Jquery and bootstrap risk for Tor Hidden service

Question

If you make a tor hidden service which has scripts and CSS (the whole core) of bootstrap and the whole Jquery library in the server (and included in the pages).

Can you deanonymize the tor hidden website?

We hear alot that Javascript, Flash Player and more... is really bad for the user to run because it might deanonymize them, but those it work the other way? Can it deanonymize the server?

From what I have read the Tor Bundle activates Javascript by default now because they say too many sites requires Javascript but does the majority of users have Javascript activated?

Answer 1

No, there is no increased risk to services based on the kind of file you serve.

HTTP is agnostic about the kind of data that is transfered over it.

Serving .css or .js files is the same as serving .exe files from the perspective of an HTTP server.

The risk is in the client who is reading and executing the code provided by the remote server. The server is, generally, not at risk based on the type of content served. There are some potential corner cases to this rule but they don't apply to simply serving .js or .css files to clients.