We build sites that have a public (non-secured) area and secured (delivered over HTTPS) area and we use jQuery library.
Recently I suggested we use Google CDN for jQuery delivery. Some of my colleagues expressed concerns in regards to security aspect of this way of delivering JavaScript libraries.
For example, they mention the scenario where someone might hijack DNS server and then inject maliciously modified library, opening the door for different security attacks. Now, if hacker can inject malicious code through Google CDN, then he can probably do the same if jQuery is served from the site itself, right?
It seems that google CDN supports serving libraries over SSL.
Is serving jQuery from CDN really less secure then serving it from the server itself? How serious is this threat?