4 ms·

My security conscious nature has always been distrustful of using a public cdn. It represents a potential security and privacy concern to my clients. It'd be

by mey 13y ago

My security conscious nature has always been distrustful of using a public cdn. It represents a potential security and privacy concern to my clients. It'd be an interesting attack vector to inject malicious javascript code into a wide pool of sites at once. It is also an operational concern that these systems are going to continue operating for the long term or not suffer service interruption.

semenko 13y ago
IIRC, Twitter is also concerned about this, and recently proposed a hash-based validation for externally included resources (though I can't seem to find their proposal right now …).
Jakob 13y ago
While true, it’s would not spread that easily. Google returns in its response header of e.g. jquery: "Expires:Fri, 21 Nov 2014 00:46:46 GMT" As long as this file is in my cache, my browser won’t request it again for a year, independent what happened to it in the meantime. > or not suffer service interruption Preventing that is actually quite easy <script src="//cdn/jquery.js"></script> <script>window.jQuery || document.write('<script src="local/jquery.js">\x3C/script>')</script> (a slightly more complex solution would be needed if the CDN is timing out instead of return an error)
- wreegab 13y ago
  If it is in the cache, why is the CDN needed anyways?
  - gcb1 13y ago
    also, if it was not... now the malicious one is. forever.
  - wcdolphin 13y ago
    Using a centralized cdn would increase the chance of a cache hit.
    - wreegab 13y ago
      I'm completely skeptical about the benefit of CDNs to users. I would like to see some hard data about the number of web sites a user visit typically to understand how this is a meaningful argument. As of now, I lean toward thinking these CDNs are just yet another way to track users. Anyways, I block them all by default, and my browsing works just fine.
      - robszumski 13y ago
        The main benefit isn't any of this "cached forever" business, although thats great. It's the fact that the download is coming from 1 or 2 hops away instead of all the way across the country or world.
      - hercynium 13y ago
        How do you "block" a CDN? Is that a mis-wording? Do you have some means to automatically discover and detect the origin servers and connect directly to them, bypassing the CDN? And, to answer your question, the benefits are substantial, well-documented, and provable on multiple levels. First off, a CDN (when working properly) greatly improves the average latency for browsing a site, and in some cases even the bandwidth usage. Additionally, use of a CDN can increase the number of users a site can simultaneously serve. The best CDNs can not only withstand but actively deflect various types of DOS attacks. Some can even serve resources like images and video dynamically optimized for the browsing software or device. There are many more benefits, and believe it or not, a huge percentage of the Internet's web and media traffic flows through CDN services - bypassing all of them is near-impossible (unless you somehow don't use any of the most popular sites and services)
- julien_c 13y ago
  In my experience, browsers don't cache things very aggressively. You'll re-download that file way before 2014.
hercynium 13y ago
Indeed, any CDN could have their servers hacked, and that would be a nightmare. But it seems that most of the biggest ones have had a reasonably (some unbelievably) good track record of preventing and protecting against such problems. I'm not saying it hasn't happened before, or that it won't happen again, but the CDNs that it happens to and/or don't handle it with the utmost care and expertise do not survive very long.

by mey 13y ago

semenko 13y ago

IIRC, Twitter is also concerned about this, and recently proposed a hash-based validation for externally included resources (though I can't seem to find their proposal right now …).

Jakob 13y ago

While true, it’s would not spread that easily. Google returns in its response header of e.g. jquery: "Expires:Fri, 21 Nov 2014 00:46:46 GMT" As long as this file is in my cache, my browser won’t request it again for a year, independent what happened to it in the meantime. > or not suffer service interruption Preventing that is actually quite easy <script src="//cdn/jquery.js"></script> <script>window.jQuery || document.write('<script src="local/jquery.js">\x3C/script>')</script> (a slightly more complex solution would be needed if the CDN is timing out instead of return an error)

wreegab 13y ago
If it is in the cache, why is the CDN needed anyways?
- gcb1 13y ago
  also, if it was not... now the malicious one is. forever.
- wcdolphin 13y ago
  Using a centralized cdn would increase the chance of a cache hit.
  - wreegab 13y ago
    I'm completely skeptical about the benefit of CDNs to users. I would like to see some hard data about the number of web sites a user visit typically to understand how this is a meaningful argument. As of now, I lean toward thinking these CDNs are just yet another way to track users. Anyways, I block them all by default, and my browsing works just fine.
    - robszumski 13y ago
      The main benefit isn't any of this "cached forever" business, although thats great. It's the fact that the download is coming from 1 or 2 hops away instead of all the way across the country or world.
    - hercynium 13y ago
      How do you "block" a CDN? Is that a mis-wording? Do you have some means to automatically discover and detect the origin servers and connect directly to them, bypassing the CDN? And, to answer your question, the benefits are substantial, well-documented, and provable on multiple levels. First off, a CDN (when working properly) greatly improves the average latency for browsing a site, and in some cases even the bandwidth usage. Additionally, use of a CDN can increase the number of users a site can simultaneously serve. The best CDNs can not only withstand but actively deflect various types of DOS attacks. Some can even serve resources like images and video dynamically optimized for the browsing software or device. There are many more benefits, and believe it or not, a huge percentage of the Internet's web and media traffic flows through CDN services - bypassing all of them is near-impossible (unless you somehow don't use any of the most popular sites and services)
julien_c 13y ago
In my experience, browsers don't cache things very aggressively. You'll re-download that file way before 2014.

hercynium 13y ago

Indeed, any CDN could have their servers hacked, and that would be a nightmare. But it seems that most of the biggest ones have had a reasonably (some unbelievably) good track record of preventing and protecting against such problems. I'm not saying it hasn't happened before, or that it won't happen again, but the CDNs that it happens to and/or don't handle it with the utmost care and expertise do not survive very long.