5 ms·
This is the first I've heard of this. Is this currently in the HTML specification or in actual use, or are you proposing such functionality be added to the spec
by ldjb 11y ago
This is the first I've heard of this. Is this currently in the HTML specification or in actual use, or are you proposing such functionality be added to the spec?
- theandrewbailey 11y agoIt's called Subresource Integrity. I just implemented it on my blog yesterday. It only works on CSS and JS, but image support is supposedly coming. I highly doubt that it would be a good idea for hyperlinks. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- majewsky 11y agoI would argue it's a bad idea for images already. Images give away a lot about the type of content that you're viewing, which is possibly sensitive information. Consider, for example, a Chinese computer connecting to Wikipedia over HTTPS, which then downloads an image over HTTP without S that is clearly related to the Tiananmen massacre.
- theandrewbailey 11y agoI'm not saying that it's a replacement for HTTPS. Nothing stops you from using SRI hashes for HTTPS content. If you're concerned over censorship, you should be using HTTPS, period. SRI is more concerned about bad CDN content. Your CDN can use HTTPS, but your server's page says what the hash should be, so if your CDN goes rouge, things will start breaking.
- geofft 11y agoWorth noting: subresource integrity doesn't currently change the mixed-content algorithm at all. An HTTPS site can't load an HTTP + SRI script. It's useful for increasing the status quo on HTTP pages, or for defense-in-depth on HTTPS pages, but it doesn't actually enable you to do anything you couldn't before.