Vendor third-party assets (leaflet)

[benjaoming]

We currently have 2 assets that should be moved:

• Leaflet CSS on unpkg
• Leaflet JS on unpkg

They should be vendored locally.

As for OpenStreetMaps itself, we can't host that :) But I think the privacy policy for embedding OSM doesn't require a website to forward anything to their users (?)

Summarizing the rationale:

• Making this static site functional in 10 years: CDNs are known to suddenly disappear
• In a few cases a CDN has temporarily been taken over maliciously
• unpkg.com has no known privacy policy (although appearing friendly-minded towards privacy in some GitHub issues)
• We don't wanna have to add a privacy policy to the website

[ulgens]

They should be vendored locally.

Why? Calling them over a CDN is well enough IMO.

[benjaoming]

I'd like the birthday site to exist in 10 years, but I think a CDN might disappear in that time span. A single domain like unpkg.com might even be taken over by malicious people.

Some people might block it through browser extensions.

Lastly, it'd be nice to not need a privacy policy on the site. I think unpkg.com is hosted on CloudFlare and unpkg is included in ~1% of all traffic on the internet [1]. The fact that it has no privacy policy also makes it hard to really write anything meaningful in our own privacy policy (maybe source something about CF). It seems to be a strange thing to omit in such a popular CDN. I dunno, but I feel like having stuff like this makes it necessary to have a privacy statement 🤷

Come to think of it, just one person runs that domain. Well, good thing we have the integrity parameter now, otherwise I'd also put a pretty big security flag on it 😄

[1] https://www.ghostery.com/whotracksme/trackers/unpkg.com

[ulgens]

I'd like the birthday site to exist in 10 years, but I think a CDN might disappear in that time span. A single domain like unpkg.com might even be taken over by malicious people.

That's a nice point. Could we include that in the description too?

[benjaoming]

Oh yeah a think I remembered: There is a way to have the youtube embeds (that'll land in the timeline) without a privacy statement, but simply having a button inside the frames that says that the embed is from youtube etc... will open an issue for that.

[kehach07]

Hello @benjaoming @ulgens , I'd like to take this issue! 👍
Totally agree with the point about vendoring Leaflet locally for long-term stability and privacy.
We just need to stay aware of updating the vendored files when new versions are released — maybe we can mention that in the README for clarity.
I’ve started working on this issue. Let me know when it would be a good time to attach my PR — I’d appreciate your feedback once it’s ready. 😊

[ulgens]

Let me know when it would be a good time to attach my PR

When it's ready? I mean, there is no special time for contributions in this repo.

[kehach07]

@ulgens, @benjaoming , my work is ready — I’ll be creating a PR for this shortly.
Before that, I just wanted to confirm whether it’s okay to update the README file with the commands for updating Leaflet versions.
This will make it easier to automatically update to newer versions in the future while retaining the existing setup.

[ulgens]

Does that need a set of commands? I was expecting that downloading and saving a new version of leaflet could simply do the job.

[kehach07]

@benjaoming @ulgens, I’ve created a PR for this issue — please review it and let me know if there are any areas where I can improve or make it better.
#114

[kehach07]

@ulgens, Yes, that’s alright — we already have the vendored Leaflet and MarkerCluster files committed, so there’s no need to run any setup commands.
The PowerShell commands are just included as an optional helper in case we want to update to newer versions later on.
They make it easier to quickly re-download and replace the existing files without doing it manually.