[RFC|Merged] Use Google's jQuery

[Oleg]

On privacy regarding Google CDN:

Just as a note, after a bit of searching I found that Google's CDN does not use cookies. The only things that it could see are referer headers and the IP addresses of the clients themselves.

Google sets cookies on .google.com. Google ajax apis recommends using their loader for loading the libraries, which lives on www.google.com.

A more reasonable position than "google does not use cookies! party!" would be "it so happens that right now google is tracking you via means other than cookies".

[/a3]

But will phpBB be using the loader? That is not something that comes in standard with jQuery, and if plain jQuery is being provided I don't see why their API would be needed.

I've checked online, and it appears that the loader exists for performance, and so that theoretically any JavaScript library can be loaded using their loader. That's not really a requirement here, I don't believe. I do understand what you're saying, but in this case using their CDN for plain jQuery shouldn't lead to any problems with cookies.

[naderman]

I do understand what you're saying, but in this case using their CDN for plain jQuery shouldn't lead to any problems with cookies.

I don't think you do. Any HTTP request to *.google.com will transmit google cookie information and any such response can set cookies, no matter how it's made.

[wGEric]

I don't think you do. Any HTTP request to *.google.com will transmit google cookie information and any such response can set cookies, no matter how it's made.

The domain for the CDN is ajax.googleapis.com and not google.com. It appears that no cookies get set on .googleapis.com.

https://ajax.googleapis.com/ajax/libs/j ... ery.min.js
https://ajax.googleapis.com/ajax/libs/j ... /jquery.js

[/a3]

I don't think you do. Any HTTP request to *.google.com will transmit google cookie information and any such response can set cookies, no matter how it's made.

The domain for the CDN is ajax.googleapis.com and not google.com. It appears that no cookies get set on .googleapis.com.

https://ajax.googleapis.com/ajax/libs/j ... ery.min.js
https://ajax.googleapis.com/ajax/libs/j ... /jquery.js

Yes, that's what I meant, apologies for any confusion.

I've checked on a few friends computers (who never clear their cookies) and they didn't have any cookies from either ajax.googleapis.com or googleapis.com. Also checking the HTTP headers of those files confirms that those files alone don't set cookies (although if they were previously set they would be sent).

[callumacrae]

http://googlegeodevelopers.blogspot.com ... -news.html

"Services on googleapis.com are guaranteed to never set cookies, nor do they ever receive google.com cookies."

[naim]

About privacy, (The whole "should we use google's jQuery...). Google probably doesn't set cookies on the clients browser...
but like already said, they can track you in other ways... (The client must connect to their server...)

What about letting the admin to add custom CDNs and by default add all the main ones and a choice to use the one that comes with phpBB, and then let the user choose from a list of CDNs on UCP...

[callumacrae]

About privacy, (The whole "should we use google's jQuery...). Google probably doesn't set cookies on the clients browser...

http://googlegeodevelopers.blogspot.com/2011/10/grab-bag-of-maps-api-news.html

"Services on googleapis.com are guaranteed to never set cookies, nor do they ever receive google.com cookies."

but like already said, they can track you in other ways... (The client must connect to their server...)

already said

What about letting the admin to add custom CDNs and by default add all the main ones and a choice to use the one that comes with phpBB, and then let the user choose from a list of CDNs on UCP...

Already discussed and decided:

I will bring this down to a single Yes/No option using the Google CDN then.

That's exactly what the goal now is, please read the topic before you reply.

Please read the previous posts, we discussed this quite a bit.

[VSE+]

Despite all this tangential discussion, the patch is finished, as far as I'm concerned, and is just sitting up there at Github awaiting action from the Dev team gurus.

[Oleg]

Merged.