What about services like npm that distribute code? Are these analogous or do they have additional security in place?
Isn't that server side?
Some analysis of the 1M most popular sites on the web
11–20 of 130 posts
Re: Some analysis of the 1M most popular sites on the web
#12Security is hard; lets build stuff with new shiny tech instead!
Re: Some analysis of the 1M most popular sites on the web
#13Likely culprits are "performance analyzers" that grade a website and report an "F" (failing) grade for not using CDN-hosted common libraries.
This is a red herring: this idea that the user will already have a cached copy of CDN-hosted jQuery is bogus. Even for a common library like jQuery: the number of versions of jQuery that are in use is likely above 50, and the number of popular CDNs that host jQuery is surely above 10. So we are hoping that the user will have a cached copy of that exact jQuery version from that exact CDN.
This is somewhat similar to the situation we have with operating systems: we created shared libraries to save disk space and memory. These days using them is pretty much pointless and incurs a performance penalty, yet everybody still uses them.
For JavaScript, a much better approach is to a) make code Google Closure-compatible, b) compile everything using advanced mode into a single JavaScript file. That way you get an optimized subset of all the code that the site actually uses (this works wonders for ClojureScript apps). Most sites probably use less than 10% of jQuery, so why include all of it?
Re: Some analysis of the 1M most popular sites on the web
#14Likely culprits are "performance analyzers" that grade a website and report an "F" (failing) grade for not using CDN-hosted common libraries. This is a red herring: this idea that the user will already have a cached copy of CDN-hosted jQuery is bogus. Even for a common library like jQuery: the number of versions of jQuery that are in use is likely above 50, and the number of popular CDNs that host jQuery is surely ab…
I remember reading about http2 that using a single javascript file is an anti-pattern since http2 has smarter management of requests and can deal with them in a more granular manner.
Re: Some analysis of the 1M most popular sites on the web
#15This is very interesting. Will you release the data and code at some point?
Yes, I will definitely release the code and the dataset required to bootstrap the rest. It takes a long long time to run and you'll need a good bit of bandwidth. I won't be releasing the raw data because there is simply too much of it.
If bandwidth is a worry there are open data projects by Amazon[1] and I think Google that could host your data.
[1] Amazon Public Data Sets, http://aws.amazon.com/public-data-sets/
[2] Google Public Data, http://www.google.com/publicdata/directory
Re: Some analysis of the 1M most popular sites on the web
#16Like, security is hard, comp sci was hard, so the websites are all built by social science grads and "designers" who know fuck all about security.
Re: Some analysis of the 1M most popular sites on the web
#17Likely culprits are "performance analyzers" that grade a website and report an "F" (failing) grade for not using CDN-hosted common libraries. This is a red herring: this idea that the user will already have a cached copy of CDN-hosted jQuery is bogus. Even for a common library like jQuery: the number of versions of jQuery that are in use is likely above 50, and the number of popular CDNs that host jQuery is surely ab…
How would the closure compiler figure out what bits and pieces of the library are triggered from the html portion of the site? (I can see how it can track the javascript bits but unless your site is entirely generated from js you'd have to start with the html)
Re: Some analysis of the 1M most popular sites on the web
#18This article should be read as ranty research, not practical advice. It'd be fine to fix these issues, but not at the website developer level.
"If you have to use externally hosted resources such as javascript libraries then at a minimum you should verify regularly that the code has not changed "
No, you shouldn't. You should focus on stuff that matters to users, not existential internet security holes. Let someone else fix this problem for you, when it stops being existential.
By far the safest approach for website owners that care about their users and their users privacy is to simply not include anything at all from other people’s servers.
FTFY "A safe, but impractical and productivity-destroying aproach..."
Re: Some analysis of the 1M most popular sites on the web
#19Earlier quoted context omitted.
wow! i think there should be a place on the internet for publicly naming and shaming such practices. like a Darwin Award or Razzies [1] of webdev. [1] https://en.wikipedia.org/wiki/Golden_Raspberry_Awards
That's one of the things I'm considering right now. To re-write the top 1000 or so with annotations and then to sort them by category as well as an example of a site that is 'clean' in the same category. There are a ton of offenders and some of them are very well known. One of the interesting things you find when you look at this data is that the bigger sites really do have their stuff set up better (for instance, by…
frankly, i am much less bothered by the cross-domain visit tracking aspects than the js injection. cookies are not going anywhere in a thriving, behavioral analysis driven ad industry. i dont know how logged impressions/clicks can be trusted for accuracy if they had to be proxied by or entrusted to their customer's servers.
i will live with cookies, but absolutely will not live with injected js behind https.
Re: Some analysis of the 1M most popular sites on the web
#20Are modern updated browsers resilient against those "evercookies" or not so much?
To be more specific: I have my Firefox configured to delete cookies on exit. Does that deal with "evercookies"? I must admit, never heard about them before...