am I weird in that I'd prefer to host a known version of a dependency than effectively hot-link like this? Avoiding this sort of attack is a just a side-benefit to the main premise of knowing that its always going to work consistently.