3 ms·
I have to disagree. Typically, having a 3rd party CDN hosted library like jQuery change on you is most definetly un-expected behaviour and not desired. The mai
by jszymborski 11y ago
I have to disagree. Typically, having a 3rd party CDN hosted library like jQuery change on you is most definetly un-expected behaviour and not desired.
The main purpose for CDN hosted scripts is allowing them to be cached in your browser, reducing latency via close edge servers and load times across website via caching.
This proposal prevents malicious changes, as well cache poisoning, which was a very scary threat up until this announcement due to attack vectors like the one described in this defcon talk: https://www.youtube.com/watch?v=kLt_uqSCEUA https://www.youtube.com/watch?v=kLt_uqSCEUA
(PDF slides here: https://defcon.org/images/defcon-20/dc-20-presentations/Alonso-Sur/DEFCON-20-Alonso-Sur-Owning-Bad-Guys-Using-JavaScript-Botnet.pdf https://defcon.org/images/defcon-20/dc-20-presentations/Alon...)
- z3t4 11y agoFair enough. Add httpS to that and it will be a good security layer.
- simoncion 11y ago> The main purpose for CDN hosted scripts is allowing them to be cached in your browser... Hopefully, subresource integrity schemes will eventually allow browsers to fetch from local cache based on the checksum of the file contents, rather than the URI from which the resource is served. :)