Hacker News Reader

Comment by mey | Hacker News Reader

My security conscious nature has always been distrustful of using a public cdn. It represents a potential security and privacy concern to my clients. It'd be an interesting attack vector to inject malicious javascript code into a wide pool of sites at once. It is also an operational concern that these systems are going to continue operating for the long term or not suffer service interruption.

View on HN

While true, it’s would not spread that easily. Google returns in its response header of e.g. jquery: "Expires:Fri, 21 Nov 2014 00:46:46 GMT"

As long as this file is in my cache, my browser won’t request it again for a year, independent what happened to it in the meantime.

> or not suffer service interruption

Preventing that is actually quite easy

    <script src="//cdn/jquery.js"></script>
    <script>window.jQuery || document.write('<script src="local/jquery.js">\x3C/script>')</script>

(a slightly more complex solution would be needed if the CDN is timing out instead of return an error)

If it is in the cache, why is the CDN needed anyways?

also, if it was not... now the malicious one is. forever.

Using a centralized cdn would increase the chance of a cache hit.

I'm completely skeptical about the benefit of CDNs to users.

I would like to see some hard data about the number of web sites a user visit typically to understand how this is a meaningful argument. As of now, I lean toward thinking these CDNs are just yet another way to track users.

Anyways, I block them all by default, and my browsing works just fine.

How do you "block" a CDN? Is that a mis-wording? Do you have some means to automatically discover and detect the origin servers and connect directly to them, bypassing the CDN?

And, to answer your question, the benefits are substantial, well-documented, and provable on multiple levels.

First off, a CDN (when working properly) greatly improves the average latency for browsing a site, and in some cases even the bandwidth usage. Additionally, use of a CDN can increase the number of users a site can simultaneously serve. The best CDNs can not only withstand but actively deflect various types of DOS attacks. Some can even serve resources like images and video dynamically optimized for the browsing software or device.

There are many more benefits, and believe it or not, a huge percentage of the Internet's web and media traffic flows through CDN services - bypassing all of them is near-impossible (unless you somehow don't use any of the most popular sites and services)

The main benefit isn't any of this "cached forever" business, although thats great. It's the fact that the download is coming from 1 or 2 hops away instead of all the way across the country or world.

In my experience, browsers don't cache things very aggressively. You'll re-download that file way before 2014.

Indeed, any CDN could have their servers hacked, and that would be a nightmare. But it seems that most of the biggest ones have had a reasonably (some unbelievably) good track record of preventing and protecting against such problems.

I'm not saying it hasn't happened before, or that it won't happen again, but the CDNs that it happens to and/or don't handle it with the utmost care and expertise do not survive very long.

IIRC, Twitter is also concerned about this, and recently proposed a hash-based validation for externally included resources (though I can't seem to find their proposal right now …).

Reply on news.ycombinator.com