Hacker News Reader

In case it's of any help to you, I use https://github.com/Synzvato/decentraleyes which had 2 of these 3 CDNs cached. And the 3rd (unpkg - an npmjs.com mirror) seemed not to be a hard requirement as far as I could tell.

are people doing this? What's the attack surface of a private hosted JS library vs. a well known TLS/SSL secured CDN for JS libraries? Threats are not restricted to CDNs.

Security theater, nerd-style.

CDNs are much more reliable than your avg. 'stuff.com' hosted js. It shouldn't be an issue

This is a falsehood i've seen repeated over and over.

CDN's fail. You already have a connection to the 'stuff.com' self-hosted js. If your site is up but the cdn breaks you have another problem.

Also the perf win for using a shared cdn version of for instance jquery is totally overstated. See discussions here too: https://news.ycombinator.com/item?id=11549131

Thanks, I stand corrected

That would depend on what CDN you use and how it works. If the CDN is just a caching CDN in front of your own site then the CDN typically won't be any more secure than your own site.

You have subresource integrity. If in use, that only leaves the privacy implications of using a CDN.