7 ms·

How Google’s CDN prevents your site from loading in China

50 points by anubiann00b 12y ago

cornewut 12y ago
It's not like Google is blocking something. Google is blocked by China.
scrollaway 12y ago
Linkbait title aside, this is a pretty good argument in favour of graceful degradation for scriptless pages. If the JS libraries/cdn/what not you deal with are on a CDN which is down for whatever reason (be it blocked, temporarily offline or "I forgot to pay them"), it's important for your site not to block on the requests and to display the text content your users want in a readable format. We're not talking "web 3.0 apps" here, we're talking documents - news articles, "Contact Us" pages on a company site, etc. It's also one of the scarier downsides of centralized CDNs. It's too easy for a single site to get blocked or go down temporarily and suddenly, thousands of websites become unaccessible. And this is not a situation we can keep brushing off for long, there is a real need for decentralized solutions.
deleted 12y ago
[deleted]
- tnuc 12y ago
  Not cooperating? The blocking done at a decentralized level as is imposed by the central government. You can read the policy documents in English if you look around. This is why sometimes sites work in one part of China and not in another. And sometimes the firewall will go down for periods of time. The telecoms cooperate with Chinese government as much as they need to, in much the same way Google and other cooperate with the NSA.
  - jrkatz 12y ago
    jhancock was referring to cooperation between telecoms, not cooperation between telecoms and the government.
kbar13 12y ago
google fonts alternative = https://github.com/alfredxing/brick https://github.com/alfredxing/brick
- thoughtpalette 12y ago
  Thanks for that! I have not seen this one come up.
tnuc 12y ago
The problem is that most things hosted by Google resolve to ghs.google.com. Given that China blocks sites that it doesn't like by simple dns then all Google hosted content is blocked. And of course Google blocks sites hosted from being seen in places like North Korea, Iran, Cuba, Syria, etc. due to the way that Google enforces U.S. sanctions. Google is not alone on this.
ycombinatoracc 12y ago
Please drop the doublespeak for the title, it should be re-titled as "How China is blocking Google CDN"
realusername 12y ago
It's partially related but something I would really like to have is a cross-website cache for public scripts. Around 80% of the size of the scripts is public libraries used by almost everyone (jquery, bootstrap, moment.js, various jquery plugins, angular...) and each of them is downloaded thousands of times. One simple solution could be something like this: <script type="text/javascript" src="/js/jquery.min.js" public="sha1:356a192b7913b04c54574d18c28d46e6395428ab"> This way the browser can have a look at the hash and not query the file at all. This could not lead to security issues since the hash saved by the browser is not the hash displayed but the one computed with the actual file. (and obviously you are only using the public attribute for scripts which are meant to be public). With this technique, the most popular libraries could be cached and not downloaded by users.
- yeldarb 12y ago
  That would be really neat. It could also solve a security issue with public CDNs. Right now there's nothing to stop a malicious CDN from changing the content of an included script on your site without you knowing it. With a hash tag like this the browser could refuse to load the file or warn the user if it didn't match.
  - sp332 12y ago
    You could have a small JS snippet on the page (served from your own domain) that checks the hash of the JS loaded from a CDN before running it.
    - bduerst 12y ago
      That would work well for most, until the /jquery-latest.min.js or whatever is updated to the newest, latest release. But that would also be a problem with the browser based solution. The question then is - how do you distribute the trusted hash? Maybe there should be an independent organization or website that serves trusted hashes for common or registered libraries and files.
      - 12y ago
azinman2 12y ago
Why does the "fix" have to be the cdn versus China itself? Why is that being ignored as the real issue?
- lnanek2 12y ago
  And a web developer is going to change China how?
- IanCal 12y ago
  Shouldn't we design systems to not be susceptible to this kind of problem rather than just asking everyone to be nice? A similar issue would be for one of the CDNs to go down, this isn't just a problem with censorship.
- untog 12y ago
  Pragmatism? If you want your web site to be viewable in China you can a) change a URL b) campaign for open internet access in China which one is likely to be more effective?
lnanek2 12y ago
Every time I've talked to a business that wants a web site or server backed software product for Chinese users, they've said the server has to be in China. This is why. Even when you do manage to get a request out, it is often laggy and worthless from a UX perspective. Linking out of the country for resources needed to load the page is just ignorant.
crishoj 12y ago
Simple solution: Host JS libs on a HTTPS domain that China cannot afford to block, e.g. GitHub. See https://greatfire.org https://greatfire.org for a practical take on this approach.
- jdbernard 12y ago
  I don't understand. If China can afford to block Google, why wouldn't the be able to afford blocking GitHub?
  - final 12y ago
    Because in OP's world GitHub is very important, and he believes Chinese bureaucrats are like him. I currently do consulting work for a Fortune 20 corporation and their firewall blocks cloning of Github repositories. They have over a thousand developers on site ... I'm thinking of writing a scraper, that clones from the Web pages, which do open.
- spacehunt 12y ago
  There is no such thing as a site which China cannot afford to block. GitHub has been blocked from time to time.
final 12y ago
Or maybe just use the standard fonts and don't use a CDN. 99.99999% of the sites on the internet gain very little from CDN. Yeah it's a cool technology, it's nice to pretend you're important, but in the end CDN is an expensive (in complexity and risks) toy.
cj 12y ago
> I’m not sure of a good alternative to Google Fonts though. Is Adobe's Typekit blocked?

50 points by anubiann00b 12y ago

It's not like Google is blocking something. Google is blocked by China.

Linkbait title aside, this is a pretty good argument in favour of graceful degradation for scriptless pages. If the JS libraries/cdn/what not you deal with are on a CDN which is down for whatever reason (be it blocked, temporarily offline or "I forgot to pay them"), it's important for your site not to block on the requests and to display the text content your users want in a readable format. We're not talking "web 3.0 apps" here, we're talking documents - news articles, "Contact Us" pages on a company site, etc. It's also one of the scarier downsides of centralized CDNs. It's too easy for a single site to get blocked or go down temporarily and suddenly, thousands of websites become unaccessible. And this is not a situation we can keep brushing off for long, there is a real need for decentralized solutions.

deleted 12y ago

[deleted]

tnuc 12y ago
Not cooperating? The blocking done at a decentralized level as is imposed by the central government. You can read the policy documents in English if you look around. This is why sometimes sites work in one part of China and not in another. And sometimes the firewall will go down for periods of time. The telecoms cooperate with Chinese government as much as they need to, in much the same way Google and other cooperate with the NSA.
- jrkatz 12y ago
  jhancock was referring to cooperation between telecoms, not cooperation between telecoms and the government.

kbar13 12y ago

google fonts alternative = https://github.com/alfredxing/brick https://github.com/alfredxing/brick

thoughtpalette 12y ago
Thanks for that! I have not seen this one come up.

tnuc 12y ago

The problem is that most things hosted by Google resolve to ghs.google.com. Given that China blocks sites that it doesn't like by simple dns then all Google hosted content is blocked. And of course Google blocks sites hosted from being seen in places like North Korea, Iran, Cuba, Syria, etc. due to the way that Google enforces U.S. sanctions. Google is not alone on this.

ycombinatoracc 12y ago

Please drop the doublespeak for the title, it should be re-titled as "How China is blocking Google CDN"

realusername 12y ago

It's partially related but something I would really like to have is a cross-website cache for public scripts. Around 80% of the size of the scripts is public libraries used by almost everyone (jquery, bootstrap, moment.js, various jquery plugins, angular...) and each of them is downloaded thousands of times. One simple solution could be something like this: <script type="text/javascript" src="/js/jquery.min.js" public="sha1:356a192b7913b04c54574d18c28d46e6395428ab"> This way the browser can have a look at the hash and not query the file at all. This could not lead to security issues since the hash saved by the browser is not the hash displayed but the one computed with the actual file. (and obviously you are only using the public attribute for scripts which are meant to be public). With this technique, the most popular libraries could be cached and not downloaded by users.

yeldarb 12y ago
That would be really neat. It could also solve a security issue with public CDNs. Right now there's nothing to stop a malicious CDN from changing the content of an included script on your site without you knowing it. With a hash tag like this the browser could refuse to load the file or warn the user if it didn't match.
- sp332 12y ago
  You could have a small JS snippet on the page (served from your own domain) that checks the hash of the JS loaded from a CDN before running it.
  - bduerst 12y ago
    That would work well for most, until the /jquery-latest.min.js or whatever is updated to the newest, latest release. But that would also be a problem with the browser based solution. The question then is - how do you distribute the trusted hash? Maybe there should be an independent organization or website that serves trusted hashes for common or registered libraries and files.
    - 12y ago

azinman2 12y ago

Why does the "fix" have to be the cdn versus China itself? Why is that being ignored as the real issue?

lnanek2 12y ago
And a web developer is going to change China how?
IanCal 12y ago
Shouldn't we design systems to not be susceptible to this kind of problem rather than just asking everyone to be nice? A similar issue would be for one of the CDNs to go down, this isn't just a problem with censorship.
untog 12y ago
Pragmatism? If you want your web site to be viewable in China you can a) change a URL b) campaign for open internet access in China which one is likely to be more effective?

lnanek2 12y ago

Every time I've talked to a business that wants a web site or server backed software product for Chinese users, they've said the server has to be in China. This is why. Even when you do manage to get a request out, it is often laggy and worthless from a UX perspective. Linking out of the country for resources needed to load the page is just ignorant.

crishoj 12y ago

Simple solution: Host JS libs on a HTTPS domain that China cannot afford to block, e.g. GitHub. See https://greatfire.org https://greatfire.org for a practical take on this approach.

jdbernard 12y ago
I don't understand. If China can afford to block Google, why wouldn't the be able to afford blocking GitHub?
- final 12y ago
  Because in OP's world GitHub is very important, and he believes Chinese bureaucrats are like him. I currently do consulting work for a Fortune 20 corporation and their firewall blocks cloning of Github repositories. They have over a thousand developers on site ... I'm thinking of writing a scraper, that clones from the Web pages, which do open.
spacehunt 12y ago
There is no such thing as a site which China cannot afford to block. GitHub has been blocked from time to time.

final 12y ago

Or maybe just use the standard fonts and don't use a CDN. 99.99999% of the sites on the internet gain very little from CDN. Yeah it's a cool technology, it's nice to pretend you're important, but in the end CDN is an expensive (in complexity and risks) toy.

cj 12y ago

> I’m not sure of a good alternative to Google Fonts though. Is Adobe's Typekit blocked?