8 ms·

Sky parental control system blocks code.jquery.com

92 points by digitalclubb 13y ago

Robin_Message 13y ago
That is really not very reassuring in terms of the level of technical understanding/oversight in managing their block list. Mind you, I'm not surprised that someone updating the list is on a Sunday night is not qualified.
- DanBC 13y ago
  I'd be interested to see if the initial blocking was part of an automatic system - block everything in this malicious page - and was fixed when the competent people got in to work to see all the complaints and reports? That can't be true because it would make reputation attacks really easy.
belorn 13y ago
ISP interference makes for a interesting question regarding liability. Their interference are now potentially causing massive amount of economic damages to companies which relies on jquery library. Webshops, economic infrastructure, hospitals, transportation systems are just a few that relies on having fully functional websites up and running. But for liability, a few questions pops up. Who is the offended party, and how much negligence is required for software bugs. Does it need to be a civil suit with each customer, or can the website owners sue? If a truck crash right outside a store and disrupt business, the store owner can sue even if they have no formal relation with the truck company.
- Cthulhu_ 13y ago
  Alternatively, does code.jquery.com offer any kind of uptime guarantee? Big companies would rather rely on their own hosting / CDN than that of jquery, I'm sure.
  - eloisant 13y ago
    Even for a small company/project, I've stopped using external CDN. The gain is not significant enough to balance problems like this one. It's not often than a consumer ISP does this mistake, but that's pretty common for a user behind a corporate proxy.
  - davidgerard 13y ago
    code.jquery.com has in fact gone down in the past, and this did in fact bite my workplace in the backside. We went to locally-hosted copies of jquery stuff. We kept using Google for JS they hosted, since their uptime way beats ours.
    - tokenizerrr 13y ago
      https://developers.google.com/speed/libraries/devguide#jquery https://developers.google.com/speed/libraries/devguide#jquer...
      - davidgerard 13y ago
        Ahhh! See, we didn't realise that at that moment. Thank you :-)
    - repsilat 13y ago
      > since their uptime way beats ours You link to Google's JS so your users can still get it when your own site is down? If you hosted it yourself your users would see a working site whenever you were up. Now they will see a working site whenever both you and Google are up. This has not improved effective uptime for anyone. (On the other hand, Google might serve the JS faster, especially if your users cache it. They may also keep their copies more up to date.)
      - andrewflnr 13y ago
        GP's point is that it also hasn't noticeably decreased uptime. So especially if there's a speed benefit, why switch?
- raverbashing 13y ago
  So, yeah, one thing that I learned about these CDNs They will stop working eventually So you may try to load from them, but always have a fallback. In your website An example: what if code.jquery.org gets compromised?
  - aidos 13y ago
    In that case your fallback isn't going to help - unless you're performing a checksum on the response you get from code.jquery.org. I know it's probably not considered great practice anymore but I generally just self host js libs. One less thing to go wrong and I often develop without an internet connection. Saves on having to dropback to a fallack every time.
    - raverbashing 13y ago
      Yes, true, in the case of a compromise it won't help. But I've found that outages are more frequent (including my own internet connection) So yes, it also is necessary for development without an internet connection.
markdown 13y ago
Sucks for the people affected by this, but if the result is that more people use google for this, I'd be a happy bunny. Why would anyone use code.jquery.com, really? They obviously don't mind a third party hosting their js, so why not use the most popular service (google) to increase the chances that users arrive at their website with jquery already cached?
- octo_t 13y ago
  What makes you think that Google wouldn't be blocked by the same mechanism?
  - taspeotis 13y ago
    Well let's assume that each URL or domain that is blocked is reviewed by a human who's paid to look at content, not necessarily to have technical knowledge. They'd be much more likely to know that blocking anything from Google is probably a bad idea/false positive but they've probably never heard of jQuery and when they look at the jquery*.js files all they see is The Matrix. So if you allow the above assumption, it's less likely that using Google's CDN would present this problem.
    - mattmanser 13y ago
      So they've never heard of jQuery, but they won't think that googleapis.com looks like a dodgy site as it's trying to pretend to be google.com?
    - VLM 13y ago
      Now that the secret's out, that google won't be blocked, expect the next wave of malware to be served from drive.google.com public links. There might, just possibly, be a meta lesson here that whack-a-mole blocking doesn't work and is basically a lost cause / waste of time. Try solving the problem another way. On the other hand, its excellent security theater operating perfectly. Sometimes security is inconvenient, therefore anything inconvenient must be secure, therefore this is great PR.
    - 13y ago
taspeotis 13y ago
Reminds me of some article I read about having some fallback mechanism for when whatever CDN is serving up your JS fails. "Who controls downtime? You do."
- davidgerard 13y ago
  Make sure your CDN has better uptime than you do. e.g. Google.
rmrfrmrf 13y ago
<script src="//ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script> <script>window.jQuery || document.write('<script src="path/to/your/jquery"><\/script>')</script> Source: http://stackoverflow.com/questions/1014203/best-way-to-use-googles-hosted-jquery-but-fall-back-to-my-hosted-library-on-go http://stackoverflow.com/questions/1014203/best-way-to-use-g...
- youngtaff 13y ago
  I'd question whether this is a worthwhile fallback as depending on what the error is then the browser may still wait 30 (ish) seconds for the original request to time out.
  - rmrfrmrf 13y ago
    I look forward to seeing what you come up with.
csmithuk 13y ago
Sky user here[1]. Turn it off then! This is entirely optional. It asks you when you first install and connect the router via the WiFi landing page if you want to use any blocking. If you don't answer the question or select no, there is no blocking at all apart form the IWF firewall stuff. Every kind of blocking comes with problems of some description. You either live with it or trust your users. [1] £7.50/month for ADSL2 for 12 months with line rental and calls included was too good a deal to throw away. I'd go for Andrews & Arnold if I could afford idealism at the moment.
- voltagex_ 13y ago
  Interested Australian user here. That's about half of the cost of our cheaper monthly ADSL2 plans - what's the catch? How far away from the exchange are you?
  - csmithuk 13y ago
    Well I was an O2 customer. Sky bought O2 last year and in the effort to maintain their customer-base they will give you silly offers if you argue with them for long enough. It's usually £20.50/month including line rental but I argued it down to £7.50/month on the basis I stayed with them for 12 months. No catch. Confirmed no traffic management, no download limit, free router, free migration. This is purely for customer retention. I'm 800m away from the exchange and get 12.2Mbits down and 1.1Mbits up. I pull an average of 120Gb/month over the line with no problems. Edit: just to add I was paying £35.50/month with O2 before which is crazy amounts.
    - Cor 13y ago
      I wish I was having as good a time as you are. I was on o2 for 3-4 years before being transferred over to Sky last month. Since transferring, I've had nothing but problems. Online gaming pings have gone from 20 -> 50, download speeds have fallen 20-30%, my connection frequently hangs (Youtube is near unusable), and I now have issues loading websites from time to time (I had to refresh Google 3 times before it loaded earlier). To make things worse, Sky is charging me £15.50 a month while o2 was only charging £7.50. Thankfully, BT is installing fibre in my area so I should be able to jump over to plus.net sometime soon. I can't wait.
maxcan 13y ago
to be fair, teaching direct dom manipulation is far more harmful to children than any amount of porn or violence.
jdorfman 13y ago
FWIW my company (MaxCDN) provides the CDN service for code.jquery.com. We are currently investigating this issue with Sky. Edit: Just saw this: "It appears that the jquery CDN is unblocked once more on Sky connections where the phishing filter that is part of the parental controls system was enabled." We will continue to work with Sky to prevent this from happening in the future.

92 points by digitalclubb 13y ago

That is really not very reassuring in terms of the level of technical understanding/oversight in managing their block list. Mind you, I'm not surprised that someone updating the list is on a Sunday night is not qualified.

DanBC 13y ago
I'd be interested to see if the initial blocking was part of an automatic system - block everything in this malicious page - and was fixed when the competent people got in to work to see all the complaints and reports? That can't be true because it would make reputation attacks really easy.

belorn 13y ago

ISP interference makes for a interesting question regarding liability. Their interference are now potentially causing massive amount of economic damages to companies which relies on jquery library. Webshops, economic infrastructure, hospitals, transportation systems are just a few that relies on having fully functional websites up and running. But for liability, a few questions pops up. Who is the offended party, and how much negligence is required for software bugs. Does it need to be a civil suit with each customer, or can the website owners sue? If a truck crash right outside a store and disrupt business, the store owner can sue even if they have no formal relation with the truck company.

Cthulhu_ 13y ago
Alternatively, does code.jquery.com offer any kind of uptime guarantee? Big companies would rather rely on their own hosting / CDN than that of jquery, I'm sure.
- eloisant 13y ago
  Even for a small company/project, I've stopped using external CDN. The gain is not significant enough to balance problems like this one. It's not often than a consumer ISP does this mistake, but that's pretty common for a user behind a corporate proxy.
- davidgerard 13y ago
  code.jquery.com has in fact gone down in the past, and this did in fact bite my workplace in the backside. We went to locally-hosted copies of jquery stuff. We kept using Google for JS they hosted, since their uptime way beats ours.
  - tokenizerrr 13y ago
    https://developers.google.com/speed/libraries/devguide#jquery https://developers.google.com/speed/libraries/devguide#jquer...
    - davidgerard 13y ago
      Ahhh! See, we didn't realise that at that moment. Thank you :-)
  - repsilat 13y ago
    > since their uptime way beats ours You link to Google's JS so your users can still get it when your own site is down? If you hosted it yourself your users would see a working site whenever you were up. Now they will see a working site whenever both you and Google are up. This has not improved effective uptime for anyone. (On the other hand, Google might serve the JS faster, especially if your users cache it. They may also keep their copies more up to date.)
    - andrewflnr 13y ago
      GP's point is that it also hasn't noticeably decreased uptime. So especially if there's a speed benefit, why switch?
raverbashing 13y ago
So, yeah, one thing that I learned about these CDNs They will stop working eventually So you may try to load from them, but always have a fallback. In your website An example: what if code.jquery.org gets compromised?
- aidos 13y ago
  In that case your fallback isn't going to help - unless you're performing a checksum on the response you get from code.jquery.org. I know it's probably not considered great practice anymore but I generally just self host js libs. One less thing to go wrong and I often develop without an internet connection. Saves on having to dropback to a fallack every time.
  - raverbashing 13y ago
    Yes, true, in the case of a compromise it won't help. But I've found that outages are more frequent (including my own internet connection) So yes, it also is necessary for development without an internet connection.

markdown 13y ago

Sucks for the people affected by this, but if the result is that more people use google for this, I'd be a happy bunny. Why would anyone use code.jquery.com, really? They obviously don't mind a third party hosting their js, so why not use the most popular service (google) to increase the chances that users arrive at their website with jquery already cached?

octo_t 13y ago
What makes you think that Google wouldn't be blocked by the same mechanism?
- taspeotis 13y ago
  Well let's assume that each URL or domain that is blocked is reviewed by a human who's paid to look at content, not necessarily to have technical knowledge. They'd be much more likely to know that blocking anything from Google is probably a bad idea/false positive but they've probably never heard of jQuery and when they look at the jquery*.js files all they see is The Matrix. So if you allow the above assumption, it's less likely that using Google's CDN would present this problem.
  - mattmanser 13y ago
    So they've never heard of jQuery, but they won't think that googleapis.com looks like a dodgy site as it's trying to pretend to be google.com?
  - VLM 13y ago
    Now that the secret's out, that google won't be blocked, expect the next wave of malware to be served from drive.google.com public links. There might, just possibly, be a meta lesson here that whack-a-mole blocking doesn't work and is basically a lost cause / waste of time. Try solving the problem another way. On the other hand, its excellent security theater operating perfectly. Sometimes security is inconvenient, therefore anything inconvenient must be secure, therefore this is great PR.
  - 13y ago

taspeotis 13y ago

Reminds me of some article I read about having some fallback mechanism for when whatever CDN is serving up your JS fails. "Who controls downtime? You do."

davidgerard 13y ago
Make sure your CDN has better uptime than you do. e.g. Google.

rmrfrmrf 13y ago

youngtaff 13y ago
I'd question whether this is a worthwhile fallback as depending on what the error is then the browser may still wait 30 (ish) seconds for the original request to time out.
- rmrfrmrf 13y ago
  I look forward to seeing what you come up with.

csmithuk 13y ago

Sky user here[1]. Turn it off then! This is entirely optional. It asks you when you first install and connect the router via the WiFi landing page if you want to use any blocking. If you don't answer the question or select no, there is no blocking at all apart form the IWF firewall stuff. Every kind of blocking comes with problems of some description. You either live with it or trust your users. [1] £7.50/month for ADSL2 for 12 months with line rental and calls included was too good a deal to throw away. I'd go for Andrews & Arnold if I could afford idealism at the moment.

voltagex_ 13y ago
Interested Australian user here. That's about half of the cost of our cheaper monthly ADSL2 plans - what's the catch? How far away from the exchange are you?
- csmithuk 13y ago
  Well I was an O2 customer. Sky bought O2 last year and in the effort to maintain their customer-base they will give you silly offers if you argue with them for long enough. It's usually £20.50/month including line rental but I argued it down to £7.50/month on the basis I stayed with them for 12 months. No catch. Confirmed no traffic management, no download limit, free router, free migration. This is purely for customer retention. I'm 800m away from the exchange and get 12.2Mbits down and 1.1Mbits up. I pull an average of 120Gb/month over the line with no problems. Edit: just to add I was paying £35.50/month with O2 before which is crazy amounts.
  - Cor 13y ago
    I wish I was having as good a time as you are. I was on o2 for 3-4 years before being transferred over to Sky last month. Since transferring, I've had nothing but problems. Online gaming pings have gone from 20 -> 50, download speeds have fallen 20-30%, my connection frequently hangs (Youtube is near unusable), and I now have issues loading websites from time to time (I had to refresh Google 3 times before it loaded earlier). To make things worse, Sky is charging me £15.50 a month while o2 was only charging £7.50. Thankfully, BT is installing fibre in my area so I should be able to jump over to plus.net sometime soon. I can't wait.

maxcan 13y ago

to be fair, teaching direct dom manipulation is far more harmful to children than any amount of porn or violence.

jdorfman 13y ago

FWIW my company (MaxCDN) provides the CDN service for code.jquery.com. We are currently investigating this issue with Sky. Edit: Just saw this: "It appears that the jquery CDN is unblocked once more on Sky connections where the phishing filter that is part of the parental controls system was enabled." We will continue to work with Sky to prevent this from happening in the future.