3 ms·

The project looks very promising but relies on running a lot of javascript from untraceable sources in the browser. Given the long history of vulnerabilities i

The project looks very promising but relies on running a lot of javascript from untraceable sources in the browser. Given the long history of vulnerabilities in the the browsers, trusting js from a well-known website might be OK, trusting js from zeronet is unreasonable. If ZeroNet could run with js code generated only by the local daemon or without js it would be brilliant.

blitmap 10y ago
Chrome added a feature a long while back I really wanted for ages. The ability to specify the checksum of a linked asset, so that it can be verified as it's downloaded (and untrusted/discarded if not). I just can't find the docs for it. :( My Google-fu is not strong. EDIT: Found it :D https://w3c.github.io/webappsec-subresource-integrity/ https://w3c.github.io/webappsec-subresource-integrity/
- gog 10y ago
  It's called Subresource Integrity, see https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/ https://hacks.mozilla.org/2015/09/subresource-integrity-in-f... and https://www.w3.org/TR/SRI/ https://www.w3.org/TR/SRI/ Browser support is noted here: http://caniuse.com/#feat=subresource-integrity http://caniuse.com/#feat=subresource-integrity
  - blitmap 10y ago
    It's kind of a shame they didn't let their imagination fly with that one... I wish integrity were a global attribute, because I could totally see using it for things like images and audio/video.
    - Ajedi32 10y ago
      It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... Another option would be to just use a subresource-integrity protected script to check the hash of a downloaded image/video before displaying it.
      - blitmap 10y ago
        That is clever and I like you.
    - StavrosK 10y ago
      And then any site could check whether you've seen a particular image before just by including it and seeing how long it takes to load, yay!
- wyldfire 10y ago
  I was pretty sure I knew what you meant but to be a bit more explicit: it's a real integrity check using hashes and not merely a checksum.
  - vog 10y ago
    If we are nitpicking like this: It uses cryptographic hash functions and not merely the hash functions commonly used by hash tables.
- eeZah7Ux 10y ago
  Nice feature but you need to trust the HTML page that is pulling the js. ZeroNet allows any HTML page to pull any script.
  - blitmap 10y ago
    And... we're back to loving IPFS :3
zeveb 10y ago
This is why native clients (real native clients, not browsers-in-cans) are so important: they enable one to be more secure against targeted attacks, and they enable many eyes to review code and hence make one more secure against untargeted attacks. Frankly, given much of the history of successful Internet tools & protocols, I'd love to see some text-UI clients for ZeroNet.

blitmap 10y ago

Chrome added a feature a long while back I really wanted for ages. The ability to specify the checksum of a linked asset, so that it can be verified as it's downloaded (and untrusted/discarded if not). I just can't find the docs for it. :( My Google-fu is not strong. EDIT: Found it :D https://w3c.github.io/webappsec-subresource-integrity/ https://w3c.github.io/webappsec-subresource-integrity/

gog 10y ago
It's called Subresource Integrity, see https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/ https://hacks.mozilla.org/2015/09/subresource-integrity-in-f... and https://www.w3.org/TR/SRI/ https://www.w3.org/TR/SRI/ Browser support is noted here: http://caniuse.com/#feat=subresource-integrity http://caniuse.com/#feat=subresource-integrity
- blitmap 10y ago
  It's kind of a shame they didn't let their imagination fly with that one... I wish integrity were a global attribute, because I could totally see using it for things like images and audio/video.
  - Ajedi32 10y ago
    It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... Another option would be to just use a subresource-integrity protected script to check the hash of a downloaded image/video before displaying it.
    - blitmap 10y ago
      That is clever and I like you.
  - StavrosK 10y ago
    And then any site could check whether you've seen a particular image before just by including it and seeing how long it takes to load, yay!
wyldfire 10y ago
I was pretty sure I knew what you meant but to be a bit more explicit: it's a real integrity check using hashes and not merely a checksum.
- vog 10y ago
  If we are nitpicking like this: It uses cryptographic hash functions and not merely the hash functions commonly used by hash tables.
eeZah7Ux 10y ago
Nice feature but you need to trust the HTML page that is pulling the js. ZeroNet allows any HTML page to pull any script.
- blitmap 10y ago
  And... we're back to loving IPFS :3

zeveb 10y ago

This is why native clients (real native clients, not browsers-in-cans) are so important: they enable one to be more secure against targeted attacks, and they enable many eyes to review code and hence make one more secure against untargeted attacks. Frankly, given much of the history of successful Internet tools & protocols, I'd love to see some text-UI clients for ZeroNet.