Hacker News new | past | comments | ask | show | jobs | submit login

There are good reasons to use the Google version.

A: Google is likely far more reliable than your dinky little outfit, so odds are very very high it'll be up and absurdly reliable.

B: If you use the Google version, it's probably already in your user's cache saving you nearly an 80k download for a common library and making the first hit to your site potentially much faster.




A: Google is likely far more reliable..

It's not about reliability. It's about trust. When you cross-site script yourself by giving Google access to the contents of every page on your site, you are entrusting this company with your data, and all your customer's data.

No company, including almighty, do-no-evil Google should be trusted this much.

B: If you use the Google version, it's probably already in your user's cache saving you nearly an 80k download

This might be offset slightly by your web browser having to make a separate HTTPS connection to a different "secure" host. If you are this concerned about JavaScript load times you should bundle all required javascript into a single file -- one HTTP request to one server will always beat many requests to many servers.


No company, including almighty, do-no-evil Google should be trusted this much.

It isn't just about trusting the CDN: relying on popular public static resources like this increases your vulnerability to DNS poisoning attacks.

If some malware manages to redirect requests for Google's static content servers to their servers they could inject a key-logger or username/password/credit-card info scanning code into every site (even small and/or low profile sites that would otherwise not be as likely to be targeted) using that as a source for libraries like jQuery that the infected users visit.


Fair points.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: