Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sky parental control system blocks code.jquery.com

thinkbroadband.com

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Sky parental control system blocks code.jquery.com

#51

Post by [deleted] »

anglebracket wrote: post #40
nly wrote: post #7

Earlier quoted context omitted.

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

> Perhaps it's about time we had a way to specify the hash of source inline so browsers can serve files from cache even if they are from different origins A spec for just that was recently proposed[0], it even has support for a "canonical" script to be used in the event of that the hash check fails. The good news is a polyfill for this can probably be created today. If CDNs serve their JS with the proper CORS headers…

[deleted]

Re: Sky parental control system blocks code.jquery.com

#53

Post by nly »

anglebracket wrote: post #40
nly wrote: post #7

Earlier quoted context omitted.

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

> Perhaps it's about time we had a way to specify the hash of source inline so browsers can serve files from cache even if they are from different origins A spec for just that was recently proposed[0], it even has support for a "canonical" script to be used in the event of that the hash check fails. The good news is a polyfill for this can probably be created today. If CDNs serve their JS with the proper CORS headers…

I see no reason to implement any of that in Javascript

Re: Sky parental control system blocks code.jquery.com

#54

Post by nly »

rmrfrmrf wrote: post #38
nly wrote: post #7

Earlier quoted context omitted.

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

I want to know what privacy concerns you have regarding static CDNs that you don't implicitly give up by accessing the Internet.

Tracking via 3rd party cookies and E-Tags, plus HTTP Referers as codeonfire said. There's also just the obvious risk of compromise, resulting in millions of sites running malicious code.

Re: Sky parental control system blocks code.jquery.com

#55

Post by nly »

ufo wrote: post #39
1stop wrote: post #32

Earlier quoted context omitted.

A slightly more sensible approach may be to allow script tags (or any external linking mechanism) to list multiple (trusted) sources, and fallback appropriately. That certainly feels more inline with how the internet in general was designed.

The point they were making is that googleapi and code.jquery.com don't count as trusted (at least not until you verify the hash)

The domains are obviously trusted to a degree. The objective of the hash is just to allow a content addressed[0] clientside web cache, and avoid talking to them most of the time. Good for privacy, security and load times.

[0] http://en.wikipedia.org/wiki/Content-addressable_storage

Re: Sky parental control system blocks code.jquery.com

#56

Post by jowiar »

nly wrote: post #7
markdown wrote: post #4

Sucks for the people affected by this, but if the result is that more people use google for this, I'd be a happy bunny. Why would anyone use code.jquery.com, really? They obviously don't mind a third party hosting their js, so why not use the most popular service (google) to increase the chances that users arrive at their website with jquery already cached?

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

This strikes me as something that, without a lot of thought, will expose a user's browsing history (similar to the old "check the visited link color" attacks). Insert script links with a hash, check to see if the browser makes a request.

Re: Sky parental control system blocks code.jquery.com

#57

Post by Cor »

csmithuk wrote: post #17
voltagex_ wrote: post #14

Earlier quoted context omitted.

Interested Australian user here. That's about half of the cost of our cheaper monthly ADSL2 plans - what's the catch? How far away from the exchange are you?

Well I was an O2 customer. Sky bought O2 last year and in the effort to maintain their customer-base they will give you silly offers if you argue with them for long enough. It's usually £20.50/month including line rental but I argued it down to £7.50/month on the basis I stayed with them for 12 months. No catch. Confirmed no traffic management, no download limit, free router, free migration. This is purely for custom…

I wish I was having as good a time as you are.

I was on o2 for 3-4 years before being transferred over to Sky last month. Since transferring, I've had nothing but problems. Online gaming pings have gone from 20 -> 50, download speeds have fallen 20-30%, my connection frequently hangs (Youtube is near unusable), and I now have issues loading websites from time to time (I had to refresh Google 3 times before it loaded earlier). To make things worse, Sky is charging me £15.50 a month while o2 was only charging £7.50.

Thankfully, BT is installing fibre in my area so I should be able to jump over to plus.net sometime soon. I can't wait.

Re: Sky parental control system blocks code.jquery.com

#58

Post by anglebracket »

nly wrote: post #53
anglebracket wrote: post #40

Earlier quoted context omitted.

> Perhaps it's about time we had a way to specify the hash of source inline so browsers can serve files from cache even if they are from different origins A spec for just that was recently proposed[0], it even has support for a "canonical" script to be used in the event of that the hash check fails. The good news is a polyfill for this can probably be created today. If CDNs serve their JS with the proper CORS headers…

I see no reason to implement any of that in Javascript

The polyfill would need to be in javascript, this is just a candidate spec and isn't actually implemented anywhere yet. Obviously it wouldn't be needed if it was implemented natively. I'm just not sure if it makes any sense to, performance-wise.

Re: Sky parental control system blocks code.jquery.com

#59

Post by csmithuk »

Cor wrote: post #57
csmithuk wrote: post #17

Earlier quoted context omitted.

Well I was an O2 customer. Sky bought O2 last year and in the effort to maintain their customer-base they will give you silly offers if you argue with them for long enough. It's usually £20.50/month including line rental but I argued it down to £7.50/month on the basis I stayed with them for 12 months. No catch. Confirmed no traffic management, no download limit, free router, free migration. This is purely for custom…

I wish I was having as good a time as you are. I was on o2 for 3-4 years before being transferred over to Sky last month. Since transferring, I've had nothing but problems. Online gaming pings have gone from 20 -> 50, download speeds have fallen 20-30%, my connection frequently hangs (Youtube is near unusable), and I now have issues loading websites from time to time (I had to refresh Google 3 times before it loaded…

If it's unusable, tell them and say you will stop paying for it as it doesn't live up to their advertising. Your rights are protected outside the contract. Threaten to complain to Ofcom if they resist. They'll let you leave and give you the MAC code.

I'm in London and my exchange has Sky LLU support. Coincidentally I live in the same postcode as Sky HQ so any problems, I'll talk face to face with them as I have some contacts.

Re: Sky parental control system blocks code.jquery.com

#60

Post by rmrfrmrf »

dictum wrote: post #46
rmrfrmrf wrote: post #38

Earlier quoted context omitted.

I want to know what privacy concerns you have regarding static CDNs that you don't implicitly give up by accessing the Internet.

Not sending Referer headers to Google. (Yes, it becomes a problem when you use private browsing, since the cache is cleared when you end the session.)

You have to do that at the end-user level if your goal is truly shielding yourself from Google. Wagging your finger at a few of the devs on a news website isn't going to change the millions of websites using client AND server-side Google Analytics, not to mention ads.
Post reply on HN