Why I am getting a front-end SPOF here?

Site alerted by SPOF-O-Matic:

Reported: Possible Frontend SPOF from: http://www.telegraph.co.uk/culture/film/11185627/Edward-Snowden-the-true-story-behind-his-NSA-leaks.html

cdn.optimizely.com - Whitelist
(100%) -
assets.adobedtm.com - Whitelist
(99%) -
d3c3cq33003psk.cloudfront.net - Whitelist
(94%) -
pixel.quantserve.com - Whitelist
(91%) -
player.ooyala.com - Whitelist
(90%) -
widgets.outbrain.com - Whitelist
(56%) -
telegraphuk.disqus.com - Whitelist
(15%) -

You wonder what a SPOF is read here: http://www.stevesouders.com/blog/2010/06/01/frontend-spof/

polonus

Hi Polonus,

Outbrain is an advertisment (simular content) script, Disqus is a commenting system (known for having holes in it’s security). optimizely is a site analytics tool to measure server load on client side (live preview of inbound traffic as well). qauntserve is a statics module (often used with the default jetpack analytics module). and adobetm is connected to the Adobe Marketing Cloud (statics with a digital tag)

Ooyala is a video cdn from what i could recall.

Hope this helps!
Oliver

New info, Oliver, coming up, good you assist with this research… :wink:

I could not resist to run the alerted extension SPOF-O-Matic results against the online Tracker Tracker,
see these results attached, widgets, trackers, ads. Do not open links given there in a browser - all info just just for research purposes. The only resource that did not was ssets.adobedtm.com, but alerted for another reason.
See this: https://www.mywot.com/en/scorecard/assets.adobedtm.com?utm_source=addon&utm_content=popup
Where the WOT page is also a Possible Frontend SPOF from:

fonts.googleapis.com - Whitelist
(99%) -
(99%) -

Interesting experiments here, mapping the monitoring for you all - and the website technology errors of-course.

polonus (volunteer website security analyst and website error-hunter)

Hi Webmaster,

Look at the scripts, stylesheets, and font files in your web page from a worst case scenario perspective. Ask yourself:

Is your web site’s availability dependent on these resources?
Is it possible that if one of these resources timed out, users would be blocked from seeing your site?
Are any of these single point of failure resources from a third party?
Would you rather embed resources in a way that avoids making them a frontend SPOF?
Make sure you’re aware of your frontend SPOFs, track their availability and latency closely, and embed them in your page in a non-blocking way whenever possible.

Above quote taken from Stevesouders.com

Link for testing: http://blog.patrickmeenan.com/2011/10/testing-for-frontend-spof.html

polonus

Combine these resources: SPOF-O-Matic extension for Google Chrome, online Tracker Tracker (do not forget to update):
https://tools.digitalmethods.net/beta/trackerTracker/ and http://www.cookiechecker.nl/ or similar.
Found at first sight that Google Ad tracking code and JQuery code could be the cause of most front-end SPOFs, example
(72%) - <script type=“text/javascript” src="htxps://apis.google.com/js/plusone.js

polonus

Here we have a posting from someone who reacts on the slow pageloading because of
http://stackoverflow.com/questions/15085555/how-to-increase-page-loading-speed-with-addthis-widget
This is the same Front End SPOF we meet at the killmalware webscanner site:
Asynchronous loading may help here - of course a lot of browser users may decide to block such scripts in the first place.
This is the total load time of the killmalware page:
File Type Time (sec.)
HTML 0.16 s.
JavaScript/VB Script - see: http://www.spyrush.com/load/killmalware.com
Also compression is adviced.
See the site trackers here: http://toolbar.netcraft.com/site_report/?url=http%3A%2F%2Fkillmalware.com%2F

polonus