6 ms·

The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. That way, you can run them through the ol' asse

by ballard 13y ago

The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. That way, you can run them through the ol' asset pipeline too... minifiers and possibly serve them straight from gzips. Gotta always remind ppl of https://developers.google.com/speed/ https://developers.google.com/speed/ ... the OP scores 47 (out of 100)

UnoriginalGuy 13y ago
Interesting, Google has added more stuff to the speed test. My site has gone DOWN by 4 points since I last tested it due to failing some new tests. Really great service by Google in general. I've managed to improve page loading times by 25%, cut number of connections in half (I merged all images into one unified file and then use CSS to display the relevant sub-sections), and reduce the total size of my page by over 10%.
grey-area 13y ago
The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. For dependencies you can control, it's obviously best to keep a local or CDN copy. However this trend of embedding js from all over the web is encouraged by the pattern that most of the big sites allowing you to embed content use: e.g. https://developers.google.com/+/web/badge/ https://developers.google.com/+/web/badge/ Google, Twitter, FaceBook all want you to embed js hosted on their servers in your page in order to interact with their site, even if all that script does is then insert an iframe into the page. By including a button or widget like the one above you're trusting them not to take over your site in a manner similar to this example, track your users surreptitiously, or be compromised now or in the future.
- jacquesm 13y ago
  One thing that will happen is that domains that get abandoned that used to host benign js will get taken over by the jerks. That's very hard to protect against, and with the rate at which start-ups encourage people to embed their tags I'm kind of surprised there hasn't been a significant incident like that.
  - mtrimpe 13y ago
    Good point. I imagine you could make a pretty penny by hijacking credit card detail entry forms. To evade detection you can even have the hijacking code only included on pages that actually collect credit card info.
    - sneak 13y ago
      Or only serve it to 10% of requests, making it a heisenbug for the site owner attempting to track it down. :D
hfsktr 13y ago
I didn't even know that existed. After checking my site it's just a reminder how little I know.

by ballard 13y ago

UnoriginalGuy 13y ago

Interesting, Google has added more stuff to the speed test. My site has gone DOWN by 4 points since I last tested it due to failing some new tests. Really great service by Google in general. I've managed to improve page loading times by 25%, cut number of connections in half (I merged all images into one unified file and then use CSS to display the relevant sub-sections), and reduce the total size of my page by over 10%.

grey-area 13y ago

The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. For dependencies you can control, it's obviously best to keep a local or CDN copy. However this trend of embedding js from all over the web is encouraged by the pattern that most of the big sites allowing you to embed content use: e.g. https://developers.google.com/+/web/badge/ https://developers.google.com/+/web/badge/ Google, Twitter, FaceBook all want you to embed js hosted on their servers in your page in order to interact with their site, even if all that script does is then insert an iframe into the page. By including a button or widget like the one above you're trusting them not to take over your site in a manner similar to this example, track your users surreptitiously, or be compromised now or in the future.

jacquesm 13y ago
One thing that will happen is that domains that get abandoned that used to host benign js will get taken over by the jerks. That's very hard to protect against, and with the rate at which start-ups encourage people to embed their tags I'm kind of surprised there hasn't been a significant incident like that.
- mtrimpe 13y ago
  Good point. I imagine you could make a pretty penny by hijacking credit card detail entry forms. To evade detection you can even have the hijacking code only included on pages that actually collect credit card info.
  - sneak 13y ago
    Or only serve it to 10% of requests, making it a heisenbug for the site owner attempting to track it down. :D

hfsktr 13y ago

I didn't even know that existed. After checking my site it's just a reminder how little I know.