This question is similar to Is it safe to whitelist CDN domains?, but is focused on the user's perspective.
It seems common in American business websites to use a CDN that presents partially random subdomains to load Javascript for core functionality. The most common example I find is <somehash>.cloudfront.net
.
Users with a domain name-based blocker like NoScript have a usability/security problem here: They need to load the JS from the CDN domain, but the domain name isn't memorably or deterministically (from the user's perspective) linked to the site. So it's difficult for them to verify whether or not that subdomain is providing trustworthy JS for that site, especially if its source is subject to change.
So what's a good habit for a user here? Trust on first use? When the hashed subdomain changes, what do they do then? What are the significant risks here?