Live data from Hacker News

Sky parental control system blocks code.jquery.com

thinkbroadband.com

61–69 of 69 posts

Re: Sky parental control system blocks code.jquery.com

#61
post #57

Earlier quoted context omitted.

I wish I was having as good a time as you are. I was on o2 for 3-4 years before being transferred over to Sky last month. Since transferring, I've had nothing but problems. Online gaming pings have gone from 20 -> 50, download speeds have fallen 20-30%, my connection frequently hangs (Youtube is near unusable), and I now have issues loading websites from time to time (I had to refresh Google 3 times before it loaded…

If it's unusable, tell them and say you will stop paying for it as it doesn't live up to their advertising. Your rights are protected outside the contract. Threaten to complain to Ofcom if they resist. They'll let you leave and give you the MAC code. I'm in London and my exchange has Sky LLU support. Coincidentally I live in the same postcode as Sky HQ so any problems, I'll talk face to face with them as I have some…

I did ring technical support to get the issues fixed last Thursday -- apparently a higher level technician will call me back within '10 working days'. Hmm.

I'm not trapped by a 12 month contract, which is why I'm not too annoyed about the situation. My cabinet will get fibre fitted early next month, so I should only have to endure Sky for another month or two thankfully, which is ok by me.

Re: Sky parental control system blocks code.jquery.com

#62
post #61

Earlier quoted context omitted.

If it's unusable, tell them and say you will stop paying for it as it doesn't live up to their advertising. Your rights are protected outside the contract. Threaten to complain to Ofcom if they resist. They'll let you leave and give you the MAC code. I'm in London and my exchange has Sky LLU support. Coincidentally I live in the same postcode as Sky HQ so any problems, I'll talk face to face with them as I have some…

I did ring technical support to get the issues fixed last Thursday -- apparently a higher level technician will call me back within '10 working days'. Hmm. I'm not trapped by a 12 month contract, which is why I'm not too annoyed about the situation. My cabinet will get fibre fitted early next month, so I should only have to endure Sky for another month or two thankfully, which is ok by me.

Cool good news then :)

Re: Sky parental control system blocks code.jquery.com

#63
post #46

Earlier quoted context omitted.

Not sending Referer headers to Google. (Yes, it becomes a problem when you use private browsing, since the cache is cleared when you end the session.)

You have to do that at the end-user level if your goal is truly shielding yourself from Google. Wagging your finger at a few of the devs on a news website isn't going to change the millions of websites using client AND server-side Google Analytics, not to mention ads.

I do. Your comment,

> I want to know what privacy concerns you have regarding static CDNs that you don't implicitly give up by accessing the Internet.

implies that the privacy concerns for 3rd party JS library CDNs are null. They are only null if you don't already block or misdirect their other tracking methods.

Re: Sky parental control system blocks code.jquery.com

#64
post #43

Earlier quoted context omitted.

Perhaps the parents should spend some time with their children and show them what is appropriate and what is not? I have three children, all of whom use the Internet regularly and bar some passive monitoring, I've done nothing. They have healthy browsing habits. Blacklists, censorship, firewalls and control are missing the point... Plus you're going to get goatse'd at some point in your life...

> Perhaps the parents should spend some time with their children and show them what is appropriate and what is not? Kids will already know this, the question is whether they still wish to push their luck if they think they can get away with it. If they're anything like me, then they will :) So I wouldn't trust my kids with an unfiltered internet any more than I'd give them satellite / cable TV in their rooms before a…

>So I wouldn't trust my kids with an unfiltered internet

Why? Like what exactly are you concerned about? Just that they might "watch adult movies"?

Re: Sky parental control system blocks code.jquery.com

#65
FWIW my company (MaxCDN) provides the CDN service for code.jquery.com. We are currently investigating this issue with Sky.

Edit: Just saw this: "It appears that the jquery CDN is unblocked once more on Sky connections where the phishing filter that is part of the parental controls system was enabled."

We will continue to work with Sky to prevent this from happening in the future.

Re: Sky parental control system blocks code.jquery.com

#66
post #56
post #7

Earlier quoted context omitted.

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

This strikes me as something that, without a lot of thought, will expose a user's browsing history (similar to the old "check the visited link color" attacks). Insert script links with a hash, check to see if the browser makes a request.

I think with JSONP you can already make a cross-site request, time the response, and determine whether it was cached or had to be fetched.

Re: Sky parental control system blocks code.jquery.com

#67
post #43

Earlier quoted context omitted.

> Perhaps the parents should spend some time with their children and show them what is appropriate and what is not? Kids will already know this, the question is whether they still wish to push their luck if they think they can get away with it. If they're anything like me, then they will :) So I wouldn't trust my kids with an unfiltered internet any more than I'd give them satellite / cable TV in their rooms before a…

>So I wouldn't trust my kids with an unfiltered internet Why? Like what exactly are you concerned about? Just that they might "watch adult movies"?

Some content might be too violent or scary. Or too sexual. I'm not someone who wraps their kids in cotton wool, but I'd like to protect their innocence until they're ready to watch adult content rather than rush them into adulthood just because the content is out there to be viewed.

Re: Sky parental control system blocks code.jquery.com

#68
post #56
post #7

Earlier quoted context omitted.

> Why would anyone use code.jquery.com, really? Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen externa…

This strikes me as something that, without a lot of thought, will expose a user's browsing history (similar to the old "check the visited link color" attacks). Insert script links with a hash, check to see if the browser makes a request.

That was my thought too, the candidate spec for this[0] seems to have taken that into consideration by requiring the scripts to be served with an `Access-Control-Allow-Origin: ` header.

Since the server needs to grant you full cross-origin read permissions to even start the hash check, it's not likely that an attacker could use this to infer more about cross-origin resources than they already can.

[0]: http://w3c.github.io/webappsec/specs/subresourceintegrity/

Re: Sky parental control system blocks code.jquery.com

#69

Earlier quoted context omitted.

code.jquery.com has in fact gone down in the past, and this did in fact bite my workplace in the backside. We went to locally-hosted copies of jquery stuff. We kept using Google for JS they hosted, since their uptime way beats ours.

> since their uptime way beats ours You link to Google's JS so your users can still get it when your own site is down? If you hosted it yourself your users would see a working site whenever you were up. Now they will see a working site whenever both you and Google are up. This has not improved effective uptime for anyone. (On the other hand, Google might serve the JS faster, especially if your users cache it. They ma…

GP's point is that it also hasn't noticeably decreased uptime. So especially if there's a speed benefit, why switch?
Post reply on HN