Skip to content

Conversation

@Joncom
Copy link
Contributor

@Joncom Joncom commented May 22, 2015

In his 2014 update to this article, @paulirish says:

If the asset you need is available on SSL, then always use the https:// asset.

Allowing the snippet to request over HTTP opens the door for attacks like the recent Github Man-on-the-side attack. It’s always safe to request HTTPS assets even if your site is on HTTP, however the reverse is not true.

@Joncom
Copy link
Contributor Author

Joncom commented Jun 11, 2015

In other words, this will allow your script to be used by applications served over HTTPS, which is currently broken. There's no downside here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant