4 ms·

Reminder: vendor your imported scripts if you’re doing this. I shouldn’t have to trust or give data to a CDN to use your website. There isn’t a meaningful perfo

Reminder: vendor your imported scripts if you’re doing this. I shouldn’t have to trust or give data to a CDN to use your website. There isn’t a meaningful performance win either since browsers now cache per domain for privacy reasons. https://httptoolkit.com/blog/public-cdn-risks/ https://httptoolkit.com/blog/public-cdn-risks/

LoganDark 3y ago
> vendor your imported scripts i̶f̶ ̶y̶o̶u̶’̶r̶e̶ ̶d̶o̶i̶n̶g̶ ̶t̶h̶i̶s̶ FTFY I vendor everything my webpages need, better to ensure that the webpage always works as long as my server is up. Also means I can download the page and use it offline.
ddalex 3y ago
What does it mean to vendor the script?
- bheadmaster 3y ago
  I assume it means the same thing as to vendor anything else: to bundle dependencies as a part of your application instead of giving users "links" to the dependencies served by a third party.
- lelandfe 3y ago
  They just mean "load your JS from your own site, not some other person's site"
- hnbad 3y ago
  To elaborate on the more pragmatic answers: vendoring generally refers to adding the source code of a dependency to your source control repository rather than having an install step (or expecting libraries to be provided by system level package managers) as part of your development process. In JavaScript these days, dependencies are usually loaded from npm so avoiding the bundling step for client-side code would naively mean replacing those dependencies with links to a third-party service like unpkg, which serves code published to npm for the browser. As others have explained, vendoring in this case would mean shipping those dependencies as part of your application code so they are served from your own domain. Of course at the moment a lot of dependencies will likely simply not work if imported directly from the browser.
  - benatkin 3y ago
    To clarify, it isn't vendoring to have an external script in your build output. Just because it's technical jargon doesn't mean there can't be a clear meaning of it.
- Karellen 3y ago
  https://stackoverflow.com/questions/26217488/what-is-vendoring https://stackoverflow.com/questions/26217488/what-is-vendori...
lelandfe 3y ago
> There isn’t a meaningful performance win And is usually a significant performance loss, since starting a new connection to the CDN domain is quite expensive during first page load.
qbasic_forever 3y ago
You can specify a hash for your CDN hosted dependencies so they aren't changed unexpectedly: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... There's zero reason not to trust a CDN if you're using integrity checks. It's just a host on the internet sending you bits.
- cormacrelf 3y ago
  It almost but not quite goes without saying, but if the import is (for example) the YouTube embed client script, you should not put an integrity check on it. Because you expect YouTube to put out a new client script from time to time. If there’s an integrity check based on an old version of the script, it will just break your page.
- easrng 3y ago
  I don't think you can use SRI with imports?
- croes 3y ago
  Seems like that's not possible for import maps https://news.ycombinator.com/item?id=35801366 https://news.ycombinator.com/item?id=35801366
- toastal 3y ago
  You're passing IP addresses and who knows what else to these CDN providers by using them. Add-ons like Decentraleyes were created because this leaks info, SRI or not.

LoganDark 3y ago

> vendor your imported scripts i̶f̶ ̶y̶o̶u̶’̶r̶e̶ ̶d̶o̶i̶n̶g̶ ̶t̶h̶i̶s̶ FTFY I vendor everything my webpages need, better to ensure that the webpage always works as long as my server is up. Also means I can download the page and use it offline.

ddalex 3y ago

What does it mean to vendor the script?

bheadmaster 3y ago
I assume it means the same thing as to vendor anything else: to bundle dependencies as a part of your application instead of giving users "links" to the dependencies served by a third party.
lelandfe 3y ago
They just mean "load your JS from your own site, not some other person's site"
hnbad 3y ago
To elaborate on the more pragmatic answers: vendoring generally refers to adding the source code of a dependency to your source control repository rather than having an install step (or expecting libraries to be provided by system level package managers) as part of your development process. In JavaScript these days, dependencies are usually loaded from npm so avoiding the bundling step for client-side code would naively mean replacing those dependencies with links to a third-party service like unpkg, which serves code published to npm for the browser. As others have explained, vendoring in this case would mean shipping those dependencies as part of your application code so they are served from your own domain. Of course at the moment a lot of dependencies will likely simply not work if imported directly from the browser.
- benatkin 3y ago
  To clarify, it isn't vendoring to have an external script in your build output. Just because it's technical jargon doesn't mean there can't be a clear meaning of it.
Karellen 3y ago
https://stackoverflow.com/questions/26217488/what-is-vendoring https://stackoverflow.com/questions/26217488/what-is-vendori...

lelandfe 3y ago

> There isn’t a meaningful performance win And is usually a significant performance loss, since starting a new connection to the CDN domain is quite expensive during first page load.

qbasic_forever 3y ago

You can specify a hash for your CDN hosted dependencies so they aren't changed unexpectedly: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... There's zero reason not to trust a CDN if you're using integrity checks. It's just a host on the internet sending you bits.

cormacrelf 3y ago
It almost but not quite goes without saying, but if the import is (for example) the YouTube embed client script, you should not put an integrity check on it. Because you expect YouTube to put out a new client script from time to time. If there’s an integrity check based on an old version of the script, it will just break your page.
easrng 3y ago
I don't think you can use SRI with imports?
croes 3y ago
Seems like that's not possible for import maps https://news.ycombinator.com/item?id=35801366 https://news.ycombinator.com/item?id=35801366
toastal 3y ago
You're passing IP addresses and who knows what else to these CDN providers by using them. Add-ons like Decentraleyes were created because this leaks info, SRI or not.