Why are you conflating individually-trusted CDNs with the servers of some random guy?  And allowing only images, like most embeds do, is a form of sanitation.<p>I&#x27;ll repeat myself.  &quot;I think very few websites allow one person to embed arbitrary scripts that will be shown to another person.&quot;  This is not happening as a result of you using an image host.  No scripts are involved there.  This is not happening as a result of the site using a CDN.  No user triggered that load of jQuery.<p>It&#x27;s fine to load jQuery from a specific server that you trust.  It&#x27;s also fine to load ads from the ad network&#x27;s server, as long as they are policing uploads properly.  The problem is they usually don&#x27;t.