1

Today I read about an alleged malware attack targeting jQuery.com

A german blogger who is what I would call an expert on IT security stated that

Any website that is working with individual-related data should not reference external libraries

Yet, usage of CDN's is recommended by large companies like Google as well as considered a best practice for performance improvements.

Should I host libraries I wish to work with on my own web space, when my apllication is working with sensitive data?

  • A CDN isn't a "library". – Mark C. Wallace Sep 24 '14 at 10:33
  • @MarkC.Wallace Thanks, I am aware of that. I meant to point out that my question is targeting both variants, CDN's and simply sincluded scripts – Wottensprels Sep 24 '14 at 11:03
2

The answer to this question has two sides...

First:

If you host the libraries yourself then you have to check the security notices on the library regularily and update the library accordingly. This can be a very time consuming task if you include several libraries which must be updated independently.

On the other side you can audit each library you use.

Additionally you have to prevent any attack to this libraries yourself. If you detect an attack you can handle this very fast.

Second:

If you use a CDN then the ownder of the CDN updates all libraries for you. You have no work with updating the libraries yourself.

The audit for the libraries are (hopefully) done by the company of the CDN. You cannot influence this audit.

A CDN should prevent any attack to the hosted libraries. If an attack is detected then the CDN will handle this attack. Perhaps the libraries are compromised and the CDN is delvivering modified libraries which can infect your customers...

Finally

The CDN lowers your work with the libraries as they do much work that has to be done by you otherwise.

On the other side you have to trust the company of the CDN to handle all security issues fast enough to not harm your customers.

  • "You have no work with updating the libraries yourself" - not necessarilt true. Most repositories host libs usng a naming convention that includes the version number - and not all developers backport security fixes. See also developers.google.com/speed/libraries/devguide#jquery – symcbean Sep 24 '14 at 13:12
1

As per the comment on Uwe's answer, there's only a security advantage if the URL you use reference a library with the security problems fixed. Although, to expand on my comment there, the jQuery team have been working with Google to make the latest production release (i.e. with security fixes) available at a (new) non-varying URI. However Google still need to update their documentation.

Other repositories / developers may not provide this level of service.

A consequence of the Google/JQuery approach is that Google are lowering the cache time at the generic URL, potentially undermining the already limited benefit of using a shared respository.

0

Using third party libraries is always the safer and for sure the recommended way to go (if you trust them). To check your third party libraries you can (e.g.) use the owasp dependency checker. That becomes hard for pure content/script-sites, i guess. I think what your expert ment was to avoid using foreign content in your websites not libraries.

  • Recommened by whom? Why? – symcbean Sep 24 '14 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.