Crockford, webhosting, online dating, JSON, alert
This is a fun story that has a security and performance point to it.
Earlier today, Dion Almaer tweeted:
Wow, Doug added an alert() to http://www.json.org/json2.js which just alerted a LOT of people on the Internet. Proving a point on hotlinks?
I was talking to Doug about his keynote at Add-on-Con tomorrow, and asked him what the motivation was for this alert message. It turns out his webhosting service had contacted him about the unusually high amount of traffic on json.org. Doug investigated and discovered that OnlineBootyCall was linking directly to http://json.org/json.js, in spite of this statement in the file:
USE YOUR OWN COPY. IT IS EXTREMELY UNWISE TO LOAD CODE FROM SERVERS YOU DO NOT CONTROL.
Linking directly to http://json.org/json.js is bad. Certainly, it puts a load on Doug’s webhosting company that shouldn’t be there. But more importantly, it exposes the content site to security and performance vulnerabilities. Loading third party scripts into the parent window gives that third party access to cookies and other potentially confidential information in the page. Accessing that script from a third party domain requires an additional DNS lookup (which can be costly). Also, if the script is at the top of the page (which it is in this case) and the third party site is slow or not responding, the entire page is left blank for thirty seconds or more.
It’s best to reduce the number of third party scripts on your site. That was the reason Doug added the alert message to the top of json.js. If you haven’t gone to OnlineBootyCall yet today, here’s what you would’ve seen:
In Doug’s words,
I’m helping onlinebootycall improve its performance.
Agustin Colchado | 10-Dec-09 at 12:13 pm | Permalink |
Hi Steve,
What is your take on the loading Javascript libraries from Google’s AJAX Libraries API (http://code.google.com/apis/ajaxlibs/) collection?
I’ve it used more and more by small websites, but have yet to see a truly high traffic website use them on their commercial site.
Agustin
Greg | 10-Dec-09 at 12:17 pm | Permalink |
Hilarious! If you going to be grabbing JS or whatever from another site other than you own make sure that its a CDN (or Google/Yahoo libraries) and not just someones site.
Richard | 10-Dec-09 at 12:40 pm | Permalink |
Agustin,
DomainTools.com is using the google ajax libraries on their whois page, which is getting a very large amount of traffic.
Kyle Simpson | 10-Dec-09 at 12:57 pm | Permalink |
I so am in favor of helping onlinebootycall improve their performance (along with all the other sites who are hotlinking to json.js or json2.js). Way to go, Doug. And thanks for another informative post, Steve. :)
Shea Frederick | 10-Dec-09 at 1:07 pm | Permalink |
Things like this just crack me up…made for a good laugh earlier today.
Steve Souders | 10-Dec-09 at 3:55 pm | Permalink |
@Agustin: If your company has a web farm that is faster and more robust than Google, host the files there. Otherwise, it’s probably better to host them on Google, even at the cost of an extra DNS lookup.
@Shea: A great combination of funny but relevant. I’d expect no less from Doug.
arlo | 10-Dec-09 at 4:05 pm | Permalink |
a whole post just to justify onlinebootycall in your browser history
:P
James Daniel Schmidt | 10-Dec-09 at 4:33 pm | Permalink |
This post made this Wookie laugh. Doug solved the leeching problem with style.
I’m still laughing!
Alvaro | 10-Dec-09 at 5:23 pm | Permalink |
hahaha.. doug rules!
Kirk Cerny | 10-Dec-09 at 6:03 pm | Permalink |
Doug is a super hero.
I get goose bumps just watching his movies.
OnlineBootyCall.com | 10-Dec-09 at 10:09 pm | Permalink |
You guys are totally right!
One of our engineers had a major FAIL. We noticed the error today and had to immediately fix it. We too laughed (also shook our heads in utter disapproval) at the fact that warning says “IT IS EXTREMELY UNWISE TO LOAD CODE FROM SERVERS YOU DO NOT CONTROL.”
Lesson learned.
Benoît | 11-Dec-09 at 5:18 am | Permalink |
On the theory, I aggry with Doug, but on practice, it is one of your (Steve Souders) recommandation to load Prototype, YUI, … on Google or Yahoo CDN.
What must we do ?
Orlando Pozo | 14-Dec-09 at 1:22 pm | Permalink |
“Wow, Doug added an alert() to http://www.json.org/json2.js which just alerted a LOT of people on the Internet”
http://www.json.org/json2.js
alert(‘IMPORTANT: Remove this line from json2.js before deployment.’);
Nice ;)
gwenhwyfaer | 15-Dec-09 at 5:08 pm | Permalink |
Good call. But how does one counterbalance this with the desire of users (at least the more on-the-ball ones) to avoid ending up with one copy of jQuery / json2.js / GWT per site using it in their browser caches – or worse, in memory at once?
Bob | 15-Dec-09 at 5:52 pm | Permalink |
The “google” question is really simple:
You ask the owner of the host if its OK to link directly to the script hosted on their server, and you ask yourself if the security implications are acceptable.
If google says “use us directly” and you trust them, it’s ok.
If google says “host a copy of the file yourself” or if you don’t trust them, then it’s not ok.
How complicated can that be?
Pid | 20-Dec-09 at 4:06 am | Permalink |
@gwenhwyfaer Are you serious?
1. Users, real ones, have no idea what scripts you’re using.
2. Your browsers cache is designed to cope with different sites using different files. A script is no different to an image.
3. What evidence do you have that multiple copies of a script file “in memory” is bad?
Marcis Gasuns | 23-Dec-09 at 12:04 am | Permalink |
And how about Google Analytics external file?
ishak | 09-Jan-10 at 5:12 am | Permalink |
hahaha.. doug rules!
Lennie | 14-Jan-10 at 4:51 am | Permalink |
@Agustin Colchado Actually, Twitter.com (social networking site ;-) ) loads from googleapis.com. Alexa says it’s 14 worldwide.
Scott | 15-Jan-10 at 8:51 am | Permalink |
Nice!
(Trying to word this right and not getting it, please read between the lines).
There is some level of value in referencing files from their “home” servers in that you get any bug fixes/enhancements without having to remember to check for new versions.
Any notions how to weigh that positive versus the negatives outlined here?
(BTW, the spam blocker question is: “5 plus twenty-to” instead of twenty-two).
Scott | 15-Jan-10 at 8:52 am | Permalink |
Never mind the BTW above, I see what you’re doing.
Douglas | 15-Jan-10 at 10:03 am | Permalink |
@Scott: That’s not a positive, that’s a negative. What happens when that hotlinked script’s bugfix or enhancement breaks your site?
adventure singles | 27-Aug-10 at 4:21 am | Permalink |
Oh i couldn’t stop laughing. Doug handled the problem very well :).
Thanks
Collin paul