Sky parental control system blocks code.jquery.com

http://www.thinkbroadband.com/news/6261-sky-parental-controls-break-jquery-website.html

by digitalclubb • 12 years ago

92 67 12 years ago

That is really not very reassuring in terms of the level of technical understanding/oversight in managing their block list.

Mind you, I'm not surprised that someone updating the list is on a Sunday night is not qualified.

DanBC• 12 years ago

I'd be interested to see if the initial blocking was part of an automatic system - block everything in this malicious page - and was fixed when the competent people got in to work to see all the complaints and reports?

That can't be true because it would make reputation attacks really easy.

belorn• 12 years ago

ISP interference makes for a interesting question regarding liability. Their interference are now potentially causing massive amount of economic damages to companies which relies on jquery library. Webshops, economic infrastructure, hospitals, transportation systems are just a few that relies on having fully functional websites up and running.

But for liability, a few questions pops up. Who is the offended party, and how much negligence is required for software bugs. Does it need to be a civil suit with each customer, or can the website owners sue? If a truck crash right outside a store and disrupt business, the store owner can sue even if they have no formal relation with the truck company.

Cthulhu_• 12 years ago

Alternatively, does code.jquery.com offer any kind of uptime guarantee? Big companies would rather rely on their own hosting / CDN than that of jquery, I'm sure.

eloisant• 12 years ago

Even for a small company/project, I've stopped using external CDN.

The gain is not significant enough to balance problems like this one. It's not often than a consumer ISP does this mistake, but that's pretty common for a user behind a corporate proxy.

davidgerard3• 12 years ago

code.jquery.com has in fact gone down in the past, and this did in fact bite my workplace in the backside.

We went to locally-hosted copies of jquery stuff. We kept using Google for JS they hosted, since their uptime way beats ours.

raverbashing2• 12 years ago

So, yeah, one thing that I learned about these CDNs

They will stop working eventually

So you may try to load from them, but always have a fallback. In your website

An example: what if code.jquery.org gets compromised?

aidos• 12 years ago

In that case your fallback isn't going to help - unless you're performing a checksum on the response you get from code.jquery.org.

I know it's probably not considered great practice anymore but I generally just self host js libs. One less thing to go wrong and I often develop without an internet connection. Saves on having to dropback to a fallack every time.

markdown• 12 years ago

Sucks for the people affected by this, but if the result is that more people use google for this, I'd be a happy bunny.

Why would anyone use code.jquery.com, really? They obviously don't mind a third party hosting their js, so why not use the most popular service (google) to increase the chances that users arrive at their website with jquery already cached?

octo_t• 12 years ago

What makes you think that Google wouldn't be blocked by the same mechanism?

taspeotis2• 12 years ago

Well let's assume that each URL or domain that is blocked is reviewed by a human who's paid to look at content, not necessarily to have technical knowledge.

They'd be much more likely to know that blocking anything from Google is probably a bad idea/false positive but they've probably never heard of jQuery and when they look at the jquery*.js files all they see is The Matrix.

So if you allow the above assumption, it's less likely that using Google's CDN would present this problem.

nly4• 12 years ago

Why would anyone use code.jquery.com, really?

Because webmasters would rather compromise the security and integrity of their site, and the privacy of their users, than pay for the initial burst of bandwidth and latency for first time visitors. jQuery 2.1.0 production, minified and gzipped is still over 30KiB, compared to this thinkbroadband page which is only 6 KiB (and yes this page uses about half a dozen external js resources, including jQuery)

Perhaps it's about time we had a way to specify the hash of <script> source inline so browsers can serve files from cache even if they are from different origins

jobigoud• 12 years ago

Having the hash would also be very valuable in case the CDN gets compromised so you don't inadvertently serve js malware to your users.

al2o3cr• 12 years ago

Sure, that sounds brilliant: allow anybody who can compute a hash collision to poison other sites' JS libraries. facepalm

rmrfrmrf4• 12 years ago

I want to know what privacy concerns you have regarding static CDNs that you don't implicitly give up by accessing the Internet.

anglebracket3• 12 years ago

Perhaps it's about time we had a way to specify the hash of <script> source inline so browsers can serve files from cache even if they are from different origins

A spec for just that was recently proposed[0], it even has support for a "canonical" script to be used in the event of that the hash check fails.

The good news is a polyfill for this can probably be created today. If CDNs serve their JS with the proper CORS headers, you can request the JS with cross-domain XHR and check it against a hash before eval()ing the script.

The bad news is that the polyfill would require you to allow `unsafe-eval` if you use Content-Security-Policy headers. Depending on your security model, it'd probably be best to host all your resources yourself. Not to mention that using a hash function written in javascript might negate any performance gains.

[0] http://w3c.github.io/webappsec/specs/subresourceintegrity/

jowiar• 12 years ago

This strikes me as something that, without a lot of thought, will expose a user's browsing history (similar to the old "check the visited link color" attacks). Insert script links with a hash, check to see if the browser makes a request.

sudomal• 12 years ago

Better yet, host it locally. More privacy for the user.

taspeotis2• 12 years ago

Reminds me of some article I read about having some fallback mechanism for when whatever CDN is serving up your JS fails. "Who controls downtime? You do."

davidgerard3• 12 years ago

Make sure your CDN has better uptime than you do. e.g. Google.

rmrfrmrf4• 12 years ago

    <script src="//ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>
    <script>window.jQuery || document.write('<script src="path/to/your/jquery"><\/script>')</script>

Source: http://stackoverflow.com/questions/1014203/best-way-to-use-g...

youngtaff• 12 years ago

I'd question whether this is a worthwhile fallback as depending on what the error is then the browser may still wait 30 (ish) seconds for the original request to time out.

rmrfrmrf4• 12 years ago

I look forward to seeing what you come up with.

csmithuk8• 12 years ago

Sky user here[1].

Turn it off then!

This is entirely optional. It asks you when you first install and connect the router via the WiFi landing page if you want to use any blocking. If you don't answer the question or select no, there is no blocking at all apart form the IWF firewall stuff. Every kind of blocking comes with problems of some description. You either live with it or trust your users.

[1] £7.50/month for ADSL2 for 12 months with line rental and calls included was too good a deal to throw away. I'd go for Andrews & Arnold if I could afford idealism at the moment.

voltagex_• 12 years ago

Interested Australian user here. That's about half of the cost of our cheaper monthly ADSL2 plans - what's the catch? How far away from the exchange are you?

csmithuk8• 12 years ago

Well I was an O2 customer. Sky bought O2 last year and in the effort to maintain their customer-base they will give you silly offers if you argue with them for long enough. It's usually £20.50/month including line rental but I argued it down to £7.50/month on the basis I stayed with them for 12 months.

No catch. Confirmed no traffic management, no download limit, free router, free migration. This is purely for customer retention.

I'm 800m away from the exchange and get 12.2Mbits down and 1.1Mbits up.

I pull an average of 120Gb/month over the line with no problems.

Edit: just to add I was paying £35.50/month with O2 before which is crazy amounts.

davb• 12 years ago

Sky don't have the best reputation when it comes to issue resolution. I was a former Sky broadband customer and found their customer care and technical teams to be woefully lacking. Additionally, they have no real SLA to speak of, and all of their service plans (as far as I understand) have a standard 1:50 contention ratio. Ouch. And when I was a customer (a couple of years ago), they refused to divulge the the ADSL (PPPoA) RADIUS credentials, making it much more difficult to use your own ADSL router.

For many users (especially your average home/family users with less technical requirements, not using it for critical purposes such as home working) they're probably perfectly adequate.

FWIW, I use BT's (formerly British Telecom) FTTC Infinity for Business product. 78Mbps down, 20Mbps up, worst case 1:20 contention, no caps or allowance-related FUP. Their customer care and technical teams are pretty decent. And I can get a /29 in addition to the dynamic PPP IP for the WAN link. Where I am (NE Scotland), BT own all of the widely available (non-private) infrastructure so it's easier to deal with a single company in the event of a failure vs being pushed between ISP and infrastructure provider. YMMV.

EDIT: FYI I pay £45 ex VAT (~AUD 102).

laumars3• 12 years ago

You're missing the point here. Some parents are not tech-savy and thus depend on the controls given to them by their ISP (etc) to help manage the level of access their kids have to the internet. Suggesting they simply turn off the parental controls doesn't actually fix the problem, it just shifts the problem (ie the problem is shifted from sites not functioning properly to kids having access to everything).

While I do agree that parental controls are not foolproof; occasionally legitimate sites get caught up in the blacklist and kids will usually find a way around many blocks, suggesting parents completely disable such censors is a little like throwing the baby out with the bath water.

csmithuk8• 12 years ago

Perhaps the parents should spend some time with their children and show them what is appropriate and what is not?

I have three children, all of whom use the Internet regularly and bar some passive monitoring, I've done nothing. They have healthy browsing habits.

Blacklists, censorship, firewalls and control are missing the point...

Plus you're going to get goatse'd at some point in your life...

johneth2• 12 years ago

I'd go for Andrews & Arnold if I could afford idealism at the moment.

I've heard Xilo are quite good regarding filtering, quality, etc., and they're cheaper than A&A.

csmithuk8• 12 years ago

I can't see any ADSL offerings on their site. Do you have a link?

rmc2• 12 years ago

(a) Non-techie mundane people have heard about the vast wave of horrible kiddie porn and grooming stalkers just waiting to kill your child. Why would they turn off the only thing protecting their loved ones from harm?[1]

(b) What should you do? Phone up the tech support line and tell them you (essentially) want to look at fisting porn? What if they recognise your voice? What if someone finds out that you want to look at all that dodge extreme porn sites?[1]

[1] I'm not saying this is accurate, just how some people think.

csmithuk8• 12 years ago

a) I know a lot of parents. Not one actually cares about this. They care more than some nasty piece of work will nick their child's phone on the way home, which is far more realistic and common. I reckon the 1% are noisier than the 99% here.

b) No - see my post. When you connect the router and hit it with the first WiFi connection, it is configured by default to allow everything. At which point you can then tell them you don't want oodles of fisting porn shoved at you or just ignore the question and carry on getting your fix.

The only thing these statements prove is that the noiser people are consistently more likely to be wallies.

maxcan• 12 years ago

to be fair, teaching direct dom manipulation is far more harmful to children than any amount of porn or violence.

jdorfman• 12 years ago

FWIW my company (MaxCDN) provides the CDN service for code.jquery.com. We are currently investigating this issue with Sky.

Edit: Just saw this: "It appears that the jquery CDN is unblocked once more on Sky connections where the phishing filter that is part of the parental controls system was enabled."

We will continue to work with Sky to prevent this from happening in the future.

Sky parental control system blocks code.jquery.com

Related Stories