3 ms·

The first time I read your post I thought you might be referring to some of the stuff addressed in: http://www.html5rocks.com/en/tutorials/security/content-secu

The first time I read your post I thought you might be referring to some of the stuff addressed in: http://www.html5rocks.com/en/tutorials/security/content-security-policy/ http://www.html5rocks.com/en/tutorials/security/content-secu... with the sha1 hashes for scripts. There is also the idea of bundling in popular scripts to the browsers themselves. There are a few different discussion threads on StackOverflow about it like http://stackoverflow.com/questions/8287607/why-is-jquery-not-integrated-within-the-browser http://stackoverflow.com/questions/8287607/why-is-jquery-not...

dheera 11y ago
The problem with bundling popular scripts into web browsers is that they evolve too fast. Also there would be inevitable politics (e.g. Microsoft and Apple invent and bundle their own equivalent to Google Polymer) and lack of standardization. On the other hand, organizations like the W3C move too slowly with respect to deciding new standards for widely-and imminently-needed features (hence band-aid solutions and meta-languages, whether server- or client-side, like jQuery, SCSS, CoffeeScript, etc.). HTML still doesn't have an standardized <input type="slider"> and it's 2015. So having these popular scripts, frameworks, and their ever-evolving versions is often a necessary evil, because new technologies and their markup necessities will keep appearing constantly into the future, and standards bodies will never catch up. Checksums for caching would solve the problem, while effectively achieving this "bundling" in a dynamic and democratized fashion, by "bundling" (=caching) whatever is encountered by the user at any given point in time into the future, and without having to update the browser software itself. Also, this strategy can be applied to commonly-used webfonts, images, icon sets, and so on. For example, although there are attempts to centralize fonts, such as Google Fonts, I'm still forced to use a local server copy in order to maintain site accessibility in China. Checksums would solve the same problem while decentralizing the whole initiative; as long as someone got the same font from Google Fonts or even another site's local copy, as long as the checksum matches, the browser wouldn't actually waste bandwidth fetching my local server copy.

dheera 11y ago

The problem with bundling popular scripts into web browsers is that they evolve too fast. Also there would be inevitable politics (e.g. Microsoft and Apple invent and bundle their own equivalent to Google Polymer) and lack of standardization. On the other hand, organizations like the W3C move too slowly with respect to deciding new standards for widely-and imminently-needed features (hence band-aid solutions and meta-languages, whether server- or client-side, like jQuery, SCSS, CoffeeScript, etc.). HTML still doesn't have an standardized <input type="slider"> and it's 2015. So having these popular scripts, frameworks, and their ever-evolving versions is often a necessary evil, because new technologies and their markup necessities will keep appearing constantly into the future, and standards bodies will never catch up. Checksums for caching would solve the problem, while effectively achieving this "bundling" in a dynamic and democratized fashion, by "bundling" (=caching) whatever is encountered by the user at any given point in time into the future, and without having to update the browser software itself. Also, this strategy can be applied to commonly-used webfonts, images, icon sets, and so on. For example, although there are attempts to centralize fonts, such as Google Fonts, I'm still forced to use a local server copy in order to maintain site accessibility in China. Checksums would solve the same problem while decentralizing the whole initiative; as long as someone got the same font from Google Fonts or even another site's local copy, as long as the checksum matches, the browser wouldn't actually waste bandwidth fetching my local server copy.