4 ms·

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... can help verify ever

by Jach 9y ago

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... can help verify everything loaded is what it's supposed to be. However you'd still need to verify that the set of things loaded is the set of things you expect, not just that the things are the things, and that requires having an out-of-band checklist or extension...

the8472 9y ago
SRI alone is insufficient. Maybe a strict CSP policy that exclusively allows hash sources and forbids eval could serve as an indicator that the scripts executed on a page are immutable. Probably needs some further conditions to make it airtight.
- kijin 9y ago
  If you don't trust Mozilla, how do you trust them not to strip the CSP header whenever they want to serve malicious javascript?
  - the8472 9y ago
    you'd still have to implement a pinning feature. the hash-only-CSP part would just be the foundation which the pin checks.