5 ms·

I think the blogger was being an idiot. You should check the authenticity of what you are downloading, not just snag it. It's like eating a kebab dropped in t

I think the blogger was being an idiot. You should check the authenticity of what you are downloading, not just snag it. It's like eating a kebab dropped in the street.

reustle 15y ago
It's not the same. If I type jQuery into google, click one of the top results and the site looks exactly like the jQuery site, I'd probably be fooled too. The domain is close enough to not catch out of the corner of your eye.
- VMG 15y ago
  With the upcoming version of chrome, there won't even be a url bar. AFAIK firefox wants to get rid of it too. Now is this an argument for keeping the url bar? It's obviously error-prone, but the other methods of establishing identity don't seem to be there yet either.
  - icebraining 15y ago
    The URL bar will be there, it just won't be visible at all times, but it'll still appear when the page is loading or you select the tab.
Tashtego 15y ago
Whether he should have downloaded from that site or not, it's ridiculous that it was showing up above the official site in search results. That's his main point.
- chrisjsmith 15y ago
  I think the rediculous thing is more that he spent that much time making a blog post because he made a mistake whilst obviously trying to do something quickly without thinking.
aquark 15y ago
Technically how should he know jquery.com is more trusted than jquery.it? jquery.com does NOT appear to have a fully valid SSL certificate: Chrome gives me "the site's security certificate is not trusted!" Like it or not, Google is an important part of establishing reputation -- that's what pagerank was built on initially and if that becomes worthless then finding the true source of something becomes very difficult.
- VMG 15y ago
  Well, in this specific case, the header comment in http://code.jquery.it/jquery-1.6.2.js http://code.jquery.it/jquery-1.6.2.js still references jquery.com
- brown9-2 15y ago
  This is an interesting point - why does jquery.com have a https version in the first place? And why did someone bother to set it up with a self-signed certificate? Sounds like perhaps someone was testing something long back (cert was signed in 2009) and just never turned it off.
- patio11 15y ago
  jquery.com does NOT appear to have a fully valid SSL certificate Hypothetically supposing that jquery.com had a lovely little green lock, that wouldn't matter, because on jquery.it a) you wouldn't be looking for the lovely green lock and b) if you did look for it, look here, a lovely little green lock and c) you didn't click the lovely green lock to see who it was issued to but if you did d) it was issued to jquery.it, which matches the address in your bar. SSL solves one problem, really really nicely: it makes it impossible to eavesdrop between the user and a trusted endpoint. It does basically nothing to make sure that the trusted endpoint is the one the user thinks they are interacting with.
  - aquark 15y ago
    True -- the green lock itself wouldn't help here. I was thinking more along the lines of code signing certificates. When I visited by bank's web site and drill into the certificate details I can at least establish that someone my browser vendors trusts (or someone they trust ...) issued the certificate to an _organization_ called 'Bank of Nova Scotia' in Toronto, not just the domain name. If I was able to register micr0soft.com then hopefully I would have a hard time getting an SSL certificate issued for it. I know there have been a number of discussions on certificate infrastructure here that show how complex this can become.

I think the blogger was being an idiot. You should check the authenticity of what you are downloading, not just snag it. It's like eating a kebab dropped in the street.

reustle 15y ago

It's not the same. If I type jQuery into google, click one of the top results and the site looks exactly like the jQuery site, I'd probably be fooled too. The domain is close enough to not catch out of the corner of your eye.

VMG 15y ago
With the upcoming version of chrome, there won't even be a url bar. AFAIK firefox wants to get rid of it too. Now is this an argument for keeping the url bar? It's obviously error-prone, but the other methods of establishing identity don't seem to be there yet either.
- icebraining 15y ago
  The URL bar will be there, it just won't be visible at all times, but it'll still appear when the page is loading or you select the tab.

Tashtego 15y ago

Whether he should have downloaded from that site or not, it's ridiculous that it was showing up above the official site in search results. That's his main point.

chrisjsmith 15y ago
I think the rediculous thing is more that he spent that much time making a blog post because he made a mistake whilst obviously trying to do something quickly without thinking.

aquark 15y ago

Technically how should he know jquery.com is more trusted than jquery.it? jquery.com does NOT appear to have a fully valid SSL certificate: Chrome gives me "the site's security certificate is not trusted!" Like it or not, Google is an important part of establishing reputation -- that's what pagerank was built on initially and if that becomes worthless then finding the true source of something becomes very difficult.

VMG 15y ago
Well, in this specific case, the header comment in http://code.jquery.it/jquery-1.6.2.js http://code.jquery.it/jquery-1.6.2.js still references jquery.com
brown9-2 15y ago
This is an interesting point - why does jquery.com have a https version in the first place? And why did someone bother to set it up with a self-signed certificate? Sounds like perhaps someone was testing something long back (cert was signed in 2009) and just never turned it off.
patio11 15y ago
jquery.com does NOT appear to have a fully valid SSL certificate Hypothetically supposing that jquery.com had a lovely little green lock, that wouldn't matter, because on jquery.it a) you wouldn't be looking for the lovely green lock and b) if you did look for it, look here, a lovely little green lock and c) you didn't click the lovely green lock to see who it was issued to but if you did d) it was issued to jquery.it, which matches the address in your bar. SSL solves one problem, really really nicely: it makes it impossible to eavesdrop between the user and a trusted endpoint. It does basically nothing to make sure that the trusted endpoint is the one the user thinks they are interacting with.
- aquark 15y ago
  True -- the green lock itself wouldn't help here. I was thinking more along the lines of code signing certificates. When I visited by bank's web site and drill into the certificate details I can at least establish that someone my browser vendors trusts (or someone they trust ...) issued the certificate to an _organization_ called 'Bank of Nova Scotia' in Toronto, not just the domain name. If I was able to register micr0soft.com then hopefully I would have a hard time getting an SSL certificate issued for it. I know there have been a number of discussions on certificate infrastructure here that show how complex this can become.