4 ms·

I'm excited that they're now based on a Firefox branch that supports Subresource-Integrity. This allows websites to add hashes of externally called resources, l

I'm excited that they're now based on a Firefox branch that supports Subresource-Integrity. This allows websites to add hashes of externally called resources, like JS or CSS files, to let the browser determine if they've been modified.

runeks 10y ago
I'm very happy to hear this practice has become reality. It just seems so much more convenient to refer to all these JS/CSS blobs with a universally unique ID (a hash), rather than whichever CDN the developer has chosen to use. As an ID, a 32 byte cryptographically secure hash really is practically the same as http://somecdn.com/somejslib/v0.1.js.min http://somecdn.com/somejslib/v0.1.js.min, except that only a single ID exists for each "shared object", plus the ID can be derived deterministically from the object it refers to. Perhaps each CDN could have a symlink in its root directory with the hash of each file it serves, redirecting to that file. Then you'd be able to find any file by its hash as long as you have the CDN host name. EDIT: I see now this is a security measure (protection against a hostile CDN), rather than a way to avoid dependence on a single CDN. I hope what I suggest is still possible though.