It's common to use a different (not sub) domain for static assets, especially when you use gigantic cookies in your web app. If the static assets aren't under a

It's common to use a different (not sub) domain for static assets, especially when you use gigantic cookies in your web app. If the static assets aren't under access control, you usually don't need session information, etc to serve them properly. This saves time and bandwidth. It's also common to spread assets across multiple hostsnames (typically subdomains that resolve to the same server) to parallelize loading by browsers. So I try to give sites some leeway, but I agree about scribd. If I can't make the site work by allowing the primary domain and a CDN domain, I generally bail. I never ever allow unknown domains like those above, especially on a site where I'm coming to view user-submitted content. I trust the JavaScript sandbox well enough, but if I get to the point of having to wonder about the provenance of code delivered by a site I'm visiting, I'm usually too disgusted to bother continuing.