Remove CDN and Google dependencies

rfc2822

Hello,

I suggest to (may be as an option?) replace CDN (at the first glance, there's bootstrapcdn.com and cdnjs.cloudflare.com) and Google dependencies (fonts.googleapis.com in the CSS) by local files because

I don't think it's good practice to spread our visitors' data (maybe including referrer etc.) all over the world for privacy reasons (for instance, Google Fonts are a free visitor counter for Google, and I don't want Google to track [probably with Google cookie, i.e. bound to a specific user] which users visit our site),
it would make us independent of these services. If a CDN chooses to take down the .js because it doesn't meet their requirements or for whatever reason, all NodeBB instances will be unusable,
site loading may even be faster because there are no additional DNS lookups and some gzipped JS and font files should be transferred quickly by any server.

It would be a really good feeling to get back control over the whole forum and not having to trust CDNs and Google.

Thanks for your awesome work!

Jacob Moen

CDNs will make the site load faster - that's what they're for - so that users around the world does not have to go all the way to your server to fetch resources, but can fetch them closer to their location.

rfc2822

@Jacob-Moen said:

CDNs will make the site load faster - that's what they're for - so that users around the world does not have to go all the way to your server to fetch resources, but can fetch them closer to their location.

Thanks, I know what CDNs are used for And I want our users to fetch our resources, and not the resources of Google (or Akamai, or Amazon, or whoever else), and get tracked at the same time.

Jacob Moen

I knew that you know that
I merely want to point out that CDN is not entirely evil - it makes a difference in how fast the site loads, especially on mobile devices.
cdnjs is an open source CDN - I think that there might be other options.

bitspook

I believe that I read with Google Fonts that you can store a copy on your server and they don't get fetched. Privacy concerns are, and should be, paramount.

Jacob Moen

I agree that it should be optional.
I would like to have the choice myself.

rfc2822

@bitspook said:

I believe that I read with Google Fonts that you can store a copy on your server and they don't get fetched.

It was possible once, but (for obvious reasons) Google has stopped that. However, you can still generate/download Web fonts, for instance on www.fontsquirrel.com (my favorite site).

Privacy concerns are, and should be, paramount.

Maybe it could be implemented as a set of URL variables + a switch that chooses between the self-hosted and the CDN set?

julian

For all intents and purposes, the only dependency we call out to is Google Web Fonts, and that's mostly a theme decision, so that's not a problem to revise (either now, or in a future default theme)

Where's the call to bootstrapcdn?

phit

@julian https://github.com/NodeBB/NodeBB/search?utf8=✓&q=maxcdn&type=Code

an option to turn that off in favor of local css would be nice, and would also improve performance when http/2 is in use

julian

Ah, skins. Yes, we could extract that out to a plugin...

Alien

Yep... I think "googleapis" in China is too slow... And many CDN are slow in China,too. I want to replace them, but I don't know what should I do. Is there anybody can help me?

sanatisharif

many CDN are slow in IR IRAN,too!
this is a nice feature if we can replaced them!

Alien

@sanatisharif
Yes!

Andy1999

@Alien I think you could use MoeCDN