Live data from Hacker News

Microsoft's Ajax CDN tumbles worldwide

zdnet.com

11–20 of 46 posts

Re: Microsoft's Ajax CDN tumbles worldwide

#11
post #3

More generally, I have never understood why people use these third party CDNs for important sites. Don't get me wrong, I understand the bullet points that the Microsoft's and Google's trot out: User more likely to have it cached, more simultaneously open connections since it's a different domain, perhaps less latency etc. But the simple fact of the matter is if the CDN goes down, your site essentially goes down. Ever…

I think the idea is that hosts like Google (and ostensibly, Mircosoft) are going to have availability that far exceeds your run-of-the-mill website. Those big hosts generally are going to provide five 9's (or more) availability, whereas %your_random_site% is probably going to be on the order of three to four 9's, at best. So more often than not, the point of failure is going to be your website...not the CDN.

If you have the infrastructure ($$$) to support your own web services on the order of 99.999%+, then by all means host it yourself, otherwise you're most likely never going to have a problem with it (especially if you include a fallback method).

Re: Microsoft's Ajax CDN tumbles worldwide

#12
post #7

Earlier quoted context omitted.

CDN, with local fallback: window.jQuery || document.write(unescape('%3Cscript src="/scripts/jquery-1.x.x.min.js"%3E%3C/script%3E'))

This is what we had, but it wasn't responding quickly enough, so the site was hanging despite the fallback.

You could probably wire something up in JS to handle it with reduced timeouts, e.g. an AJAX call that automatically fails after 50-100ms and proceeds to load the local version.

Re: Microsoft's Ajax CDN tumbles worldwide

#13
post #11
post #3

More generally, I have never understood why people use these third party CDNs for important sites. Don't get me wrong, I understand the bullet points that the Microsoft's and Google's trot out: User more likely to have it cached, more simultaneously open connections since it's a different domain, perhaps less latency etc. But the simple fact of the matter is if the CDN goes down, your site essentially goes down. Ever…

I think the idea is that hosts like Google (and ostensibly, Mircosoft) are going to have availability that far exceeds your run-of-the-mill website. Those big hosts generally are going to provide five 9's (or more) availability, whereas %your_random_site% is probably going to be on the order of three to four 9's, at best. So more often than not, the point of failure is going to be your website...not the CDN. If you h…

I agree completely that your average website will have less uptime than the CDN. The problem isn't that the CDNs are less reliable, it's that it's VERY unlikely that your site will experience downtime at the same time as the CDN. This means your site reliability is the combination of the downtime of the CDN as well as your own.

Re: Microsoft's Ajax CDN tumbles worldwide

#14
post #11
post #3

More generally, I have never understood why people use these third party CDNs for important sites. Don't get me wrong, I understand the bullet points that the Microsoft's and Google's trot out: User more likely to have it cached, more simultaneously open connections since it's a different domain, perhaps less latency etc. But the simple fact of the matter is if the CDN goes down, your site essentially goes down. Ever…

I think the idea is that hosts like Google (and ostensibly, Mircosoft) are going to have availability that far exceeds your run-of-the-mill website. Those big hosts generally are going to provide five 9's (or more) availability, whereas %your_random_site% is probably going to be on the order of three to four 9's, at best. So more often than not, the point of failure is going to be your website...not the CDN. If you h…

I'm not sure I follow. Obviously if my host goes down my entire site will go down - this is not the point. The point is that when my host is up, what % of the time will my site still be down? Well if you use a CDN that % is greater than zero. If you use two CDN's the percentage is compounded.

Re: Microsoft's Ajax CDN tumbles worldwide

#15
post #11
post #3

More generally, I have never understood why people use these third party CDNs for important sites. Don't get me wrong, I understand the bullet points that the Microsoft's and Google's trot out: User more likely to have it cached, more simultaneously open connections since it's a different domain, perhaps less latency etc. But the simple fact of the matter is if the CDN goes down, your site essentially goes down. Ever…

I think the idea is that hosts like Google (and ostensibly, Mircosoft) are going to have availability that far exceeds your run-of-the-mill website. Those big hosts generally are going to provide five 9's (or more) availability, whereas %your_random_site% is probably going to be on the order of three to four 9's, at best. So more often than not, the point of failure is going to be your website...not the CDN. If you h…

If your webserver is down what does it matter that the CDN that hosts your library scripts is up?

Re: Microsoft's Ajax CDN tumbles worldwide

#16
If anyone still needs convincing these CDN'd JS lib are a bad design pattern, check out this presentation from 2012's Black Hat (and also DEFCON) on MITM attacks on them that persist after the user has been exposed (due to indefinite caching of poisoned JS files).

http://media.blackhat.com/bh-us-12/Briefings/Alonso/BH_US_12..., or https://www.youtube.com/watch?v=ZCNZJ_7f0Hk (quite entertaining presentation)

the tl:dr is users browse a short time via an anonymous proxy (c'mon, many do), the proxy MITM's these CDN's JS lib requests and serves up poisoned versions that work but also check a mothership server to load in further poisoned + persistently cached JS files for popular websites (banking, facebook, etc). User then ends their proxy session but future visits (even direct, not via proxy) to sites loads in the now cached poisoned JS libs. Phishing, credential theft, clipboard theft, etc is all now possible

Re: Microsoft's Ajax CDN tumbles worldwide

#17
post #3

More generally, I have never understood why people use these third party CDNs for important sites. Don't get me wrong, I understand the bullet points that the Microsoft's and Google's trot out: User more likely to have it cached, more simultaneously open connections since it's a different domain, perhaps less latency etc. But the simple fact of the matter is if the CDN goes down, your site essentially goes down. Ever…

This was what I was going to suggest also... but...

Whatever happened to using progressive enhancement techniques which meant the site would continue to work, albeit with basic functionality, for users even without JavaScript?

I understand for some sites this is not possible, but for a lot of sites it would be perfectly acceptable...

Re: Microsoft's Ajax CDN tumbles worldwide

#18
post #3

More generally, I have never understood why people use these third party CDNs for important sites. Don't get me wrong, I understand the bullet points that the Microsoft's and Google's trot out: User more likely to have it cached, more simultaneously open connections since it's a different domain, perhaps less latency etc. But the simple fact of the matter is if the CDN goes down, your site essentially goes down. Ever…

CDN, with local fallback: window.jQuery || document.write(unescape('%3Cscript src="/scripts/jquery-1.x.x.min.js"%3E%3C/script%3E'))

Don't use unescape, is ugly and is not required if you break the close tag of "script".

    this.jQuery||document.write('')

Re: Microsoft's Ajax CDN tumbles worldwide

#19
post #16

If anyone still needs convincing these CDN'd JS lib are a bad design pattern, check out this presentation from 2012's Black Hat (and also DEFCON) on MITM attacks on them that persist after the user has been exposed (due to indefinite caching of poisoned JS files). http://media.blackhat.com/bh-us-12/Briefings/Alonso/BH_US_12... , or https://www.youtube.com/watch?v=ZCNZJ_7f0Hk (quite entertaining presentation) the tl:d…

How often does your average user browse via an anonymous proxy? I doubt most would even know what the hell you are talking about. I can understand for your more clued up or power user, but you give the average user too much credit.

Re: Microsoft's Ajax CDN tumbles worldwide

#20
post #3

More generally, I have never understood why people use these third party CDNs for important sites. Don't get me wrong, I understand the bullet points that the Microsoft's and Google's trot out: User more likely to have it cached, more simultaneously open connections since it's a different domain, perhaps less latency etc. But the simple fact of the matter is if the CDN goes down, your site essentially goes down. Ever…

CDN, with local fallback: window.jQuery || document.write(unescape('%3Cscript src="/scripts/jquery-1.x.x.min.js"%3E%3C/script%3E'))

If you do overall page loading times, I wonder what sort of averages you will see comparing this to hosting it locally for all requests.

When hosted locally it would result in 1 less DNS lookup, as well it could reuse an open HTTP connection to fetch the resource.

Post reply on HN