3 ms·
It's very sobering to think of all the havoc that would cause. Is it still best practice to call your jq up from the jquery cdn?
by dccoolgai 12y ago
It's very sobering to think of all the havoc that would cause. Is it still best practice to call your jq up from the jquery cdn?
- Igglyboo 12y agoNot sure about the jQuery CDN but where I work it's best practice to serve it from Google's CDN. Probably should rethink that.
- tripzilch 12y agoReading this news, I was wondering, whether from a security POV, including jQuery from Google's CDN rather than jQuery's own would be better. My reasoning was that Google is bigger, therefore probably has better security. They also need very similar technology for securing the AdSense includes. Finally, if someone manages to compromise Google, there might be bigger problems than hosting a malware-d jQuery (although that would be pretty big). It's not a very convincing reason, risk-wise, IMO. I'm assuming that jQuery should be pretty on top of the security of their CDN. Also that proposed new hash/integrity attribute for the SCRIPT tag seems way more promising.
- josephlord 12y agoYou do however leak information to Google about your customers browsing behaviour. If you are using Google Analytics you obviously do that to an even greater degree anyway so there is no further harm for most users but it is more likely to be blocked by me and I always block Google Analytics.