5 ms·
But software loaded from webpages are not immutable. They could be manipulated at any given time. So even if someone audits the code you still cannot trust it b
by the8472 9y ago
But software loaded from webpages are not immutable. They could be manipulated at any given time. So even if someone audits the code you still cannot trust it because all the audit would show is that the specific downloaded version which the auditor saw was non-malicious.
As long as websites have no fingerprints that encompasses all loaded resources and can't be pinned to that fingerpint crypto in the webbrowser is not trustworthy.
- eugeniub 9y agoIn that case, wouldn't an alternative like OnionShare always be safer? The code is open source, it's a desktop app, and the source code is obviously immutable on your computer.
- Nexxxeh 9y agoSurly the safest option is to encrypt it yourself first?
- ArneBab 9y agoYou could upload it to Freenet, then there won’t even be a record what was up- and downloaded by whom: No one will have the metadata. Info: http://www.draketo.de/light/english/freenet/effortless-password-protected-sharing-files http://www.draketo.de/light/english/freenet/effortless-passw... Install: https://freenetproject.org https://freenetproject.org
- Jach 9y agohttps://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... can help verify everything loaded is what it's supposed to be. However you'd still need to verify that the set of things loaded is the set of things you expect, not just that the things are the things, and that requires having an out-of-band checklist or extension...
- the8472 9y agoSRI alone is insufficient. Maybe a strict CSP policy that exclusively allows hash sources and forbids eval could serve as an indicator that the scripts executed on a page are immutable. Probably needs some further conditions to make it airtight.