4 ms·

Chrome added a feature a long while back I really wanted for ages. The ability to specify the checksum of a linked asset, so that it can be verified as it's do

by blitmap 10y ago

Chrome added a feature a long while back I really wanted for ages. The ability to specify the checksum of a linked asset, so that it can be verified as it's downloaded (and untrusted/discarded if not). I just can't find the docs for it. :( My Google-fu is not strong. EDIT: Found it :D https://w3c.github.io/webappsec-subresource-integrity/ https://w3c.github.io/webappsec-subresource-integrity/

gog 10y ago
It's called Subresource Integrity, see https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/ https://hacks.mozilla.org/2015/09/subresource-integrity-in-f... and https://www.w3.org/TR/SRI/ https://www.w3.org/TR/SRI/ Browser support is noted here: http://caniuse.com/#feat=subresource-integrity http://caniuse.com/#feat=subresource-integrity
- blitmap 10y ago
  It's kind of a shame they didn't let their imagination fly with that one... I wish integrity were a global attribute, because I could totally see using it for things like images and audio/video.
  - Ajedi32 10y ago
    It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... Another option would be to just use a subresource-integrity protected script to check the hash of a downloaded image/video before displaying it.
    - blitmap 10y ago
      That is clever and I like you.
  - StavrosK 10y ago
    And then any site could check whether you've seen a particular image before just by including it and seeing how long it takes to load, yay!
wyldfire 10y ago
I was pretty sure I knew what you meant but to be a bit more explicit: it's a real integrity check using hashes and not merely a checksum.
- vog 10y ago
  If we are nitpicking like this: It uses cryptographic hash functions and not merely the hash functions commonly used by hash tables.
eeZah7Ux 10y ago
Nice feature but you need to trust the HTML page that is pulling the js. ZeroNet allows any HTML page to pull any script.
- blitmap 10y ago
  And... we're back to loving IPFS :3

by blitmap 10y ago

gog 10y ago

It's called Subresource Integrity, see https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/ https://hacks.mozilla.org/2015/09/subresource-integrity-in-f... and https://www.w3.org/TR/SRI/ https://www.w3.org/TR/SRI/ Browser support is noted here: http://caniuse.com/#feat=subresource-integrity http://caniuse.com/#feat=subresource-integrity

blitmap 10y ago
It's kind of a shame they didn't let their imagination fly with that one... I wish integrity were a global attribute, because I could totally see using it for things like images and audio/video.
- Ajedi32 10y ago
  It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... Another option would be to just use a subresource-integrity protected script to check the hash of a downloaded image/video before displaying it.
  - blitmap 10y ago
    That is clever and I like you.
- StavrosK 10y ago
  And then any site could check whether you've seen a particular image before just by including it and seeing how long it takes to load, yay!

wyldfire 10y ago

I was pretty sure I knew what you meant but to be a bit more explicit: it's a real integrity check using hashes and not merely a checksum.

vog 10y ago
If we are nitpicking like this: It uses cryptographic hash functions and not merely the hash functions commonly used by hash tables.

eeZah7Ux 10y ago

Nice feature but you need to trust the HTML page that is pulling the js. ZeroNet allows any HTML page to pull any script.

blitmap 10y ago
And... we're back to loving IPFS :3