Hacker News Reader

are people doing this? What's the attack surface of a private hosted JS library vs. a well known TLS/SSL secured CDN for JS libraries? Threats are not restricted to CDNs.

View on HN

Security theater, nerd-style.

CDNs are much more reliable than your avg. 'stuff.com' hosted js. It shouldn't be an issue

That would depend on what CDN you use and how it works. If the CDN is just a caching CDN in front of your own site then the CDN typically won't be any more secure than your own site.

This is a falsehood i've seen repeated over and over.

CDN's fail. You already have a connection to the 'stuff.com' self-hosted js. If your site is up but the cdn breaks you have another problem.

Also the perf win for using a shared cdn version of for instance jquery is totally overstated. See discussions here too: https://news.ycombinator.com/item?id=11549131

Thanks, I stand corrected

Reply on news.ycombinator.com