41

I have used SO at work for almost 2 years now without problem. Last week, I started getting a red banner across the top saying javascript from an external server was being blocked. My IT guys said Google APIs are "very malware prone security risks", and they have blocked those for a long time. Because I just started having this problem, their conclusion was SO must have just recently started using them, and so I was out of luck, ticket closed. No more SO as a work resource for me.

Is this anywhere near true? Is there something else that might be causing that red banner to pop up?

19
  • 54
    SO has used the Google CDN for a very long time. Your IT guys may want to review their policy. (imo their reason is moronic)
    – user247702
    Commented Dec 8, 2017 at 11:25
  • 1
    No arguments from me on the lack of love for my IT guys. I just can't reopen the trouble ticket unless I can point to something else that might be causing it.
    – SandPiper
    Commented Dec 8, 2017 at 11:29
  • 4
    They switched to using Google Ads a month ago or so. But that should be independent of the working of the other scripts. Also it would immensely help if you could open a dev console and share which scripts fail to load.
    – rene
    Commented Dec 8, 2017 at 11:32
  • 2
    also see What else do I need
    – rene
    Commented Dec 8, 2017 at 11:38
  • 2
    jquery.min.js and analytics.js comes from google servers, which raises the question of why we're still needing jquery on a site targetted at developers but that's a different disucssion. It would be easier to have an opinion here if we knew what exactly is being blocked, like rene said.
    – ivarni
    Commented Dec 8, 2017 at 11:40
  • 2
    @ivarni didn't they drop everything else and use jQuery instead?
    – rene
    Commented Dec 8, 2017 at 11:43
  • 3
    It has been going on for quite some time, and as another SO user who works in a place where google apis are blocked, I find this extremely annoying.
    – martin
    Commented Dec 8, 2017 at 13:30
  • 2
    You probably only started having the problem recently because those resources cache for a while. If you can flip on a vpn or physically move the machine to a location where google apis are allowed to let the browser load the jquery, you should be set for a while.
    – martin
    Commented Dec 8, 2017 at 13:32
  • 5
    Just deploy the file somewhere else under the same URL and change your .hosts file. Sounds like less hassle :)
    – ivarni
    Commented Dec 8, 2017 at 14:08
  • 12
    For the record, we noticed in our offices the issue of ajax.googleapis.com/ being required on StackOverflow starting November 30th 2017. We didn't raise the issue on meta because we thought it was the Great Firewall of China. But you're in Nebraska, so it's now likely also an issue from StackOverflow itself.
    – Cœur
    Commented Dec 9, 2017 at 8:00
  • 13
    @Stijn There are valid reasons not to allow Google CDNs (or any other CDN, for that matter). Mainly privacy is a concern (in fact, there are talks inside the EU to ban loading of external resources), since Google can easily use their CDN to create profiles of users. Yes, the reasons as given are moronic, but try to explain how that tracking works to the average employee - "its prone to malware" is easy to understand (its bad), and thus sometimes the best you can do.
    – Polygnome
    Commented Dec 9, 2017 at 15:54
  • 3
    That's odd @Cœur, I've had to whitelist ajax.googleapis.com in NoScript for a couple of years at least.
    – halfer
    Commented Dec 9, 2017 at 16:22
  • 2
    @Polygnome: exactly. I would imagine that Google and other CDN providers would use usage data to enhance their advertising and search intelligence data, but who can say where the privacy boundaries are these days?
    – halfer
    Commented Dec 9, 2017 at 16:28
  • 4
    See also what value do we actually get from the CDN?
    – Jeremy Banks Mod
    Commented Dec 9, 2017 at 23:06
  • 3
    Shouldn't SO fallback to using a local copy of any external resource anyway? If a CDN goes down (however unlikely) then that should be a fallback.
    – DavidG
    Commented Dec 10, 2017 at 20:27

2 Answers 2

19

I'm facing the same problem in China (the evil government has blocked all of Google).

My solution is a plugin (I use Google Chrome), Resource Override. I downloaded a copy of that JS with VPN and put it in a constant directory in my computer. Then I configured Resource Override to replace the request to Google AJAX Library with my own copy of the script, then everything starts working well.

Disclaimer: I'm not affiliated with that plugin in any way, it's recommended by peers in my school. I share it here on Meta Stack Overflow only because I think it's useful for me and may potentially be useful to anyone else.

2
  • 2
    An alternative for Firefox might be PourBico (not affiliated). It's not Quantum compatible though, in Quantum you could probably use userscripts to achieve this.
    – Erik A
    Commented Dec 10, 2017 at 12:19
  • Decentraleyes emulate the most common cdn, works with Firefox, Chrome and Opera.
    – mantal
    Commented Dec 11, 2017 at 10:13
6

I think the ajax.googleapis.com domain has been in use on Stack Overflow for a long time - I have had to whitelist it in NoScript for a couple of years at least.

For me, this just fetches the following resource:

https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js

What you could do, if googleapis.com is blocked completely for you, is to alias this in your local hosts file to 127.0.0.1, and then get your development machine to host a copy of this file using IIS or Apache, including the full directory path.

Since Stack Overflow is now an HTTPS site, you'd also need to generate a self-signed certificate, and get your browser to trust that.

There does not seem to be any markup verification (using JS file hashes) that would prevent this working, so it might be worth a try.


Or, if that sounds like a lot of hassle, you could bring in a tablet computer with your own internet connection, and just use Stack Overflow on that. However, you'd lose the ability to easily copy+paste between SO and your editor, so I'd personally go with the first option.

5
  • would 172.217.9.170 ajax.googleapis.com work as well or not? (not in office to try right now)
    – Cœur
    Commented Dec 9, 2017 at 16:34
  • @Cœur: it depend on Google's configuration, and my guess would be no - even if that points to another copy that is for some unusual reason not blocked by the OP's firewall, I would imagine it would be brittle. Google would likely detect the anomaly automatically and block it as a possible unknown security threat. It is probably just more reliable to self-host.
    – halfer
    Commented Dec 9, 2017 at 16:37
  • 3
    Only adding to the hosts file isn't enough, you also need to generate a fake ssl certificate and import it
    – Ferrybig
    Commented Dec 10, 2017 at 19:27
  • Good point @Ferrybig, added.
    – halfer
    Commented Dec 10, 2017 at 20:22
  • 2
    Yes, googleapis.com has been listed on Which browsers are officially supported, and what else do I need? (near "The following sites should be accessible") for many years (since rev. 7, 2011-04-25). Commented Dec 10, 2017 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .