Hacker News Reader

Third-party CDN usage like this isn’t a best parctice generally if it can be avoided because it involves users need to trust more parties and leaks user data to those sources. With the advent of assets being isolated a couple of years ago, there's no performance/chaching benefit to it anymore either.

View on HN

Also: if the CDN for some reason is non-functional it impacts the reliability of your service. That might be a short outage or a complete shutdown of the server.

Unless you plan to monitor that stuff constantly and unless you tested your program with single components (or all possible permutations) missing, hosting these yourself might be the better option anyways.

Additionally your users don't signal their visit of your page to a hundred other servers which certainly isn't the most trustworthy behaviour.

I hear you folks. I’ll add an option for local assets.

That should be the default for security/privacy. It's better to have a CSP with just first-party trust too.

Reply on news.ycombinator.com