Is referencing jQuery from ajax.googleapis.com bad practice?

Question

I've seen it recommended to reference jQuery via:

<script type="text/javascript" 
    src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"&gt;
</script>

The idea being most people already have a cached copy on their client.

What if a hacker replaces that file on google's server? They could do an infinite number of "evil" things from $(document).ready().

Am I paranoid or is this bad practice?

Edit: Obviously this is a matter of opinion. But I think the best answer is ceejayoz comment

It might be illegal for a bank. Check your local privacy and data security laws.

Answer 1

Google has far more tempting targets than their jQuery host (unless it gets used by banks), so I wouldn't worry too much.

Also, I would guess that your webserver is easier to hack than Google's servers.

Answer 2

No, just keep in mind that a minority of users (very small minority) may have google blocked. If you're worried about hackers taking over Google's jQuery source, you shouldn't feel safe doing anything, anywhere online.

Answer 3

Personally I choose to self-host the jquery library file for this reason amongst others. "If" the file was hacked yes I could see it a security risk. Plus if the file becomes unavailable for any reason to a user all of your clientside functionality breaks. It's unlikely, but still a risk I don't like.

The little amount of time saved for the user by referencing the external script is not worth the tradeoff IMO. Beyond the first load of the script core, caching will be the same anyway no matter where it's stored...