/ajax/libs/jquery/1/jquery.m

by rsoto 15y ago

...Which those CDN provide support as well: https://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js https://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js

ufo 15y ago
...but is it really worth it to give Google a "backdoor" into your https app just because you want to load jQuery faster?
- X-Istence 15y ago
  The user most likely already is giving Google a backdoor into your app ... if they are using Chrome.
  - drivebyacct2 15y ago
    What? That's absurd. You understand why that is hyperbolic, right?
    - X-Istence 15y ago
      Just as absurd as Google destroying any and all confidence any of us tech people would have in them as a company if they loaded malicious javascript instead of jquery or along with jquery from their CDN's. That is the point I was trying to make.
      - drivebyacct2 15y ago
        My apologies. I understand and think you make a very good point.
- icebraining 15y ago
  I find it very improbably that Google will decide to mess with it, but as a general feature it would be nice if one could indicate an hash of the file to be loaded (as a <script> attribute), and throw an error callback if the verification failed. That way you could use Google's jQuery file without being vulnerable to them messing with the file contents.
- mythz 15y ago
  I'd say there is 0.000% chance google would use it's CDN to compromise 3rd party sites. It would be discovered in a flash and in no way will it every justify the brand confidence hurt.
- yuhong 15y ago
  It is not just Google. Anyone that can get a fake certificate issued by a trusted CA for ajax.googleapis.com can MITM it and do the backdoor.
  - waitwhat 15y ago
    That's not as universally true as it used to be. Chrome has introduced certificate-pinning [1] which covers googleapis.com [2]. [1] http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html [2] http://src.chromium.org/viewvc/chrome/trunk/src/net/base/transport_security_state.cc?view=markup http://src.chromium.org/viewvc/chrome/trunk/src/net/base/tra...

by rsoto 15y ago

...Which those CDN provide support as well: https://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js https://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js

ufo 15y ago

...but is it really worth it to give Google a "backdoor" into your https app just because you want to load jQuery faster?

X-Istence 15y ago
The user most likely already is giving Google a backdoor into your app ... if they are using Chrome.
- drivebyacct2 15y ago
  What? That's absurd. You understand why that is hyperbolic, right?
  - X-Istence 15y ago
    Just as absurd as Google destroying any and all confidence any of us tech people would have in them as a company if they loaded malicious javascript instead of jquery or along with jquery from their CDN's. That is the point I was trying to make.
    - drivebyacct2 15y ago
      My apologies. I understand and think you make a very good point.
icebraining 15y ago
I find it very improbably that Google will decide to mess with it, but as a general feature it would be nice if one could indicate an hash of the file to be loaded (as a <script> attribute), and throw an error callback if the verification failed. That way you could use Google's jQuery file without being vulnerable to them messing with the file contents.
mythz 15y ago
I'd say there is 0.000% chance google would use it's CDN to compromise 3rd party sites. It would be discovered in a flash and in no way will it every justify the brand confidence hurt.
yuhong 15y ago
It is not just Google. Anyone that can get a fake certificate issued by a trusted CA for ajax.googleapis.com can MITM it and do the backdoor.
- waitwhat 15y ago
  That's not as universally true as it used to be. Chrome has introduced certificate-pinning [1] which covers googleapis.com [2]. [1] http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html [2] http://src.chromium.org/viewvc/chrome/trunk/src/net/base/transport_security_state.cc?view=markup http://src.chromium.org/viewvc/chrome/trunk/src/net/base/tra...