3 ms·

Use of integrity hash validation is pretty limited -- I see 90k sites in the top 10 million. It's a shame this isn't more popular, I'd love to build a browser

Use of integrity hash validation is pretty limited -- I see 90k sites in the top 10 million. It's a shame this isn't more popular, I'd love to build a browser add-on that uses the integrity hash as the name of the script, and load them from ipfs or something. Top sites: gov.uk, nhm.ac.uk, change.org, blogs.worldbank.org, handbrake.fr, army.mil, genome.gov, ...

K0nserv 9y ago
SRI[0] is still a fairly new technology with lacking browser support. I expect its usage to grow, but it's worth keeping in mind that the use of SRI does not matter at all if the client doesn't support SRI. 0: SRI - Subresource Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- greglindahl 9y ago
  As a guy who crawls, indexes, and archives websites, subresource integrity matters to me whether or not the client supports it. You probably had end-users in mind.
  - K0nserv 9y ago
    Yeah exactly I was thinking of end users. Since the support in end user's client dictate what websites will implement I think we'll see use of SRI increase over the coming years
    - greglindahl 9y ago
      I would be amazed if anyone disagreed with you about that. Status of client support: https://caniuse.com/#search=integrity https://caniuse.com/#search=integrity
raesene9 9y ago
that info. on the level of support is v. interesting, is there any published data on it that could be linked to (blog posts, web site etc)?
- greglindahl 9y ago
  There are a bunch of crawlers that aggregate that kind of info -- I'm building a new search engine, and I'm not in the business of publishing stuff that would encourage anyone to block my crawler. builtwith.com is an example, but they're being pretty strict with what you can see for free these days. And hey, they only know about 2k sites using script integrity, so maybe I've got a bigger crawl than they do! :-)

K0nserv 9y ago

SRI[0] is still a fairly new technology with lacking browser support. I expect its usage to grow, but it's worth keeping in mind that the use of SRI does not matter at all if the client doesn't support SRI. 0: SRI - Subresource Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

greglindahl 9y ago
As a guy who crawls, indexes, and archives websites, subresource integrity matters to me whether or not the client supports it. You probably had end-users in mind.
- K0nserv 9y ago
  Yeah exactly I was thinking of end users. Since the support in end user's client dictate what websites will implement I think we'll see use of SRI increase over the coming years
  - greglindahl 9y ago
    I would be amazed if anyone disagreed with you about that. Status of client support: https://caniuse.com/#search=integrity https://caniuse.com/#search=integrity

raesene9 9y ago

that info. on the level of support is v. interesting, is there any published data on it that could be linked to (blog posts, web site etc)?

greglindahl 9y ago
There are a bunch of crawlers that aggregate that kind of info -- I'm building a new search engine, and I'm not in the business of publishing stuff that would encourage anyone to block my crawler. builtwith.com is an example, but they're being pretty strict with what you can see for free these days. And hey, they only know about 2k sites using script integrity, so maybe I've got a bigger crawl than they do! :-)