<story><title>Security and privacy risks of public JavaScript CDNs</title><url>https://httptoolkit.com/blog/public-cdn-risks/</url></story><parent_chain></parent_chain><comment><author>atoav</author><text>If you truly worry about the performance of your webpage there are many, &lt;i&gt;many&lt;/i&gt; places to optimize before ever considering the problematic CDN option. I suggest optimizing everything else first. How many pages I have seen that load 3 fonts with 8 variants each while using &lt;i&gt;one&lt;/i&gt; font with two variants is too damn high. The amount of people who don&amp;#x27;t know how to scale and compress images as well.&lt;p&gt;I know this is not how most sites operate these days, but consider that your visitor wants to visit &lt;i&gt;you&lt;/i&gt; and getting &lt;i&gt;your&lt;/i&gt; website. Whenever you embed stuff from other servers you not only gift away your user-data and breach their trust, you just doubled your attack surface and lowered the reliability of your site. And for &lt;i&gt;what&lt;/i&gt; exactly?&lt;p&gt;My suspicion is that developers find it easier to paste a CDN include than downloading the file and including it themselves. Because performance my ass.&lt;p&gt;That&amp;#x27;s a bit like that cookie notice thing. Guess what: if you don&amp;#x27;t collect personal data and store it on your users computer, you don&amp;#x27;t need to ask them for consent and suddenly your site looks a lot cleaner and needs to deliver less data.</text></comment>
<story><title>Security and privacy risks of public JavaScript CDNs</title><url>https://httptoolkit.com/blog/public-cdn-risks/</url></story><parent_chain></parent_chain><comment><author>antifa</author><text>Regarding the alleged performance benefits of using a public CDN: if there ever was a cache hit because a user visited one site then yours that coincidentally used the same CDN and query version (pro tip: never happened), and in a short enough time to not suffer a cache eviction, the user did not notice.&lt;p&gt;When the CDN was slow, every user noticed and thought your website was slow.&lt;p&gt;You gave away free analytics and made your website worse, there wasn&amp;#x27;t even a trade off.</text></comment>