Hacker News Reader

Comment by nthitz | Hacker News Reader

Wow, impressive. Let's hope the jQuery sources and CDNs never get compromised!

It's interesting and slightly scary the CDN issue. Several months ago when there was an issue with Google's CDN, an awful lot of websites fell over as they never had a local backup in place.

Hopefully as jQuery usage grows people come to understand the need for fallbacks.

especially when it's trivial to implement

    <script src="//ajax.googleapis.com/ajax/libs/jquery/1.8.0/jquery.min.js"></script>
    <script type="text/javascript">
    if (typeof jQuery == 'undefined') { document.write(unescape("%3Cscript src='/path_to_scripts/js/libs/jquery-1.8.0.min.js' type='text/javascript'%3E%3C/script%3E"));}
    </script>

Is it really that big of a perf hit to just download the minified and use it in your source like all other libs? jq isn't that big of beast, plus if you have a large site its cached for every other page visit :)

> if you have a large site its cached for every other page visit

until you modify your own js (not that rare and uncommon) and it's back new and shiny again. from the cdn, it's just already there sitting in the browser's cache.

> Is it really that big of a perf hit

maybe not, but if you had the option to wake up with your teeth already brushed, wouldn't you take it? :D

You don't need to use unescape in the fallback

    if(!jQuery)document.write('<script src="jquery.js"></scrip'+'t>');

They don't even have to get compromised to mess up the web. Too many sites point their jQuery src to the latest version, so just wait for jQuery 2.0 to come out and see how many IE 6/7/8 users complain. http://blog.jquery.com/2012/06/28/jquery-core-version-1-9-an...

yeah that wouldn't be fun, but maybe we could make a browser add-on to check for the md5 checksum, not a security expert here but sounds like a solution to me

MD5 is not acceptable for this purpose since it's possible to create source with the same MD5 as the original. It would need a different hash at a minimum.

I'm not sure what you mean by this. mrpollo recommended using MD5 as a checksum before executing jQuery to ensure that the CDN hasn't been compromised. For instance jQuery 1.8.0's checksum is cd8b0bffc85bb5614385ee4ce3596d07. I was under the impression that MD5 isn't malleable enough to create a non-trivial malicious script with the same hash.

As of right now there are no practical preimage attacks on MD5, but people keep expecting one.

It's better to switch to something else and not have to worry about it.

Your impression is incorrect. Quoting one researcher, "Our intent is to raise awareness that MD5 is broken so drastically that its continued use in digital signature schemes and certificates poses realistic threats." See also http://en.wikipedia.org/wiki/MD5 .

I am no expert. It may be that MD5 is still relatively secure for this specific task. However, SHA2 is more secure. Use that instead.

Yes, it does raise the "herd of cloned sheep" question.

But I wouldn't worry too much. It's open source, and using the hosted version means that only that one copy has to be fixed. It is unlikely to ever be a problem on the scope of, e.g., out-of-date Wordpress installs.

Of one of those major CDNs get hacked (rather than fail on accident), the problem will be far worse than some outdated Wordpress blogs.

I was thinking a cool Chrome extension might be to preload all the major javascript libraries (jquery, etc.) and change any external extension references to the preloaded ones. I'm not sure how much of a speedup this would offer but certainly it would be something.

Not unless you are 1. visiting a lot of sites for the 1st time that use these libraries and/or 2. frequently clear your browser cache.

Your browser caches the libraries on first load anyway.

Reply on news.ycombinator.com