> From the point of view of the user that content might as well have come from a third party since - just like the headless browser used ...
> From the point of view of the user that content might as well have come from a third party since - just like the headless browser used in the testing - they have absolutely no way to verify that short of doing a bunch of whois lookups. How many users, even among the extremely security conscious, do you expect to actually verify such things? And among these, how many do you expect will turn their noses up at a CDN url that is serving a number of obviously website-specific assets in addition to jQuery and friends? The real issue (and the one you focus on in your article) is the actual dangers you expose yourself to by using uncontrolled external asset sources. If I set up a CloudFront bucket that mirrors the static asset directory on my web server (and use it via HTTPS), what is the vulnerability? CloudFront could be hacked, but so could my web server (and the later is a more likely culprit since it is executing more dynamic code). The difference makes even less sense if my website is also hosted by Amazon. If I want to keep my static assets on a CDN (and save myself a lot of server load) while keeping my assets URLs on the same domain, the only two things I can think of are: 1. Using a CNAME record, which precludes using HTTPS (introducing a real, not perceived, security vulnerability). 2. Use a local url that gives a 301 redirect to my CDN url. Which means extra requests to my website, for no real security benefit.
Posted by johncolanduoni on Jul 24, 2015, 9:59 PM
Tags
Related issues
- Legit what one of our clients problem was.
- sounds painful, just searched on "how can i get ms office running in linux using wine" and the results included a containerised windows v...
- Appreciate MCP server availability, will help integrate with Claude.
- Maybe a different take, but as someone that manages a large public API that allows anonymous access, IPv6 has been a nightmare to try and...
- Why is there no write through unionfs in Linux?
- > why is there no in-memory kafka server that I can use for simple testing purposes https://github.com/embeddedkafka/...
Raise real-world problems, find people facing the same issue, and discuss solutions.5,000 issues0 comments
hackernews (Sysadmin)
Legit what one of our clients problem was.
sounds painful, just searched on "how can i get ms office running in linux using wine" and the results included a containerised windows v...
Appreciate MCP server availability, will help integrate with Claude.
Maybe a different take, but as someone that manages a large public API that allows anonymous access, IPv6 has been a nightmare to try and...
Why is there no write through unionfs in Linux?
> why is there no in-memory kafka server that I can use for simple testing purposes https://github.com/embeddedkafka/...
> why is there no in-memory kafka server that I can use for simple testing purposes.
I went from daily driving mac and being very used to the desktop environment, and i am really hating everything i've tried in Linux.
> From the point of view of the user that content might as well have come from a third party since - just like the headless browser used ...
> From the point of view of the user that content might as well have come from a third party since - just like the headless browser used in the testing - they have absolutely no way to verify that short of doing a bunch of whois lookups. How many users, even among the extremely security conscious, do you expect to actually verify such things? And among these, how many do you expect will turn their noses up at a CDN url that is serving a number of obviously website-specific assets in addition to jQuery and friends? The real issue (and the one you focus on in your article) is the actual dangers you expose yourself to by using uncontrolled external asset sources. If I set up a CloudFront bucket that mirrors the static asset directory on my web server (and use it via HTTPS), what is the vulnerability? CloudFront could be hacked, but so could my web server (and the later is a more likely culprit since it is executing more dynamic code). The difference makes even less sense if my website is also hosted by Amazon. If I want to keep my static assets on a CDN (and save myself a lot of server load) while keeping my assets URLs on the same domain, the only two things I can think of are: 1. Using a CNAME record, which precludes using HTTPS (introducing a real, not perceived, security vulnerability). 2. Use a local url that gives a 301 redirect to my CDN url. Which means extra requests to my website, for no real security benefit.
Comments (0)
No comments yet. Start the discussion.