back
9 comments
> The big issue with this code is that it was directly linked via a script tag from a CDN (Content Delivery Network). This means that at any given moment, you have no idea what is actually going to be running on your site.

What exactly is the benefit you can get from linking something on an out-of-premise public CDN anyway? To save some traffic?

You still needs to host images and other files by yourself, one big picture could be a few times bigger than those jslibs. Not to mention then you have to handle loading priorities etc to make the external scripts work right.

For me, the only acceptable type of externally linked resource is the one inserted by the CDN that also hosts the site. For example, the statistics script inserted by Cloudflare if you host the site on Cloudflare. Other than that, IMO the risk out weight the benefit.

The original idea was that a shared source would mean the browser only caching a single copy of the code. Why should your cache contain 100+ identical copies of jQuery just because they were served on different URLs?

However, since cache partitioning, this benefit no longer exists.

Another benefit was speed, since a CDN was supposed to serve content faster than your server because it is a distributed network of servers. Probably not an advantage today with current speeds, unless you use dozens/hundreds of libraries a la Node.JS
I would argue that self-hosting hundreds of Nodejs modules might still be a better choice than the alternatives, specially since it give a easier time for bundling tool such as Webpack to workout what it needs to do in order to bundle the project in a better way.

And, let's don't forget creating a self-hosted CDN service to serve those bundles is not really THAT hard. (also creates job ops)

since when did medium require login to read full articles?

https://archive.is/0Itzv

When the author makes the article paid subscribers only.
Reminder about https://developer.mozilla.org/en-US/docs/Web/Security/Subres... :

> Subresource Integrity (SRI) is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match.

https://front-end.social/@mxbck/112752602298883078

polyfill.io was crazy huh, we just let a third party run any JS without even checking integrity. lol anyway please add this snippet for google tag manager, marketing needs it