5 ms·

JQuery SSL Certificates Expire

52 points by rcconf 12y ago

rcconf 12y ago
This brought down our website. Lesson learned, host your own JavaScript.
- dtech 12y ago
  Or use a CDN you have more trust in, like Google's.
getdavidhiggins 12y ago
http://code.jque.re/ http://code.jque.re/
BradRuderman 12y ago
please fix asap!
- Zergy 12y ago
  Wouldn't this be solved by hosting it on your own site?
  - mhogomchungu 12y ago
    I assume that will work,but it will introduce two problems. 1. Keep a local copy means you will be the one paying for the bandwidth to serve it. 2. You will have to manually update your local copy everytime upstream makes improvements. Having things locally increases reliability but it carries its own costs.
    - kcbanner 12y ago
      How is getting upstream "improvements" without having a chance to test them a good thing?
      - danielweber 12y ago
        "Users want and demand a rich computing experience."[1] [1] http://catless.ncl.ac.uk/Risks/18.85.html#subj6 http://catless.ncl.ac.uk/Risks/18.85.html#subj6
    - krisdol 12y ago
      But a minified library is loaded once per visitor (then cached) and is lilely is not going to have a greater bandwidth impact than any one of your actual pages. My site surprisingly breaking without me making changes to it (whether due to third party unreliability, security issues with their server, or surprise updates) sounds like a really, really bad thing.
    - wdewind 12y ago
      No these are not the reasons: 1. This cost is minimal, and most of the time will be served from cache anyway. I'd be willing to stake a claim that literally zero people ever have worried about the cost of serving jQuery when they weren't already worried about the cost of serving a bunch of other shit that eliminating just jQuery wouldn't fix. 2. This is completely undesirable, and doesn't happen anyway because you like to a specific version which does not change from under you. The arguments in favor of hosting it on a CDN like googles are: 1) Clients who visit other sites will precache the file, so there is a chance they wont even need to load jQuery at all, and this can increase perf 2) Pushing some files to different domains can decrease load times because browsers can load files from multiple domains in parallel instead of serially like they would from one domain. 3) For smaller sites the google CDN is likely actually more dependable than your own. But if you've invested in a CDN this is no longer true.
    - tlianza 12y ago
      #2 isn't solved with a CDN since you'd always hotlink a specific version - the version you tested your code with. The main reason I think isn't even really #1 (cost) but a general assumption that CDNs are faster than your servers, and the chance that if multiple sites are sharing one of these CDNs, you actually have first-time users who can visit your site a bit faster because they already have that resource cached.
      - Zikes 12y ago
        Some CDNs like Google's will let you specify just the major version, so in the case of jQuery it would serve 1.<latest> or 2.<latest>. Generally undesirable in a production environment, though.
    - BlakePetersen 12y ago
      Paying for jQ bandwidth is like paying for air, seriously. With jQ, you're most likely defining the version you need, so getting upstream improvements with jQ is a bit more involved than the library simply updating itself if you aren't using the edge version. A better argument for using a CDN is that jQ library is likely going to be cached if the user's been on the web for more than 5 minutes. Chances are, your version will be one that's cached and, instead of waiting for the downloading of a library that already exists on the users system, the library is immediately loaded and perceived PLT is decreased as a result. There are also numerous CDNs out there, I would use a fallback stack to ping the next CDN in line as it would be a cold day if every major CDN that hosts jQ were to lose SSL support for a time.
    - bdcravens 12y ago
      You will have to manually update your local copy everytime upstream makes improvements. Isn't this true of every library, framework, language, kernel, etc, that drives websites?
    - bdcravens 12y ago
      Keep a local copy means you will be the one paying for the bandwidth to serve it. This should never be a consideration. It's not really stealing bandwidth, since all are welcome to download, but the idea that an asset my site (which presumably makes money) needs should be paid for by someone else really is in the same ballpark ethically.
edftw 12y ago
just took down our site - can't sign up users
ihsw 12y ago
Why not use Google's CDN? https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.m...
- Zikes 12y ago
  Because you'd still be putting your web site in someone else's hands. http://www.sslshopper.com/article-ssl-certificate-renewal-even-google-forgets.html http://www.sslshopper.com/article-ssl-certificate-renewal-ev...
- StoryboardThat 12y ago
  Google doesn't host jquery migrate
- donpdonp 12y ago
  Or for that matter, why not use any of the other CDNs that host jQuery? http://cdnjs.com/ http://cdnjs.com/ http://www.jsdelivr.com/ http://www.jsdelivr.com/ http://www.asp.net/ajaxlibrary/cdn.ashx http://www.asp.net/ajaxlibrary/cdn.ashx
- fourstar 12y ago
  Because not everyone requires jQuery with a script tag. Especially with require/common.js.
- danielweber 12y ago
  I am some kind of weird mutant because I consider having external javascript on my website to be an embarrassment for anything bigger than a hobby project -- but 99% of the universe behaves otherwise.
  - UnoriginalGuy 12y ago
    That's because the other 99% understands how browser caching works. If you use JQuery.com, Google, or Microsoft's CDNs then MOST of the time users won't have to download a JQuery/Boostrap/etc library as the browser would already have an unexpired cache of it. For example, the OP's link's cache will expire (theoretically) in the year 2079. So if a user visited ANY page that utilises JQuery v1.10.2 they already have it. That is a HUGE win. It is an even huger win for mobile (e.g. for small sites you could cut your network traffic in half, which in turn increases loading speed). It is also trivial to set it up so the page tries the CDN first and if that fails then grab a local copy e.g. <script src="//code.jquery.com/jquery-1.10.2.js"></script> <script>window.jQuery || document.write('<script src="lib/jquery-1.10.2.js">\x3C/script>')</script>
dtech 12y ago
Wow, how can a prominent internet library that advises its users to use this server make such an avoidable rookie mistake...
- nobodysfool 12y ago
  Well, because chances are they gave the job of renewing the certificates to the rookie, and he may not have known how to do it, or raised the issue multiple times and nobody knew the implications of it. I know the last place I worked at, I mentioned that the certificates were expiring, and I needed to pay to renew them, yet they didn't seem to care until our customers couldn't connect anymore.
0x0 12y ago
Would the standard local js fallback pattern solve this? <script>window.jQuery || document.write('<script src="js/jquery-2.0.0.min.js">\x3C/script>')</script>
- gprasanth 12y ago
  Indeed! it's shipped as standard in html5 boilerplate code https://github.com/h5bp/html5-boilerplate/blob/c3a72ff882104a1abc6ed05f5ca3eabb11c08a51/index.html#L25 https://github.com/h5bp/html5-boilerplate/blob/c3a72ff882104...
- deleted 12y ago
  [deleted]
hayksaakian 12y ago
Is there a public acknowledgement of the problem?
- yuhong 12y ago
  https://twitter.com/jquery/status/494922194351181824 https://twitter.com/jquery/status/494922194351181824
dm2 12y ago
CloudFlare CDN: http://cdnjs.com/libraries/jquery http://cdnjs.com/libraries/jquery I use to use the Google CDN but cdnjs.com has a huge amount of javascript libraries hosted on it and it is usually updated faster.
abimaelmartell 12y ago
Any "big" website is broken because of this?
- slouch 12y ago
  eBay was down earlier, but I have no idea if this was the reason.
- thathonkey 12y ago
  Big websites would host jQuery themselves typically on their own CDN.
josho 12y ago
This reminds me of a Microsoft research paper* "It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives." * http://msdn.microsoft.com/en-us/magazine/hh288087.aspx http://msdn.microsoft.com/en-us/magazine/hh288087.aspx
peterwwillis 12y ago
Good news! They renewed the certificate...... For one year. facepalm
Zikes 12y ago
Are there any proposals for a local CDN-like caching system capable of handling these sorts of "universal resources"? I understand the difficulties would be many (trusted sources, versioning, etc.) but I bet it would have a huge impact on the overall web's bandwidth consumption if a page could say "load standard jQuery v1.10.2 on this page, if not cached find it here or here".
html5web 12y ago
Why you guys talking about minuses of jQuery? Donate some bucks to jQuery creators instead.
Justanothernate 12y ago
Here's a post on stack overflow from July 30, 2012. Looks like the same thing happened 2 years ago. Not sure why they renewed it for only 1 year again considering it's expired twice in 2 years. http://stackoverflow.com/questions/11726451/ajax-call-to-rest-api-in-jquery-no-longer-works-caused-by-expired-ssl-certifica http://stackoverflow.com/questions/11726451/ajax-call-to-res...

52 points by rcconf 12y ago

rcconf 12y ago

This brought down our website. Lesson learned, host your own JavaScript.

dtech 12y ago
Or use a CDN you have more trust in, like Google's.

getdavidhiggins 12y ago

http://code.jque.re/ http://code.jque.re/

BradRuderman 12y ago

please fix asap!

Zergy 12y ago
Wouldn't this be solved by hosting it on your own site?
- mhogomchungu 12y ago
  I assume that will work,but it will introduce two problems. 1. Keep a local copy means you will be the one paying for the bandwidth to serve it. 2. You will have to manually update your local copy everytime upstream makes improvements. Having things locally increases reliability but it carries its own costs.
  - kcbanner 12y ago
    How is getting upstream "improvements" without having a chance to test them a good thing?
    - danielweber 12y ago
      "Users want and demand a rich computing experience."[1] [1] http://catless.ncl.ac.uk/Risks/18.85.html#subj6 http://catless.ncl.ac.uk/Risks/18.85.html#subj6
  - krisdol 12y ago
    But a minified library is loaded once per visitor (then cached) and is lilely is not going to have a greater bandwidth impact than any one of your actual pages. My site surprisingly breaking without me making changes to it (whether due to third party unreliability, security issues with their server, or surprise updates) sounds like a really, really bad thing.
  - wdewind 12y ago
    No these are not the reasons: 1. This cost is minimal, and most of the time will be served from cache anyway. I'd be willing to stake a claim that literally zero people ever have worried about the cost of serving jQuery when they weren't already worried about the cost of serving a bunch of other shit that eliminating just jQuery wouldn't fix. 2. This is completely undesirable, and doesn't happen anyway because you like to a specific version which does not change from under you. The arguments in favor of hosting it on a CDN like googles are: 1) Clients who visit other sites will precache the file, so there is a chance they wont even need to load jQuery at all, and this can increase perf 2) Pushing some files to different domains can decrease load times because browsers can load files from multiple domains in parallel instead of serially like they would from one domain. 3) For smaller sites the google CDN is likely actually more dependable than your own. But if you've invested in a CDN this is no longer true.
  - tlianza 12y ago
    #2 isn't solved with a CDN since you'd always hotlink a specific version - the version you tested your code with. The main reason I think isn't even really #1 (cost) but a general assumption that CDNs are faster than your servers, and the chance that if multiple sites are sharing one of these CDNs, you actually have first-time users who can visit your site a bit faster because they already have that resource cached.
    - Zikes 12y ago
      Some CDNs like Google's will let you specify just the major version, so in the case of jQuery it would serve 1.<latest> or 2.<latest>. Generally undesirable in a production environment, though.
  - BlakePetersen 12y ago
    Paying for jQ bandwidth is like paying for air, seriously. With jQ, you're most likely defining the version you need, so getting upstream improvements with jQ is a bit more involved than the library simply updating itself if you aren't using the edge version. A better argument for using a CDN is that jQ library is likely going to be cached if the user's been on the web for more than 5 minutes. Chances are, your version will be one that's cached and, instead of waiting for the downloading of a library that already exists on the users system, the library is immediately loaded and perceived PLT is decreased as a result. There are also numerous CDNs out there, I would use a fallback stack to ping the next CDN in line as it would be a cold day if every major CDN that hosts jQ were to lose SSL support for a time.
  - bdcravens 12y ago
    You will have to manually update your local copy everytime upstream makes improvements. Isn't this true of every library, framework, language, kernel, etc, that drives websites?
  - bdcravens 12y ago
    Keep a local copy means you will be the one paying for the bandwidth to serve it. This should never be a consideration. It's not really stealing bandwidth, since all are welcome to download, but the idea that an asset my site (which presumably makes money) needs should be paid for by someone else really is in the same ballpark ethically.

edftw 12y ago

just took down our site - can't sign up users

ihsw 12y ago

Why not use Google's CDN? https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.m...

Zikes 12y ago
Because you'd still be putting your web site in someone else's hands. http://www.sslshopper.com/article-ssl-certificate-renewal-even-google-forgets.html http://www.sslshopper.com/article-ssl-certificate-renewal-ev...
StoryboardThat 12y ago
Google doesn't host jquery migrate
donpdonp 12y ago
Or for that matter, why not use any of the other CDNs that host jQuery? http://cdnjs.com/ http://cdnjs.com/ http://www.jsdelivr.com/ http://www.jsdelivr.com/ http://www.asp.net/ajaxlibrary/cdn.ashx http://www.asp.net/ajaxlibrary/cdn.ashx
fourstar 12y ago
Because not everyone requires jQuery with a script tag. Especially with require/common.js.
danielweber 12y ago
I am some kind of weird mutant because I consider having external javascript on my website to be an embarrassment for anything bigger than a hobby project -- but 99% of the universe behaves otherwise.
- UnoriginalGuy 12y ago
  That's because the other 99% understands how browser caching works. If you use JQuery.com, Google, or Microsoft's CDNs then MOST of the time users won't have to download a JQuery/Boostrap/etc library as the browser would already have an unexpired cache of it. For example, the OP's link's cache will expire (theoretically) in the year 2079. So if a user visited ANY page that utilises JQuery v1.10.2 they already have it. That is a HUGE win. It is an even huger win for mobile (e.g. for small sites you could cut your network traffic in half, which in turn increases loading speed). It is also trivial to set it up so the page tries the CDN first and if that fails then grab a local copy e.g. <script src="//code.jquery.com/jquery-1.10.2.js"></script> <script>window.jQuery || document.write('<script src="lib/jquery-1.10.2.js">\x3C/script>')</script>

dtech 12y ago

Wow, how can a prominent internet library that advises its users to use this server make such an avoidable rookie mistake...

nobodysfool 12y ago
Well, because chances are they gave the job of renewing the certificates to the rookie, and he may not have known how to do it, or raised the issue multiple times and nobody knew the implications of it. I know the last place I worked at, I mentioned that the certificates were expiring, and I needed to pay to renew them, yet they didn't seem to care until our customers couldn't connect anymore.

0x0 12y ago

Would the standard local js fallback pattern solve this? <script>window.jQuery || document.write('<script src="js/jquery-2.0.0.min.js">\x3C/script>')</script>

gprasanth 12y ago
Indeed! it's shipped as standard in html5 boilerplate code https://github.com/h5bp/html5-boilerplate/blob/c3a72ff882104a1abc6ed05f5ca3eabb11c08a51/index.html#L25 https://github.com/h5bp/html5-boilerplate/blob/c3a72ff882104...
deleted 12y ago
[deleted]

hayksaakian 12y ago

Is there a public acknowledgement of the problem?

yuhong 12y ago
https://twitter.com/jquery/status/494922194351181824 https://twitter.com/jquery/status/494922194351181824

dm2 12y ago

CloudFlare CDN: http://cdnjs.com/libraries/jquery http://cdnjs.com/libraries/jquery I use to use the Google CDN but cdnjs.com has a huge amount of javascript libraries hosted on it and it is usually updated faster.

abimaelmartell 12y ago

Any "big" website is broken because of this?

slouch 12y ago
eBay was down earlier, but I have no idea if this was the reason.
thathonkey 12y ago
Big websites would host jQuery themselves typically on their own CDN.

josho 12y ago

This reminds me of a Microsoft research paper* "It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives." * http://msdn.microsoft.com/en-us/magazine/hh288087.aspx http://msdn.microsoft.com/en-us/magazine/hh288087.aspx

peterwwillis 12y ago

Good news! They renewed the certificate...... For one year. facepalm

Zikes 12y ago

Are there any proposals for a local CDN-like caching system capable of handling these sorts of "universal resources"? I understand the difficulties would be many (trusted sources, versioning, etc.) but I bet it would have a huge impact on the overall web's bandwidth consumption if a page could say "load standard jQuery v1.10.2 on this page, if not cached find it here or here".

html5web 12y ago

Why you guys talking about minuses of jQuery? Donate some bucks to jQuery creators instead.

Justanothernate 12y ago

Here's a post on stack overflow from July 30, 2012. Looks like the same thing happened 2 years ago. Not sure why they renewed it for only 1 year again considering it's expired twice in 2 years. http://stackoverflow.com/questions/11726451/ajax-call-to-rest-api-in-jquery-no-longer-works-caused-by-expired-ssl-certifica http://stackoverflow.com/questions/11726451/ajax-call-to-res...