They says "secure" but it's trusting the website to not deliver malicious JS. Also trusting the numerous third party domains that javascript is included from (and if you block them the entire thing breaks).
There's no reason he can't host all of these javascript resources on the same domain, substantially reducing the attack surface area.
I know people like to use CDNs and third party hosted analytics software, but can we at least come to the compromise that if you're going to say your app is "secure" or "private", that you at least attempt to host what you can on your own domain...
[edit] I'm probably being unfair. He makes the code available so you can host it yourself. I'm sure most people who install it will leave the CDNs in place though.
Is there any way to initiate transfers between two browsers over WebRTC without the use of a server?
Since you asked: https://github.com/cjb/serverless-webrtc/
Lets say you have 500kb of compressed js. If you have 2 million unique visitors, that'll just eat 1TB of bandwidth -- and if you don't screw up your own cache headers -- that'll be that -- it'll be cached.
Seems like a low-impact way to significantly boot the usefulness + security of CDN's. If the source page (requested over https, and presumedly not MITM'ed already) declares "I want to load that resource over there, and I expect it to hash to this value", then we get all the benefits of caching + trust that it has not been tampered.