Microsoft's Ajax CDN tumbles worldwide • Hacker News Board

Re: Microsoft's Ajax CDN tumbles worldwide

#31

Post by k3n » Thu, Jan 03, 2013, 4:19 PM UTC

kamjam wrote: post #19

dotBen wrote: post #16

If anyone still needs convincing these CDN'd JS lib are a bad design pattern, check out this presentation from 2012's Black Hat (and also DEFCON) on MITM attacks on them that persist after the user has been exposed (due to indefinite caching of poisoned JS files). http://media.blackhat.com/bh-us-12/Briefings/Alonso/BH_US_12... , or https://www.youtube.com/watch?v=ZCNZJ_7f0Hk (quite entertaining presentation) the tl:d…

How often does your average user browse via an anonymous proxy? I doubt most would even know what the hell you are talking about. I can understand for your more clued up or power user, but you give the average user too much credit.

Yeah that's a good point, the # of those users is going to be high in that user sampling (black hats), but very low for most of the rest of the world. I think I used an anonymous proxy back in '02 to get around a forum ban or something.

Re: Microsoft's Ajax CDN tumbles worldwide

#32

Post by k3n » Thu, Jan 03, 2013, 4:21 PM UTC

JonnieCache wrote: post #22

kamjam wrote: post #19

Earlier quoted context omitted.

How often does your average user browse via an anonymous proxy? I doubt most would even know what the hell you are talking about. I can understand for your more clued up or power user, but you give the average user too much credit.

Every time they use a public wifi hotspot. Any time you use a network you don't control and where you have no reason to trust the admin, you may as well be using a proxy. The requirement to trust the admin isn't about the admin MITMing you, but rather trusting their competency in preventing other users MITMing you. Of course the admin could be bad as well.

Yay for never using public wifi hotspots, now if I could only impress that upon the millions of Americans who do so everyday...

Re: Microsoft's Ajax CDN tumbles worldwide

#33

Post by jQueryIsAwesome » Thu, Jan 03, 2013, 4:21 PM UTC

k3n wrote: post #12

macca321 wrote: post #7

Earlier quoted context omitted.

This is what we had, but it wasn't responding quickly enough, so the site was hanging despite the fallback.

You could probably wire something up in JS to handle it with reduced timeouts, e.g. an AJAX call that automatically fails after 50-100ms and proceeds to load the local version.

A simpler solution would be to reload the page passing a parameter that you want to use other CDN; something like this: https://gist.github.com/4444636

Re: Microsoft's Ajax CDN tumbles worldwide

#34

Post by jlgreco » Thu, Jan 03, 2013, 4:23 PM UTC

JonnieCache wrote: post #22

kamjam wrote: post #19

Earlier quoted context omitted.

How often does your average user browse via an anonymous proxy? I doubt most would even know what the hell you are talking about. I can understand for your more clued up or power user, but you give the average user too much credit.

Every time they use a public wifi hotspot. Any time you use a network you don't control and where you have no reason to trust the admin, you may as well be using a proxy. The requirement to trust the admin isn't about the admin MITMing you, but rather trusting their competency in preventing other users MITMing you. Of course the admin could be bad as well.

Any time you browse via public wifi you might be being fucked with. How often are you actually? My wager, depending on setting, very rarely.

Re: Microsoft's Ajax CDN tumbles worldwide

#35

Post by dos1 » Thu, Jan 03, 2013, 4:23 PM UTC

k3n wrote: post #27

dos1 wrote: post #13

Earlier quoted context omitted.

I agree completely that your average website will have less uptime than the CDN. The problem isn't that the CDNs are less reliable, it's that it's VERY unlikely that your site will experience downtime at the same time as the CDN. This means your site reliability is the combination of the downtime of the CDN as well as your own.

Yeah, but if you gracefully handle those failures with local fallbacks, then the CDN's downtime is a moot point.

See the rest of the comments in this thread about why the fallback can be painfully slow if the CDN is down. I saw your previous comment about making an ajax request with an adjusted timeout, but this is not ideal for making cross domain script requests for a number of reasons. For one, CORS needs to be enabled. Another is that you now have to create a script tag and take the responseText and jam it in there. This is going to be slower than just creating a script tag and setting the src attr.

If you are going to have a fallback, and that fallback may take seconds to activate if the CDN is down, why not just make the fallback your primary?

Re: Microsoft's Ajax CDN tumbles worldwide

#36

Post by JonnieCache » Thu, Jan 03, 2013, 4:25 PM UTC

jlgreco wrote: post #34

JonnieCache wrote: post #22

Earlier quoted context omitted.

Every time they use a public wifi hotspot. Any time you use a network you don't control and where you have no reason to trust the admin, you may as well be using a proxy. The requirement to trust the admin isn't about the admin MITMing you, but rather trusting their competency in preventing other users MITMing you. Of course the admin could be bad as well.

Any time you browse via public wifi you might be being fucked with. How often are you actually? My wager, depending on setting, very rarely.

In your local starbucks? Probably very rarely. In the VIP business lounge of an major international airport? I wouldn't be so sure in this day and age...

In the cafe on the corner of your block in syria, iran and similar places though, the odds are a lot better.

Re: Microsoft's Ajax CDN tumbles worldwide

#37

Post by jQueryIsAwesome » Thu, Jan 03, 2013, 4:27 PM UTC

crescentfresh wrote: post #21

jQueryIsAwesome wrote: post #18

Earlier quoted context omitted.

Don't use unescape, is ugly and is not required if you break the close tag of "script". this.jQuery||document.write(' ')

Yes, also document.write('\x3Cscript>\x3C/script>'). But these are beside the point.

Well; I also think this is going offtopic but I have to mention "unescape" is not a JS standard but it is available in most JS engines; in the other hand literal Unicode codes in strings are part of the ES specification.

Re: Microsoft's Ajax CDN tumbles worldwide

#38

Post by weego » Thu, Jan 03, 2013, 4:36 PM UTC

jQueryIsAwesome wrote: post #33

k3n wrote: post #12

Earlier quoted context omitted.

You could probably wire something up in JS to handle it with reduced timeouts, e.g. an AJAX call that automatically fails after 50-100ms and proceeds to load the local version.

A simpler solution would be to reload the page passing a parameter that you want to use other CDN; something like this: https://gist.github.com/4444636

You've now got people wondering why their page just reloaded after half a second and a slug of unnecessary javascript in your page all for the sake of simplicity.

A simple solution would be to just link to a self-hosted version of the lib.

Re: Microsoft's Ajax CDN tumbles worldwide

#39

Post by jQueryIsAwesome » Thu, Jan 03, 2013, 4:40 PM UTC

weego wrote: post #38

jQueryIsAwesome wrote: post #33

Earlier quoted context omitted.

A simpler solution would be to reload the page passing a parameter that you want to use other CDN; something like this: https://gist.github.com/4444636

You've now got people wondering why their page just reloaded after half a second and a slug of unnecessary javascript in your page all for the sake of simplicity. A simple solution would be to just link to a self-hosted version of the lib.

False; because (if the script is inside the head of the page) the loading of Javascript is synchronous so the user will not notice any refresh at all.

Re: Microsoft's Ajax CDN tumbles worldwide

#40

Post by bentcorner » Thu, Jan 03, 2013, 4:40 PM UTC

k3n wrote: post #32

JonnieCache wrote: post #22

Earlier quoted context omitted.

Every time they use a public wifi hotspot. Any time you use a network you don't control and where you have no reason to trust the admin, you may as well be using a proxy. The requirement to trust the admin isn't about the admin MITMing you, but rather trusting their competency in preventing other users MITMing you. Of course the admin could be bad as well.

Yay for never using public wifi hotspots, now if I could only impress that upon the millions of Americans who do so everyday...

I set up a VPN server at home on an old laptop, it works well for me in these scenarios (also for location-blocked services like Netflix while travelling out of country).