Live data from Hacker News

jQuery CDN having SSL issues

code.jquery.com

31–40 of 59 posts

Re: jQuery CDN having SSL issues

#32
post #20

Original, jQuery CDN: https://code.jquery.com/jquery-X.Y.Z.min.js Google: https://ajax.googleapis.com/ajax/libs/jquery/X.Y.Z/jquery.min.js Microsoft: https://ajax.microsoft.com/ajax/jquery/jquery-X.Y.Z.min.js Microsoft ASP.NET: https://ajax.aspnetcdn.com/ajax/jquery/jquery-X.Y.Z.min.js jsDelivr: https://cdn.jsdelivr.net/npm/jquery@X.Y.Z/dist/jquery.min.js cdnjs: https://cdnjs.cloudflare.com/ajax/libs/jquery/X.Y.Z/jqu…

Does anyone have a performance benchmark comparing them?

Re: jQuery CDN having SSL issues

#33

It is too bad that the HTML standard has no built in way to fallback. They've added a cryptographic hash/integrity and the async/defer attributes to the script tag, but something as essential as a fallback if a script or stylesheet fails to load (which the browser is best placed to know), has no built in functionality. Instead you're left doing JavaScript tricks which for missing CSS gets a little ugly[0]. But CDN wi…

[deleted]

Re: jQuery CDN having SSL issues

#34

I always self-host my JS/CSS libraries: the connection is already open (thanks to keep-alive) so what's the problem of serving a couple of more KiBs of compressed data instead of making an additional DNS request and a new connection to a CDN? I understand that the CDN version of the library may have already been cached by the browser while visiting other websites, but does it really save that much time/traffic compar…

I'm not taking a side, just trying to add some numbers. Let's ignore the privacy/uptime concerns for the sake of this comment. If every site you visit has 350kb of stuff that would benefit from a CDN JS but also some CSS and fonts (google fonts, bootstrap, etc.) If you visit 50 pages a day in a 30 day month, that's a little over 500mb of data. .35mb x 50sites x 30days = 525mb That would be a ton of easily avoidable d…

That’s assuming every site is using the same CDN and the same version of the library. Seeing as that’s not the case you can cut that by at least an order of magnitude. Secondly, most users visiting 50 pages a day will not visit 50 sites a day but more like 5 pages a site across 10 sites, or even 10 pages a site on 5 sites. Now let’s add in to the user the external privacy cost of being tracked across multiple sites and it starts to look a little less appetising again from the user’s point of view.

Re: jQuery CDN having SSL issues

#35

It is too bad that the HTML standard has no built in way to fallback. They've added a cryptographic hash/integrity and the async/defer attributes to the script tag, but something as essential as a fallback if a script or stylesheet fails to load (which the browser is best placed to know), has no built in functionality. Instead you're left doing JavaScript tricks which for missing CSS gets a little ugly[0]. But CDN wi…

> Honestly if the integrity attribute is specified the browser should just be able to fall back to a cached copy it has (e.g. jquery.1.2.3.min.js has a crypto hash of ABC123, and I have that file already).

I really want this feature. I think there might be some cross-origin issues that need to be handled correctly (e.g. you might be able to fingerprint a user by probing for parts of their cache), but for common things like exact copies of jquery, this would be super useful.

Re: jQuery CDN having SSL issues

#36
post #27

Earlier quoted context omitted.

> Nowadays, with all the Node.js stuff that goes around modern front-end, I don't see the point of embedding a JavaScript library from a CDN, unless that library is dependent on a remote service, e.g. Google Analytics, Google Maps, etc… That being said, if you are still maintaining a legacy website that depends on jQuery, you should consider to embed the library like this instead: What does Node.js have to do with de…

I assume he's talking about NPM. Now that everybody's hot new SPA has a few hundred thousand NPM dependencies, you roll it all up using Webpack and can just as easily `npm install jquery` as ` `.

> Now that everybody's hot new SPA has a few hundred thousand NPM dependencies, you roll it all up using Webpack and can just as easily `npm install jquery` as ``.

Just because you can doesn't mean you should. You usually don't want some huge javascript bundle to load it's bad for page load performance. Also Webpack allows you to chose whether you want to bundle a dependency locally or grab it at runtime from a CDN or another sever.

Re: jQuery CDN having SSL issues

#38
post #20

Original, jQuery CDN: https://code.jquery.com/jquery-X.Y.Z.min.js Google: https://ajax.googleapis.com/ajax/libs/jquery/X.Y.Z/jquery.min.js Microsoft: https://ajax.microsoft.com/ajax/jquery/jquery-X.Y.Z.min.js Microsoft ASP.NET: https://ajax.aspnetcdn.com/ajax/jquery/jquery-X.Y.Z.min.js jsDelivr: https://cdn.jsdelivr.net/npm/jquery@X.Y.Z/dist/jquery.min.js cdnjs: https://cdnjs.cloudflare.com/ajax/libs/jquery/X.Y.Z/jqu…

Does anyone have a performance benchmark comparing them?

While Google and Microsoft are not included, JSDelivr (StackPath+fastly+CloudFlare+Quantil) compares themselves to MaxCDN (now StackPath which is the official jQuery CDN) and CloudFlare (the cdnjs provider) here: https://www.cdnperf.com/cdn-compare?type=performance&locatio...

KeyCDN has an online asset performance tool that we can use to compare the hosted jquery.min.js files. The numbers included here are results received (to the San Francisco location) in ms of [DNS lookup time] / [time to connect to server] / [overhead of TLS connection on individual asset] / [time from client HTTP request to receiving first byte from server]:

Original, jQuery CDN:

https://tools.keycdn.com/performance?url=https://code.jquery...

8 / 2 / 79 / 85

Google:

https://tools.keycdn.com/performance?url=https://ajax.google...

32 / 2 / 132 / 155

Microsoft:

https://tools.keycdn.com/performance?url=https://ajax.micros...

128 / 3 / 122 / 130

Microsoft ASP.NET:

https://tools.keycdn.com/performance?url=https://ajax.aspnet...

128 / 3 / 114 / 120

jsDelivr:

https://tools.keycdn.com/performance?url=https://cdn.jsdeliv...

64 / 3 / 118 / 129

cdnjs:

https://tools.keycdn.com/performance?url=https://cdnjs.cloud...

64 / 2 / 118 / 125

Yandex.ru:

https://tools.keycdn.com/performance?url=https://yastatic.ne...

32 / 139 / 667 / 993

When I tested them, only jsDelivr and cdnjs/Cloudflare recieved green results (under 200ms time to connect and under 400ms time to first byte) from all 16 worldwide test locations. Averaging the results between these two across 16 locations, I would go with jsDelivr who had a faster average TTFB. The fact that they are combining CloudFlare, Fastly, StackPath, and Quantil (who I had never heard of until today) might explain their global results.

Re: jQuery CDN having SSL issues

#39

It is too bad that the HTML standard has no built in way to fallback. They've added a cryptographic hash/integrity and the async/defer attributes to the script tag, but something as essential as a fallback if a script or stylesheet fails to load (which the browser is best placed to know), has no built in functionality. Instead you're left doing JavaScript tricks which for missing CSS gets a little ugly[0]. But CDN wi…

I mean, the fallback mechanism is progressive enhancement. It’s a reliability mechanism more than anything - if JS (or part of the JS) fails to load the site should fall back to a version that potentially reduces the interactivity but allows essential functions to continue.

Progressive enhancement is largely a myth.

A lot of libraries, JQuery, Lodash, Angular, Vue, React, Bootstrap's JS, module loaders, etc aren't simply offering "improved interactivity" they're offering core functionality. In essence the site runs on these libraries, if you remove them there's nothing left to regress too.

I've worked in several companies and never seen progressive enhancement used. It might have made sense back in the IE6 era when JavaScript was just for whiz-bang, these days JS libraries are holding the whole site's data context/state and generating Ajax as needed (Vue, Angular, React, etc). That's core, there's nothing progressive that can be removed from that.

Progressive Enhancement only makes sense for small toy sites or for academics to play with. Even Netflix's famous examples are about web services going offline, not losing core JavaScript libraries.

Re: jQuery CDN having SSL issues

#40

Earlier quoted context omitted.

I mean, the fallback mechanism is progressive enhancement. It’s a reliability mechanism more than anything - if JS (or part of the JS) fails to load the site should fall back to a version that potentially reduces the interactivity but allows essential functions to continue.

Progressive enhancement is largely a myth. A lot of libraries, JQuery, Lodash, Angular, Vue, React, Bootstrap's JS, module loaders, etc aren't simply offering "improved interactivity" they're offering core functionality. In essence the site runs on these libraries, if you remove them there's nothing left to regress too. I've worked in several companies and never seen progressive enhancement used. It might have made s…

You in Australia? We built 9now.com.au using a degree of ‘progressive enhancement’ thanks to server-side react. I left a while ago, but Normally, users get a single-page-app-like complete with prefetching to instantly display subsequent pages. Turn JS off and it ‘degrades’ into a typical server-rendered experience. Sure, get far enough in and some things will break (videos won’t play), but we were pretty happy about this degrading nicely.

We built Qantas’s in flight wifi portal using this same technique, a necessity to deal with providing users with an instant ‘web’ experience over a high-latency connection.

Toy sites or for academics? Hardly.

Post reply on HN