3 ms·
That is absurd. To prevent malicious modifications and data leak you can just host code on your own server. Using free CDN (without SLA) you just increase your
by codedokode 11y ago
That is absurd. To prevent malicious modifications and data leak you can just host code on your own server. Using free CDN (without SLA) you just increase your site downtime and get nothing in return (well except that company and NSA can now collect IPs, UAs and referers of your users).
CDNs are used to optimize traffic cost but hosting just single JS library there won't save you much.
Calculating hashes is bothersome and requires modification of an app so probably nobody is going to use it.
I never use libraries hosted at free CDNs.
EDIT: I cannot think of a scenario where this feature can be useful.
EDIT 2: And you cannot use this feature for scripts like Google Analytics because they can be modified anytime.
- err4nt 11y agoIt's not just about CDN-hosted files, it's also a way to not execute untrusted JS. Let's say you have a high-traffic WordPress site with a dev environment. You might have a clean theme and know all your JS, but be using plugins other people have written. Using this it looks like you could put the hash in your markup and if their JavaScript code changed it wouldn't execute. For some people having that deadman's switch might be better than an always-execute policy on JS that you aren't writing yourself.
- codedokode 11y agoThere is CSP ( https://en.wikipedia.org/wiki/Content_Security_Policy https://en.wikipedia.org/wiki/Content_Security_Policy ) to protect againgst inclusion of unapproved third party scripts. Hash check won't help against malicious WP themes because they would not output integrity attribute into generated HTML.
- Kenji 11y agoYou are right in everything you say here. I don't know why you are downvoted. Cross-domain JavaScript is cancer and most if not all websites that follow this practice could do without it.