4 ms·

Wow, impressive. Let's hope the jQuery sources and CDNs never get compromised!

by nthitz 14y ago

grayj 14y ago
Yes, it does raise the "herd of cloned sheep" question. But I wouldn't worry too much. It's open source, and using the hosted version means that only that one copy has to be fixed. It is unlikely to ever be a problem on the scope of, e.g., out-of-date Wordpress installs.
- romaniv 14y ago
  Of one of those major CDNs get hacked (rather than fail on accident), the problem will be far worse than some outdated Wordpress blogs.
  - deleted 14y ago
    [deleted]
digitalclubb 14y ago
It's interesting and slightly scary the CDN issue. Several months ago when there was an issue with Google's CDN, an awful lot of websites fell over as they never had a local backup in place. Hopefully as jQuery usage grows people come to understand the need for fallbacks.
- zalew 14y ago
  especially when it's trivial to implement <script src="//ajax.googleapis.com/ajax/libs/jquery/1.8.0/jquery.min.js"></script> <script type="text/javascript"> if (typeof jQuery == 'undefined') { document.write(unescape("%3Cscript src='/path_to_scripts/js/libs/jquery-1.8.0.min.js' type='text/javascript'%3E%3C/script%3E"));} </script>
  - jfaucett 14y ago
    Is it really that big of a perf hit to just download the minified and use it in your source like all other libs? jq isn't that big of beast, plus if you have a large site its cached for every other page visit :)
    - zalew 14y ago
      > if you have a large site its cached for every other page visit until you modify your own js (not that rare and uncommon) and it's back new and shiny again. from the cdn, it's just already there sitting in the browser's cache. > Is it really that big of a perf hit maybe not, but if you had the option to wake up with your teeth already brushed, wouldn't you take it? :D
  - jQueryIsAwesome 14y ago
    You don't need to use unescape in the fallback if(!jQuery)document.write('<script src="jquery.js"></scrip'+'t>');
mrpollo 14y ago
yeah that wouldn't be fun, but maybe we could make a browser add-on to check for the md5 checksum, not a security expert here but sounds like a solution to me
- ars 14y ago
  MD5 is not acceptable for this purpose since it's possible to create source with the same MD5 as the original. It would need a different hash at a minimum.
  - taylorfausak 14y ago
    I'm not sure what you mean by this. mrpollo recommended using MD5 as a checksum before executing jQuery to ensure that the CDN hasn't been compromised. For instance jQuery 1.8.0's checksum is cd8b0bffc85bb5614385ee4ce3596d07. I was under the impression that MD5 isn't malleable enough to create a non-trivial malicious script with the same hash.
    - ars 14y ago
      As of right now there are no practical preimage attacks on MD5, but people keep expecting one. It's better to switch to something else and not have to worry about it.
    - dalke 14y ago
      Your impression is incorrect. Quoting one researcher, "Our intent is to raise awareness that MD5 is broken so drastically that its continued use in digital signature schemes and certificates poses realistic threats." See also http://en.wikipedia.org/wiki/MD5 http://en.wikipedia.org/wiki/MD5 . I am no expert. It may be that MD5 is still relatively secure for this specific task. However, SHA2 is more secure. Use that instead.
keltex 14y ago
I was thinking a cool Chrome extension might be to preload all the major javascript libraries (jquery, etc.) and change any external extension references to the preloaded ones. I'm not sure how much of a speedup this would offer but certainly it would be something.
- jemka 14y ago
  Not unless you are 1. visiting a lot of sites for the 1st time that use these libraries and/or 2. frequently clear your browser cache. Your browser caches the libraries on first load anyway.
hnruss 14y ago
They don't even have to get compromised to mess up the web. Too many sites point their jQuery src to the latest version, so just wait for jQuery 2.0 to come out and see how many IE 6/7/8 users complain. http://blog.jquery.com/2012/06/28/jquery-core-version-1-9-and-beyond/ http://blog.jquery.com/2012/06/28/jquery-core-version-1-9-an...

Wow, impressive. Let's hope the jQuery sources and CDNs never get compromised!

by nthitz 14y ago

Wow, impressive. Let's hope the jQuery sources and CDNs never get compromised!

grayj 14y ago

Yes, it does raise the "herd of cloned sheep" question. But I wouldn't worry too much. It's open source, and using the hosted version means that only that one copy has to be fixed. It is unlikely to ever be a problem on the scope of, e.g., out-of-date Wordpress installs.

romaniv 14y ago
Of one of those major CDNs get hacked (rather than fail on accident), the problem will be far worse than some outdated Wordpress blogs.
- deleted 14y ago
  [deleted]

digitalclubb 14y ago

It's interesting and slightly scary the CDN issue. Several months ago when there was an issue with Google's CDN, an awful lot of websites fell over as they never had a local backup in place. Hopefully as jQuery usage grows people come to understand the need for fallbacks.

zalew 14y ago
especially when it's trivial to implement <script src="//ajax.googleapis.com/ajax/libs/jquery/1.8.0/jquery.min.js"></script> <script type="text/javascript"> if (typeof jQuery == 'undefined') { document.write(unescape("%3Cscript src='/path_to_scripts/js/libs/jquery-1.8.0.min.js' type='text/javascript'%3E%3C/script%3E"));} </script>
- jfaucett 14y ago
  Is it really that big of a perf hit to just download the minified and use it in your source like all other libs? jq isn't that big of beast, plus if you have a large site its cached for every other page visit :)
  - zalew 14y ago
    > if you have a large site its cached for every other page visit until you modify your own js (not that rare and uncommon) and it's back new and shiny again. from the cdn, it's just already there sitting in the browser's cache. > Is it really that big of a perf hit maybe not, but if you had the option to wake up with your teeth already brushed, wouldn't you take it? :D
- jQueryIsAwesome 14y ago
  You don't need to use unescape in the fallback if(!jQuery)document.write('<script src="jquery.js"></scrip'+'t>');

mrpollo 14y ago

yeah that wouldn't be fun, but maybe we could make a browser add-on to check for the md5 checksum, not a security expert here but sounds like a solution to me

ars 14y ago
MD5 is not acceptable for this purpose since it's possible to create source with the same MD5 as the original. It would need a different hash at a minimum.
- taylorfausak 14y ago
  I'm not sure what you mean by this. mrpollo recommended using MD5 as a checksum before executing jQuery to ensure that the CDN hasn't been compromised. For instance jQuery 1.8.0's checksum is cd8b0bffc85bb5614385ee4ce3596d07. I was under the impression that MD5 isn't malleable enough to create a non-trivial malicious script with the same hash.
  - ars 14y ago
    As of right now there are no practical preimage attacks on MD5, but people keep expecting one. It's better to switch to something else and not have to worry about it.
  - dalke 14y ago
    Your impression is incorrect. Quoting one researcher, "Our intent is to raise awareness that MD5 is broken so drastically that its continued use in digital signature schemes and certificates poses realistic threats." See also http://en.wikipedia.org/wiki/MD5 http://en.wikipedia.org/wiki/MD5 . I am no expert. It may be that MD5 is still relatively secure for this specific task. However, SHA2 is more secure. Use that instead.

keltex 14y ago

I was thinking a cool Chrome extension might be to preload all the major javascript libraries (jquery, etc.) and change any external extension references to the preloaded ones. I'm not sure how much of a speedup this would offer but certainly it would be something.

jemka 14y ago
Not unless you are 1. visiting a lot of sites for the 1st time that use these libraries and/or 2. frequently clear your browser cache. Your browser caches the libraries on first load anyway.

hnruss 14y ago

They don't even have to get compromised to mess up the web. Too many sites point their jQuery src to the latest version, so just wait for jQuery 2.0 to come out and see how many IE 6/7/8 users complain. http://blog.jquery.com/2012/06/28/jquery-core-version-1-9-and-beyond/ http://blog.jquery.com/2012/06/28/jquery-core-version-1-9-an...