3 ms·
the 3rd party would provide a script that emits the URL/SRI And we're back to square one - we can't trust _that_ script to not get pwned
by jffry 10y ago
the 3rd party would provide a script that emits the URL/SRI
And we're back to square one - we can't trust _that_ script to not get pwned
- cryptarch 10y agoNot really, isn't packaging and securely distributing PHP/Node.js libraries a solved problem?
- johncolanduoni 10y agoIf you're not updating the PHP/Node.js library, and you're not updating any data you give it, where does it get the information it needs to update the URL/SRI tag? And if you are doing any of those things when Stripe pushes an update, how is it any different that having to update the URL/SRI tag?