3 ms·

Yes, there is no JS source signing in the browser yet. Then again, do you check the (compiled) code that is delivered to you via source repositories with which

by edejong 10y ago

Yes, there is no JS source signing in the browser yet. Then again, do you check the (compiled) code that is delivered to you via source repositories with which you sign/encrypt your GPG messages? How many people read the OpenSSL source code? How trustworthy are the signatures on Debian packages?

haywirez 10y ago
What about SRI? "Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match." [0] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- StavrosK 10y ago
  SRI is a great way to make an html page that loads all the js from a server, tell the user to store that locally, and be sure that the loaded js files will never change (otherwise they won't get loaded).
  - eli 10y ago
    Why not just store all the js locally too?
    - Tepix 10y ago
      It's slower but also provides better privacy.
    - StavrosK 10y ago
      Purely for UX, it's easier to say "save the page you're currently viewing" than "save this page and also these files". It's not a huge difference, though, as you noted.
witty_username 10y ago
At least with the Debian system it might be possible to get some information about the attackers.