Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sky parental control system blocks code.jquery.com

thinkbroadband.com

Post reply on HN
Print view View original

31–40 of 69 posts

Re: Sky parental control system blocks code.jquery.com

#31

Post by csmithuk »

rmc wrote: post #28
csmithuk wrote: post #13

Sky user here[1]. Turn it off then! This is entirely optional. It asks you when you first install and connect the router via the WiFi landing page if you want to use any blocking. If you don't answer the question or select no, there is no blocking at all apart form the IWF firewall stuff. Every kind of blocking comes with problems of some description. You either live with it or trust your users. [1] £7.50/month for A…

(a) Non-techie mundane people have heard about the vast wave of horrible kiddie porn and grooming stalkers just waiting to kill your child. Why would they turn off the only thing protecting their loved ones from harm?[1] (b) What should you do? Phone up the tech support line and tell them you (essentially) want to look at fisting porn? What if they recognise your voice? What if someone finds out that you want to look…

a) I know a lot of parents. Not one actually cares about this. They care more than some nasty piece of work will nick their child's phone on the way home, which is far more realistic and common. I reckon the 1% are noisier than the 99% here.

b) No - see my post. When you connect the router and hit it with the first WiFi connection, it is configured by default to allow everything. At which point you can then tell them you don't want oodles of fisting porn shoved at you or just ignore the question and carry on getting your fix.

The only thing these statements prove is that the noiser people are consistently more likely to be wallies.

Re: Sky parental control system blocks code.jquery.com

#32

Post by 1stop »

al2o3cr wrote: post #29
nly wrote: post #7

Earlier quoted context omitted.

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

Sure, that sounds brilliant: allow anybody who can compute a hash collision to poison other sites' JS libraries. facepalm

A slightly more sensible approach may be to allow script tags (or any external linking mechanism) to list multiple (trusted) sources, and fallback appropriately.

That certainly feels more inline with how the internet in general was designed.

Re: Sky parental control system blocks code.jquery.com

#33

Post by davb »

voltagex_ wrote: post #14
csmithuk wrote: post #13

Sky user here[1]. Turn it off then! This is entirely optional. It asks you when you first install and connect the router via the WiFi landing page if you want to use any blocking. If you don't answer the question or select no, there is no blocking at all apart form the IWF firewall stuff. Every kind of blocking comes with problems of some description. You either live with it or trust your users. [1] £7.50/month for A…

Interested Australian user here. That's about half of the cost of our cheaper monthly ADSL2 plans - what's the catch? How far away from the exchange are you?

Sky don't have the best reputation when it comes to issue resolution. I was a former Sky broadband customer and found their customer care and technical teams to be woefully lacking. Additionally, they have no real SLA to speak of, and all of their service plans (as far as I understand) have a standard 1:50 contention ratio. Ouch. And when I was a customer (a couple of years ago), they refused to divulge the the ADSL (PPPoA) RADIUS credentials, making it much more difficult to use your own ADSL router.

For many users (especially your average home/family users with less technical requirements, not using it for critical purposes such as home working) they're probably perfectly adequate.

FWIW, I use BT's (formerly British Telecom) FTTC Infinity for Business product. 78Mbps down, 20Mbps up, worst case 1:20 contention, no caps or allowance-related FUP. Their customer care and technical teams are pretty decent. And I can get a /29 in addition to the dynamic PPP IP for the WAN link. Where I am (NE Scotland), BT own all of the widely available (non-private) infrastructure so it's easier to deal with a single company in the event of a failure vs being pushed between ISP and infrastructure provider. YMMV.

EDIT: FYI I pay £45 ex VAT (~AUD 102).

Re: Sky parental control system blocks code.jquery.com

#34

Post by rmrfrmrf »

youngtaff wrote: post #30
rmrfrmrf wrote: post #9

window.jQuery || document.write(' ') Source: http://stackoverflow.com/questions/1014203/best-way-to-use-g...

I'd question whether this is a worthwhile fallback as depending on what the error is then the browser may still wait 30 (ish) seconds for the original request to time out.

I look forward to seeing what you come up with.

Re: Sky parental control system blocks code.jquery.com

#35

Post by raverbashing »

aidos wrote: post #23
raverbashing wrote: post #18

Earlier quoted context omitted.

So, yeah, one thing that I learned about these CDNs They will stop working eventually So you may try to load from them, but always have a fallback. In your website An example: what if code.jquery.org gets compromised?

In that case your fallback isn't going to help - unless you're performing a checksum on the response you get from code.jquery.org. I know it's probably not considered great practice anymore but I generally just self host js libs. One less thing to go wrong and I often develop without an internet connection. Saves on having to dropback to a fallack every time.

Yes, true, in the case of a compromise it won't help. But I've found that outages are more frequent (including my own internet connection)

So yes, it also is necessary for development without an internet connection.

Re: Sky parental control system blocks code.jquery.com

#36

Post by johneth »

csmithuk wrote: post #27
johneth wrote: post #22

Earlier quoted context omitted.

> I'd go for Andrews & Arnold if I could afford idealism at the moment. I've heard Xilo are quite good regarding filtering, quality, etc., and they're cheaper than A&A.

I can't see any ADSL offerings on their site. Do you have a link?

Sure: http://www.xilo.net/adsl_broadband/

Disclaimer: I've never used them, I've just read some positive reviews on reddit and places a couple of monnths ago.

Re: Sky parental control system blocks code.jquery.com

#37

Post by jevinskie »

al2o3cr wrote: post #29
nly wrote: post #7

Earlier quoted context omitted.

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

Sure, that sounds brilliant: allow anybody who can compute a hash collision to poison other sites' JS libraries. facepalm

If you can create arbitrary collisions with something cryptographically secure like SHA-256, malicious jquery is probably the least of our worries.

Re: Sky parental control system blocks code.jquery.com

#38

Post by rmrfrmrf »

nly wrote: post #7
markdown wrote: post #4

Sucks for the people affected by this, but if the result is that more people use google for this, I'd be a happy bunny. Why would anyone use code.jquery.com, really? They obviously don't mind a third party hosting their js, so why not use the most popular service (google) to increase the chances that users arrive at their website with jquery already cached?

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

I want to know what privacy concerns you have regarding static CDNs that you don't implicitly give up by accessing the Internet.

Re: Sky parental control system blocks code.jquery.com

#39

Post by ufo »

1stop wrote: post #32
al2o3cr wrote: post #29

Earlier quoted context omitted.

Sure, that sounds brilliant: allow anybody who can compute a hash collision to poison other sites' JS libraries. facepalm

A slightly more sensible approach may be to allow script tags (or any external linking mechanism) to list multiple (trusted) sources, and fallback appropriately. That certainly feels more inline with how the internet in general was designed.

The point they were making is that googleapi and code.jquery.com don't count as trusted (at least not until you verify the hash)

Re: Sky parental control system blocks code.jquery.com

#40

Post by anglebracket »

nly wrote: post #7
markdown wrote: post #4

Sucks for the people affected by this, but if the result is that more people use google for this, I'd be a happy bunny. Why would anyone use code.jquery.com, really? They obviously don't mind a third party hosting their js, so why not use the most popular service (google) to increase the chances that users arrive at their website with jquery already cached?

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

> Perhaps it's about time we had a way to specify the hash of source inline so browsers can serve files from cache even if they are from different origins

A spec for just that was recently proposed[0], it even has support for a "canonical" script to be used in the event of that the hash check fails.

The good news is a polyfill for this can probably be created today. If CDNs serve their JS with the proper CORS headers, you can request the JS with cross-domain XHR and check it against a hash before eval()ing the script.

The bad news is that the polyfill would require you to allow `unsafe-eval` if you use Content-Security-Policy headers. Depending on your security model, it'd probably be best to host all your resources yourself. Not to mention that using a hash function written in javascript might negate any performance gains.

[0]: http://w3c.github.io/webappsec/specs/subresourceintegrity/

Post reply on HN