10 ms·
JsDelivr – The advanced open source public CDN
- dalek2point3 13y agoI dont understand how this is paid for -- can someone explain?
- lazyjones 13y ago> I should also point out that MaxCDN, CloudFlare, Cedexis and the rest of the companies sponsor jsDelivr for free. Personally, I don't trust such services any more than I trust cloud hosting, which means not at all. I have no way to make sure that they server these files unmodified, that they aren't neglecting their servers to the point where they're hacked and serve malware to my users etc. ...
- wreegab 13y agoAdd to this privacy concerns. I un-block such 3rd-party CDNs if and only if it breaks specific web sites which I want really want to un-break.
- jimaek 13y agoI would be happy to address these issues. You have no reason to believe me but all custom servers are secured and are regularly updated. For CloudFlare and MaxCDN I have 2-Step authentication enabled + for MaxCDN 1 allowed whitelisted IP address. Regarding unmodified files I guess we can build an app to monitor them? If you want drop by https://github.com/jsdelivr/jsdelivr https://github.com/jsdelivr/jsdelivr and we can discuss this even further. I would be happy to do anything possible to ease your concerns regarding security.
- bronson 13y agoDo you have any sort of agreement that they will serve these files bit for bit unmodified? I had a problem with cloudflare inserting some tracking cookies into my static HTML files. They claimed it was ddos protection. To me (and the EU cookie directive) it looked no different from the garbage other analytics sites use. If jsdelivr providers are allowed to modify the files they serve, I won't use it. Got any sort of guarantees? Thanks.
- jimaek 13y agoThey are not allowed to modify the files. CloudFlare had to deploy a special fix to disable all cookies and security functionality completely on my account. Only after the fix I enabled their CDN. MaxCDN does not modify the files in any case.
- saurik 13y agoI think with CloudFlare you should really get an agreement that states some kind of penalty if that "special fix" every accidentally breaks (their engineers seem pretty fast/loose with agile code changes that affect their customer's sites).
- bronson 13y agoI think so too. I'm happy and reassured to hear that assets are served unmodified now, but do you have a guarantee that it will remain that way?
- jimaek 13y agoModifying already hosted files is unacceptable. The fix by CloudFlare was a custom code that disables the Control Panel features completely. Even if I or someone else enables it, it wont do anything. I will be in contact with them to make 100% sure the fix wont be reverted in any case.
- saurik 13y agoFWIW, the only "CDN" I've ever heard of to regularly pull stunts like that is CloudFlare; and really, that's their angle: it adds latency (which has been demonstrated in various commentary on the service) with the goal of modifying content to reduce the number of requests or improve client-side rendering times. It is more of a "content optimization" service than a "content delivery" service. If you want a CDN the tradeoffs (number of edge nodes, latency, cache sizes) are much better with other providers. Sometimes, the stuff they inject also has horrible bugs ;P. One time, for an entire day, they were managing to lock up Safari entirely. Cydia is mostly a web browser, and one of the companies I work with apparently used CloudFlare, so Cydia suddenly stopped working that day in a way that was pretty catastrophic. I did a writeup on the process of discovering the bug (which I had to report to CloudFlare to get fixed: I don't even think they really had the expertise in-house to figure out what happened). http://www.saurik.com/id/14 http://www.saurik.com/id/14
- giergirey 13y agoHere's one security concern - What procedure do you follow when accepting files for inclusion in jsdelivr? I mean, what's to stop this scenario: 1. attacker uploads a poisoned version (say, with an XSS vulnerability) of a popular library to an official-sounding github repo 2. attacker raises a github issue with you asking you to put it on jsdelivr 3. you assume the attacker is a legitimate contributor or user of the library and add it to jsdelivr 4. other sites start using the poisoned version of the library 5. attacker can now carry out XSS attacks on the sites using the library I have another security concern about www.jsdelivr.com (which I hope is totally separate from the CDN?) but I'll email that to you.
- jimaek 13y agoI validate all submitted libraries. I try to do size and md5 validation for everybody. Cases where I do minimum validation is when the author himself submits his library and for trusted people I can skip md5. But once the auto-update app comes online this issues should become obsolete. www.jsdelivr.com is completely separate from the CDN. Plus the code is open sourced so you can actually see how it works.
- lazyjones 13y agoTo be frank, I'd like to be able to believe and trust you and work myself in a climate where this is generally safe to do. But we're no longer in the early 90's, so we can no longer base technical decisions that concern security on trust in other people's decisions and behavior (esp. when they are not on our payroll). Nor can we trust contracts and legal assessments when even governments are breaking the law. There are no technical measures that can prevent you or the companies hosting these files for free from serving modified JS arbitrarily, or on some authority's demand, to everyone or to selected individuals. If we could put a checksum in the <script> tag, we'd be fine (to some extent, provided collisions are really hard to find - so no md5 please), but we can't, so we aren't. Like many other web site owners, I believe security to be more important than my bandwidth or a few 10 more miliseconds of loading times, so I can't be convinced easily to use a public CDN for JS. (and yes, I still have to trust other people for not backdooring other software and hardware I'm using, but I try to keep the attack surface as small as possible)
- jimaek 13y agoCedexis, MaxCDN and CloudFlare all offer their services without any limits and for free. Same for all the custom locations we have from Hosting companies. We are in excellent relations with all of our sponsors so no issues there. For the rest stuff like Domains, SSL, Hosting, Freelancers, other I pay myself.
- shimon_e 13y agoI wonder if you could somehow get Google as a sponsor too? Maybe someone could convince them to adopt your multi CDN technology for web fonts? The reason why I want this is because in China the GFW periodically hangs connections to Google's IPs after searching certain keywords for 90 seconds. This causes any site that uses Google web fonts to hang until the connection is resumed.
- jimaek 13y agoI would love to have Google join jsDelivr but its hard getting in contact. I guess Google is the one who knocks :p
- RaphiePS 13y agoThis is really cool. Up to the section on Advanced Features, it seemed like a clone of Cloudflare's cdnjs. But the multiple request feature is absolutely terrific, and I can't wait to use it. EDIT: I wonder if the multiple-request URL's mean that the individual assets won't be cached, which is a big selling point of CDN's.
- jimaek 13y agoGrouped URLs are cached as always but for less time. You can check the headers.
- eli 13y agoI think the parent's point is that people will less likely to have a warm cache because it's less likely any other site has requested the exact same group of files. (Though there's debate as to how much that matters.)
- jimaek 13y agoPersonally I think they only file that is going to be already cached is jQuery from Google. So for the rest it doesn't matter. Just my opinion.
- moystard 13y agoThere is cdnjs.com that proposes the exact same features and has been available for quite some time. I regularly submit new libraries and update the current ones through their Github repository. The multiple files per request is nice however, but contributing to cdnjs might have been a better way of proposing it.
- xpose2000 13y agoBut according to the benchmarks, cdnjs.com is worse than google and jsdelivr. http://www.cdnperf.com/#jsdelivr,google,cdnjs/http/90 http://www.cdnperf.com/#jsdelivr,google,cdnjs/http/90
- jimaek 13y agoExactly, we use multiple CDNs. We are the only project to do that. This is why our performance and uptime will be always better.
- Codhisattva 13y agoBetter than Akamai? I think not.
- jimaek 13y agoAkamai does not offer a public CDN. So they are not a competitor. Apples and oranges
- Codhisattva 13y agoIf by "public" you mean free, correct. Akamai is cadillac of the CDN world so more like Apples and Organic Gourmet Apples.
- moystard 13y agoThanks for the link, we will be experimenting with cdnperf in the coming weeks, and make the move if we are happy with it.
- alecsmart1 13y agoI must say that the process for adding files is too complicated and time consuming.
- jimaek 13y agoI know. I hope the auto-update app will fix this. We are also thinking new ways to add files https://github.com/jsdelivr/jsdelivr/issues/347 https://github.com/jsdelivr/jsdelivr/issues/347
- alecsmart1 13y agoWhy not implement origin pull?
- jimaek 13y agoOrigin pull from Github? We need to maintain our own structure to allow features like file grouping and version aliasing.
- gales 13y agoI currently use cdnjs, but very interested in the single HTTP request & simpler versioning that JsDelivr is offering, so will start using this for my current project. Most of the libraries I use are already on there, and I like the fact that brief glance information is shown for each library. Also noticed there's a duplicate misspelt typeahead library listed.
- deleted 13y ago[deleted]
- pfraze 13y agoFunny you mention that! Posted today: http://www.w3.org/TR/SRI/ http://www.w3.org/TR/SRI/
- romaniv 13y agoThe same thing that is used for integrity checks could be used as a DHT hash, potentially allowing people to download the file from their peers where connection has the lowest latency, or from their favorite CDN they find the most reliable. The same hash could be used similarly to etags with additional interesting properties. You could, for example, use it to safely retrieve an item that was cached for another website. (E.g. latest JQuery.) Not only it would improve performance, it would make user tracking somewhat more challenging for CDNs, improving privacy. The potential here is huge, so it's disappointing that these ideas are smudged over multiple unrelated specs, and sometimes missed entirely.
- pfraze 13y agoYou're correct, and all of those use-cases are mentioned in the spec, so I'm optimistic. This is from some of the guys involved in CSP, and that spec has been deployed well. Let's just make sure we voice our support for it. EDIT: sorry - they mention caching and using fallback sources, they don't mention any DHT.
- nawitus 13y agoI'd like something like this integrated with a module system. For example, I could just say "var jquery = require("jquery")", and the script would be automatically downloaded from the CDN.
- bebraw 13y agoI suppose someone could write something like this on top of the API, https://github.com/jsdelivr/api https://github.com/jsdelivr/api .
- riffraff 13y agoisn't that what google does? https://developers.google.com/loader/ https://developers.google.com/loader/
- deleted 13y ago[deleted]
- kjell 13y ago[browserify-cdn](http://wzrd.in/ http://wzrd.in/) and http://requirebin.com/ http://requirebin.com/ are heading this direction.
- aw3c2 13y agoHow about not leaking to third-parties? I value my privacy and I wish Mozilla would too.
- rnyman 13y agoRobert here, Editor of Mozilla Hacks. We cover all kinds of resources for developers, especially with a strong focus on open source and technologies. If you are interested in knowing more about privacy, please get in touch with the people behind jsDelivr, write a comment to the blog post or similar. Thanks.
- aw3c2 13y agoHi Robert, sorry I did not realise that this was not a Mozilla project. The post sounds like it is and the site suggests it is a "hack" by Mozilla.
- rnyman 13y agoNo worries. The name of the web site is Mozilla Hacks, and we talk about everything open source/Open Web. I've added a note at the beginning of the post to be more clear.
- _puk 13y agoSorry, I don't get the comment. Leaking what? Your publicly available JS libraries? or is this a more general Mozilla bashing comment? The service itself looks great, and the versioning is exactly what I'm after.
- gtirloni 13y agoThere are no popularity restrictions and all kinds of files are allowed, including JavaScript libraries, jQuery plugins, CSS frameworks, fonts and more So what is 'Js' about it? Has 'i' prefix become old-fashioned?
- jimaek 13y agojsDelivr is javascript centered. But it allows all kinds of projects too. For example the combination feature will only work with js projects. And we have all kinds of plugins for js developers. But we still want to help open source projects to take advantage of our network. This is why we allow even windows binaries and other stuff too.
- userbinator 13y agoThe 'i' prefix would risk unwanted attention from Apple.
- deleted 13y ago[deleted]
- it_learnses 13y agoCan I work for mozilla? I feel like they're only one of the few organizations that are doing cool things for the common good. Keep it up!
- F30 13y agoThey may be, but JsDelivr appears to have no deep affiliation with Mozilla: > Who is behind jsDelivr? > Basically just me, Dmitriy A. or @jimaek. But a lot of other people are involved, giving their advice and helping me out. I always refer to jsDelivr in the plural sense because of this. It is sponsored, amongst others, by CloudFlare and MaxCDN, where @jimaek is also employed. But the only connection to Mozilla seems to be that it's featured on the Mozilla Hacks blog.
- ozten 13y agohttps://careers.mozilla.org/en-US/listings/ https://careers.mozilla.org/en-US/listings/
- AdrianRossouw 13y agoSo this is something I wrote last week relating how I've come to believe that it's really not appropriate to rely on vendor code on public CDN's for anything more complex than a JSFiddle. http://daemon.co.za/2014/03/from-trenches-js-cdn-point-of-failure http://daemon.co.za/2014/03/from-trenches-js-cdn-point-of-fa... Basically, if you need to include something like jquery, you have to have code that makes use of it. Since by definition, you can't serve that code from a public cdn, you are going to need to serve those static assets somehow. I now believe that you should serve the vendor code from the same 'place' as you serve your application's static assets, because by relying on external resources, you are adding more moving parts that all have to be in perfect working order for your app to actually be able to run. This doesn't really have anything to do with how reliable the CDN itself is, but rather with how reliable the client's connection is. I did read the jsdelivr post, and it actually looks like a really well thought out system. I just don't think I will use something like this for anything where I have the choice not to. IMO, the possible benefits of using a public CDN, don't outweigh the fragility that gets added. It just feels like it is trying to optimize best case performance while worst case is far more important. I'm not against CDN's as a concept though, I just think you should serve all the code that is needed for normal operation from the same one.
- untog 13y agoIt's very easy to add a fallback, though. If the CDN goes down, load the local version. > This doesn't really have anything to do with how reliable the CDN itself is, but rather with how reliable the client's connection is. If they have the CDNed version of jQuery cached then it doesn't need their connection to do anything.
- AdrianRossouw 13y agoyou could just have loaded the local file the first time and have it work every time, without all those ifs and maybes involved. it can take several seconds for the request to fail, during which your application won't have been loaded or working. the fallback adds complexity to your code, which ultimately didn't need to be there. I just think that it's better to reduce the ways that your application can break, before trying to make it a little bit faster for the cases in which all the conditions are met. On principle, even in the theoretical best case scenario, I think it's not the right approach to be taking. I also don't think that the best case scenario can be reliably enough predicted to be something you should try to optimize for. There are many CDN's, many different versions of the many different libraries. Especially on mobile devices, cache size is limited. IMO, at least.
- stcredzero 13y agoI'd like to see something like a CDN, but for completely dynamic content. Something like a system that could host instances of a game server, with a framework that ensures clients make connections with very low latency.
- devicenull 13y agoHuh? The game server instances would still need to sync between themselves, so this really wouldn't address latency. Rather then having the latency between the client and the server, you'd instead have latency between the two servers.
- stcredzero 13y agoHuh? The game server instances would still need to sync between themselves, so this really wouldn't address latency. No. If you design the game properly, they actually don't have to coordinate very much at all.
- devicenull 13y agoFor what kind of game? For something like a FPS this requires significant coordination.
- chc 13y agoHow much coordination is there between, say, different Team Fortress 2 servers?
- Dorian-Marie 13y agoNeat, but I couldn't get three librairies with minified JS: https://cdn.jsdelivr.net/g/jquery@1.10.2,bootstrap@3.0.3,angularjs@1.2.10 And I couldn't get Boostrap CSS even if they say they also host CSS. Also, it's not clear if you can or not mix CSS and JS in the query, that would be neat to do that and then to insert CSS with Javascript (or maybe that would be a bad idea).
- jimaek 13y agojQuery was deployed from the official source. And it does load a map file suggesting its minified. Not sure why it looks like this. You can mix CSS and JS in one query but its up to you to make it work. To load Bootstrap CSS you need to specify the exact file like so https://cdn.jsdelivr.net/g/bootstrap@3.1(css/bootstrap.min.css) https://cdn.jsdelivr.net/g/bootstrap@3.1(css/bootstrap.min.c... Because the main file for this project points to a js
- Dorian-Marie 13y agoThe original file was not minified: https://github.com/jsdelivr/jsdelivr/pull/478 https://github.com/jsdelivr/jsdelivr/pull/478
- Dorian-Marie 13y agoThanks, I didn't see the files were in sub-directories for Bootstrap. Here is my final Javascript query: https://cdn.jsdelivr.net/g/jquery@1.10.2(jquery.min.js),bootstrap@3.0.3(js/bootstrap.min.js),angularjs@1.2.10(angular.min.js) https://cdn.jsdelivr.net/g/jquery@1.10.2(jquery.min.js),boot...
- jimaek 13y agoYou dont need to specify the exact files in this case. This code will load the exact same thing https://cdn.jsdelivr.net/g/jquery@1.10.2,bootstrap@3.0.3,angularjs@1.2.10 https://cdn.jsdelivr.net/g/jquery@1.10.2,bootstrap@3.0.3,ang... You need to specify the files if you are loading files other than the one specified in the "mainfile" parameter. Or loading multiple files together.
- javajosh 13y agoWhen you include 3rd-party hosted content in your program, you give those 3rd-parties: 1. Access to your users' browser details (via request headers). 2. Access to your users' habits (via the referrer header). 3. The ability to replace executable code. (This code can be used to gather more data from the state of the web page (e.g. keystroke logging), or break out of the browser sandbox and compromise the whole system. Note: this only applies to JavaScript.) 4. The ability to break your software, either intentionally or unintentionally, by not serving the resource at all. When you host and serve your own resources, these are non-issues. I think there is a sense among good-hearted programmers that "But gosh, they wouldn't do [1-3]! These CDNs are just a really nice public service by companies that care about keeping the web community healthy and fast. And besides, if they ever abused their access to user data, there would be hell to pay!" Unfortunately this blasé attitude about user privacy on the part of programmers is why we have such a rough time with privacy in general these days. I believe that if you're a programmer with any interest at all in protecting your users from bad actors, that you'll do your best to avoid using 3rd party hosts, especially for executable code.
- deleted 13y ago[deleted]
- majika 13y agoThank you thank you thank you. What's worse is when you see sites running JavaScript from multiple analytics companies, social media companies, and CDNs - even on pages that should be private (login forms, personal details, etc.). It's even worse when those sites break without those scripts. This is a concern that far too many developers overlook. I made this (harsh) comment [0] on such a site posted to HN a few months ago. CDNs are way overrated, from what I've seen. I think, for most use cases, you're better off avoiding the multiple HTTP requests and just compressing all your JavaScript into a single file. Serve that from your own server and you'll save the client from another domain name resolution too. Do yourself a favor and install NoScript. For one thing, it will show you how easily Google can (or, could have) track your internet usage - and, as you pointed out, so much more. In my experience, about 50% of sites serve scripts from some Google domain. [0]: https://news.ycombinator.com/item?id=7187593 https://news.ycombinator.com/item?id=7187593
- dangayle 13y agoHOw is this different from cdn.js? I already use that, and it too is on Cloudfare.
- SimHacker 13y ago2004 calld. Thy want their missing "e" back.
- SimHacker 13y agoI am worrid about wb sits with misspelld nams. Mistakn usrs somtims correctd missd lettrs, so thy downloadd pags from unrelatd servrs. Howevr, the spc thy postd mentiond othr use cass, and presentd exampls of anothr systm with enterprisy qualitis to delivr usrs to correctd wb sits with misspelld nams: A clevr browsr evn maks guesss, which enabls fils with unrequestd but correctd nams to be downloadd in paralll ovr integratd distributd per to per technologis, oftn receivd replis cachd, and latr presentd. Ys, yt again, browsrs designd by committs enabld Opn Sourcs and Fre Softwars to answr anothr complicatd Internt problm!
- lerouxb 13y agoThe problem I have with this is the same I have with all public js CDNs: Your project doesn't just use public js files. You are almost guaranteed to also have custom javascript (which could itself be opensource or not. irrelevant), css, possibly fonts, images, etc. You can't put your static files on that public cdn. So either you have to serve it up yourself or you have to put it on your own CDN (either one you run yourself or a managed one). So you have an additional point of failure (because your static files are coming from at least two places rather than one) which multiplies the chances of something going wrong for little benefit in my opinion. Deployments are likely to be much more complex too, etc. And before someone mentions the limit of how many concurrent requests a browser will make to a host: That's also irrelevant. I'm not arguing that you should have loads of little files. You should still be combining things with build tools. In fact if you host those "vendor" files on your own webserver or cdn you actually have more flexibility around how to combine them. And you can still have multiple subdomains and ip addresses or whatever pointing to the same CDN to try and optimise around that if you want.