Hacker News Reader

Comment by aw3c2 | Hacker News Reader

I see no privacy policy so you have to assume that they will log all they can about your visitors.

In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself.

View on HN

> In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself.

I still wish there was a "hash" attribute to script tags (and others) so that browsers could cache common JS/CSS/etc assets cross-domain.

I've been wanting this for a while now. The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes. But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest

Ugh. This proposal also suggests using "magic comments" in scripts, which needs to die. They will get stripped by things like pagespeed and various acceleration proxies, completely outside the developers control.

shouldn't it be something like <script src="blah" data-hash-sha512="...">?

If the hash was SHA-512 wouldn't that be hard?

Agreed, especially a third party provide of javascript! It would be absolutely trivial for them to inject highly invasive tracking code into your site, or worse.

I'm not saying they will, but really it doesn't make sense to take the risk.

I think the assets are served via cookie less connection.

    prasanth:~/ $ http get http://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.1/jquery.min.js                                           [18:22:12]
    HTTP/1.1 200 OK
    Access-Control-Allow-Origin: *
    CF-Cache-Status: HIT
    CF-RAY: 13f0d5579cd70bab-HKG
    Cache-Control: public, max-age=30672000
    Connection: keep-alive
    Content-Encoding: gzip
    Content-Type: application/javascript
    Date: Mon, 23 Jun 2014 12:54:17 GMT
    Expires: Sat, 13 Jun 2015 12:54:17 GMT
    Last-Modified: Thu, 01 May 2014 17:45:11 GMT
    Server: cloudflare-nginx
    Transfer-Encoding: chunked
    Vary: Accept-Encoding

Edit: found this other thread[1] where the above is not true for cloudflare customers.

[1] - https://news.ycombinator.com/item?id=4912134

CloudFlare WWW developer here: since that thread we fixed our GA inserts on our web properties and turned off the usual CDN cookies for CDNJS.

Reply on news.ycombinator.com