Vendor third-party assets (leaflet)

[benjaoming]

We currently have 2 assets that should be moved:

• Leaflet CSS on unpkg
• Leaflet JS on unpkg

They should be vendored locally.

As for OpenStreetMaps itself, we can't host that :) But I think the privacy policy for embedding OSM doesn't require a website to forward anything to their users (?)

Summarizing the rationale:

• Making this static site functional in 10 years: CDNs are known to suddenly disappear
• In a few cases a CDN has temporarily been taken over maliciously
• unpkg.com has no known privacy policy (although appearing friendly-minded towards privacy in some GitHub issues)
• We don't wanna have to add a privacy policy to the website

[ulgens]

They should be vendored locally.

Why? Calling them over a CDN is well enough IMO.

[benjaoming]

I'd like the birthday site to exist in 10 years, but I think a CDN might disappear in that time span. A single domain like unpkg.com might even be taken over by malicious people.

Some people might block it through browser extensions.

Lastly, it'd be nice to not need a privacy policy on the site. I think unpkg.com is hosted on CloudFlare and unpkg is included in ~1% of all traffic on the internet [1]. The fact that it has no privacy policy also makes it hard to really write anything meaningful in our own privacy policy (maybe source something about CF). It seems to be a strange thing to omit in such a popular CDN. I dunno, but I feel like having stuff like this makes it necessary to have a privacy statement 🤷

Come to think of it, just one person runs that domain. Well, good thing we have the integrity parameter now, otherwise I'd also put a pretty big security flag on it 😄

[1] https://www.ghostery.com/whotracksme/trackers/unpkg.com

[ulgens]

I'd like the birthday site to exist in 10 years, but I think a CDN might disappear in that time span. A single domain like unpkg.com might even be taken over by malicious people.

That's a nice point. Could we include that in the description too?

[benjaoming]

Oh yeah a think I remembered: There is a way to have the youtube embeds (that'll land in the timeline) without a privacy statement, but simply having a button inside the frames that says that the embed is from youtube etc... will open an issue for that.