4 ms·

I see no privacy policy so you have to assume that they will log all they can about your visitors. In these global dragnet surveillance ridden times it should

by aw3c2 12y ago

I see no privacy policy so you have to assume that they will log all they can about your visitors. In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself.

Timmmmmm 12y ago
Agreed, especially a third party provide of javascript! It would be absolutely trivial for them to inject highly invasive tracking code into your site, or worse. I'm not saying they will, but really it doesn't make sense to take the risk.
kalleboo 12y ago
> In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself. I still wish there was a "hash" attribute to script tags (and others) so that browsers could cache common JS/CSS/etc assets cross-domain.
- woadwarrior01 12y ago
  I've been wanting this for a while now. The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes. But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest https://github.com/pwnall/script-digest
  - jacobgreenleaf 12y ago
    If the hash was SHA-512 wouldn't that be hard?
  - dsl 12y ago
    Ugh. This proposal also suggests using "magic comments" in scripts, which needs to die. They will get stripped by things like pagespeed and various acceleration proxies, completely outside the developers control.
    - voltagex_ 12y ago
      shouldn't it be something like <script src="blah" data-hash-sha512="...">?
gprasanth 12y ago
I think the assets are served via cookie less connection. prasanth:~/ $ http get http://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.1/jquery.min.js [18:22:12] HTTP/1.1 200 OK Access-Control-Allow-Origin: * CF-Cache-Status: HIT CF-RAY: 13f0d5579cd70bab-HKG Cache-Control: public, max-age=30672000 Connection: keep-alive Content-Encoding: gzip Content-Type: application/javascript Date: Mon, 23 Jun 2014 12:54:17 GMT Expires: Sat, 13 Jun 2015 12:54:17 GMT Last-Modified: Thu, 01 May 2014 17:45:11 GMT Server: cloudflare-nginx Transfer-Encoding: chunked Vary: Accept-Encoding Edit: found this other thread[1] where the above is not true for cloudflare customers. [1] - https://news.ycombinator.com/item?id=4912134 https://news.ycombinator.com/item?id=4912134
- terinjokes 12y ago
  CloudFlare WWW developer here: since that thread we fixed our GA inserts on our web properties and turned off the usual CDN cookies for CDNJS.

by aw3c2 12y ago

Timmmmmm 12y ago

Agreed, especially a third party provide of javascript! It would be absolutely trivial for them to inject highly invasive tracking code into your site, or worse. I'm not saying they will, but really it doesn't make sense to take the risk.

kalleboo 12y ago

> In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself. I still wish there was a "hash" attribute to script tags (and others) so that browsers could cache common JS/CSS/etc assets cross-domain.

woadwarrior01 12y ago
I've been wanting this for a while now. The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes. But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest https://github.com/pwnall/script-digest
- jacobgreenleaf 12y ago
  If the hash was SHA-512 wouldn't that be hard?
- dsl 12y ago
  Ugh. This proposal also suggests using "magic comments" in scripts, which needs to die. They will get stripped by things like pagespeed and various acceleration proxies, completely outside the developers control.
  - voltagex_ 12y ago
    shouldn't it be something like <script src="blah" data-hash-sha512="...">?

gprasanth 12y ago

I think the assets are served via cookie less connection. prasanth:~/ $ http get http://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.1/jquery.min.js [18:22:12] HTTP/1.1 200 OK Access-Control-Allow-Origin: * CF-Cache-Status: HIT CF-RAY: 13f0d5579cd70bab-HKG Cache-Control: public, max-age=30672000 Connection: keep-alive Content-Encoding: gzip Content-Type: application/javascript Date: Mon, 23 Jun 2014 12:54:17 GMT Expires: Sat, 13 Jun 2015 12:54:17 GMT Last-Modified: Thu, 01 May 2014 17:45:11 GMT Server: cloudflare-nginx Transfer-Encoding: chunked Vary: Accept-Encoding Edit: found this other thread[1] where the above is not true for cloudflare customers. [1] - https://news.ycombinator.com/item?id=4912134 https://news.ycombinator.com/item?id=4912134

terinjokes 12y ago
CloudFlare WWW developer here: since that thread we fixed our GA inserts on our web properties and turned off the usual CDN cookies for CDNJS.