It's always blown me away how willing people are to install remote JavaScript on their sites, including top sites that you would expect to be more cautious. A lot of internet retailers include dozens of third party JavaScript files on their pages for analytics, social widgets, retargeting, etc. The way they handle the risk is by using constant monitoring by security auditing firms to check for changes in any of the files (presumably from different locations, browsers, user-agents, etc).
You shouldn't hotlink someone else's JavaScript
81–90 of 102 posts
Re: You shouldn't hotlink someone else's JavaScript
#82And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite. Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're steali…
I've wondered in the past why there isn't something like:
" />
Using anything from sources you don't trust is a bad idea, but even trustworthy partners can be exploited to attack your site as well.
It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible.
Re: You shouldn't hotlink someone else's JavaScript
#83That page was like that for a while, since the author of that plugin has done that a few months ago:
http://blog.sucuri.net/2013/05/who-really-owns-your-website-...
Re: You shouldn't hotlink someone else's JavaScript
#84Earlier quoted context omitted.
http://caniuse.com/#compare=ie+10,firefox+24,chrome+29
Sure, I don't mind if bits don't work, if I miss out on some WebGL stuff or similar. But to just put up a big fuck you, to what is the second most popular or most popular browser as a whole isn't helpful. It reminds me of people using Java Applets for navigation in their frames webpage.... Actually I did that once, I was however 11, and this thing had a spinny thing. Sure, do cool stuff that requires features which s…
> But to just put up a big fuck you, to what is the second most popular or most popular browser as a whole isn't helpful.
I'm glad you said this. I think you're stepping out from a trend/trope, which is to make fun of IE, to recognize the more nuanced reality of the situation.
Over the last few months, I've encountered some surprises. One is that although Firefox seems to be a memory hog, it's very reliable at this point. I didn't set out to like Firefox, but now I trust it as much as the old Netscape.
Another is that while I like the idea of Opera and Chrome, each has failed me now in a number of situations where we're not looking at an isolated glitch, but major performance problems. In particular, complex scripts can lock these guys up like a flash freeze, and Chrome has periodic catastrophic crashes:
http://productforums.google.com/forum/#!topic/chrome/7WtG_xY...
This leaves me looking at Firefox and IE as the two real contenders. And while I've never wanted to be an IE fan, as only the unpopular kids on the schoolyard like IE, I think as an application, it's pretty stable. Its only real problem is security and if MS fixes that, I think it's going to be a great competitor for FF now that it's standards-based in the newest version.
Re: You shouldn't hotlink someone else's JavaScript
#85How is this even a thing we're discussing?
This just seems so obvious.
Re: You shouldn't hotlink someone else's JavaScript
#86And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite. Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're steali…
I've wondered in the past why there isn't something like: " /> that refuses to load the referenced script unless it matches the specified digest/signature. Using anything from sources you don't trust is a bad idea, but even trustworthy partners can be exploited to attack your site as well. It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible.
"It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible."
You just put the version number in the name somewhere and make deployments immutable. Otherwise you have everything you need for that already, technically, though you might want to add a fallback to a local clone of the resource or something so it isn't just a failure.
Re: You shouldn't hotlink someone else's JavaScript
#87if (window.location.origin !== "http://beta.whatispolymath.com/"){
window.location = "http://beta.whatispolymath.com/";
}
Re: You shouldn't hotlink someone else's JavaScript
#88And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite. Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're steali…
I've wondered in the past why there isn't something like: " /> that refuses to load the referenced script unless it matches the specified digest/signature. Using anything from sources you don't trust is a bad idea, but even trustworthy partners can be exploited to attack your site as well. It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible.
it wouldn't be all that hard to implement this yourself if you're willing to load script dynamically. you'd have to maintain your own digest list.
Re: You shouldn't hotlink someone else's JavaScript
#89Earlier quoted context omitted.
Everyone these days is so polite. OK, that was a bit of an exaggeration. But back in my day the web had a whole site high-bandwidth site specifically for educating careless webmasters about the dangers of hotlinking: g o a t s e . c x. It was used to great effect on things like auction sites where the original page html was not allowed to be changed after listing.
I'm not sure if politeness is the motivator. Imagine if you had done that, for all hotlinks to your script. Then, it turns out a children's website is hotlinking your script. Some idiot at Company X decides that it's actually your fault, since its your script that did it. To save face, they get an expensive lawyer to sue you. Next thing you know, you're a registered sex offender.
Well that escalated quickly.
Re: You shouldn't hotlink someone else's JavaScript
#90This site is full of bad practices.
* Never link to someone else's files (JS, images, etc).
* Don't use S3 as a CDN. It's not a CDN. Latency can be bad. Use CloudFront.
* Minify and combine CSS and JS.
* Put your JS at the end of the page.