6 ms·

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

• mayrun 11y ago
  doesnt have to be literally "hacked", just a change of the dns records is enough.
  • leni536 11y ago
    Well, once you hotlink jquery in your website at least use the https link (assuming your site is on https too).
    • nothrabannosir 11y ago
      No need; the browser will block http:// http:// included from https:// https:// pages. Including from a http:// http:// page? Then a compromised jquery cdn is the least of your worries. In short; no, just a compromised dns record is not enough.
      • mayrun 11y ago
        if it is a http:// http:// page, then even a small change in the local host file is enough.
• nly 11y ago
  I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains. I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults
  • leni536 11y ago
    The same could be told about other third party resources, like images and css files, too.
    • nly 11y ago
      Maybe, but hotlinking images has historically been considered rude at best, and theft at worst. And most people still host their own CSS because it tends to come with whatever app, or theme, they're using. In any case, the defaults I live with cover all the other web resources too.
      • leni536 11y ago
        Well, pixel tracking actually exists. http://digiday.com/platforms/explainer-why-pixel-tracking-is-increasingly-popular/ http://digiday.com/platforms/explainer-why-pixel-tracking-is...
  • danielweber 11y ago
    I've been called an idiot (even here on HN) for being paranoid about loading scripts from all over the web. I think it's a losing battle and my side is going the way of the dinosaurs.
    • bsilvereagle 11y ago
      As tools like uBlock and uMatrix get widespread adoption more and more people are realizing how much extraneous junk is being loaded by webpages. I think your side is slowly but surely gaining followers.
      • IanCal 11y ago
        Which is an interesting problem as to stop loading all these scripts I have to give another script access to everything I see.
        • bsilvereagle 11y ago
          If you download the source for uBlock/uMatrix, and run locally you avoid the auto-updating of the add-on while being able to vet the source.
          • IanCal 11y ago
            Thank you, that's an extremely good idea.
      • jdmichal 11y ago
        I use uMatrix, and I have already whitelisted loading scripts from common CDNs as global rules. They're everywhere and I found myself just constantly whitelisting them anyway. The trend for a long time was to cite using a CDN as a best practice, but no one ever calls out the downsides when making such statements. In this case, you lose control of the code and allow third-party access to your users' browsers.
        • 11y ago
  • anc84 11y ago
    > you're also potentially leaking all your visitor stats Not just potentially but (f)actually!
  • glomph 11y ago
    Could this be illegal? I mean the EU for example has pretty strict requirements on what you can do with user information.
• deleted 11y ago
  [deleted]
• fastest963 11y ago
  Which is why they're adding Subresource integrity to script tags so you can detect when a popular CDN/host is hacked and not load the script: http://w3c.github.io/webappsec/specs/subresourceintegrity/#htmlscriptelement http://w3c.github.io/webappsec/specs/subresourceintegrity/#h...
  • tarpherder 11y ago
    How would that help? The "integrity" packet is provided by the now hacked server, and thus can never provide extra security? Or am I missing something?
    • ryan-c 11y ago
      The integrity value is part of the script tag. You add a hash of the script content as a property of the script tag, and the browser only executes if it matches. I hacked together something that implements this sort of behavior in a script loader a while ago, if you're interested: https://github.com/ryancdotorg/VerifyJS https://github.com/ryancdotorg/VerifyJS
      • tarpherder 11y ago
        Ah I see, thanks for explaining. So, though this does allow one to safely circumvent the hosting cost associated with bigger third party scripts, it means giving up some of the advantages like dynamic updates (as the hash would now be incorrect), right? This would therefore not work when ad providers want to be able to supply content they get dynamically from others right?
        • ryan-c 11y ago
          Many of the CDNs will let you reference a specific version of the script. If you didn't do this, and there were an update, the script wouldn't load and you'd have to update your site. My script allows callbacks to be specified for a bad hash, so you could be notified of this, and the subresource integrity draft also mentions this as a good idea. It seems not uncommon for ad networks to dynamically load further scripts/content, which would not fall under the hash. You can just sandbox them off in an iframe, though. An obvious extension would be signed scripts, which would re-enable trusted updates of a script in a CDN, but there is the question of how that would be implemented.