3 ms·

How does the web packaging spec guarantee that a user isn't served an outdated version? A site may make a mistake, correct it, and web package caches could sti

How does the web packaging spec guarantee that a user isn't served an outdated version? A site may make a mistake, correct it, and web package caches could still serve the old version otherwise. In fact, this basically leads to the update denial issue that also caused APT repositories to move to HTTPS.

dfabulich 9y ago
The package is cryptographically signed by the original web site; the signed package includes a signed expiration date.
- kuschku 9y ago
  In other words, the issue isn't solved at all, and either we end up with expiration dates of a few minutes, and Google crawling every page on the web every 5 minutes, or we're ending up with horribly outdated content, or any mix of the negatives of both.
  - Spivak 9y ago
    So don't package sites with volatile content? Or package the client and pull the content dynamically with JS.
    - colemannugent 9y ago
      >package the client and pull the content dynamically with JS Please don't do this. Most pages are documents, not interactive web apps. This bugs the crap out of me when the online documentation for a language/framework/program refuses to render without JS. It's completely unnecessary.
      - superkuh 9y ago
        Upvoting this is just not enough. This is the worst aspect of the web currently. Even NASA.gov is just a blank black page without JS enabled. It's completely unecessary and sacrifices accessibility for ease of development.
        JoshMnem 9y ago
        Sometimes is not even about ease of development, but just a following of trends without thinking. SPAs are a bad choice for content-based sites for several reasons. People often ask the wrong question: "which JS framework should I use?" (wrong first question) instead of "should I build a site that requires users to execute JS?"
drivingmenuts 9y ago
A better question: how does the spec guarantee that the content isn't fraudulent? It doesn't seem like there's a way to guarantee that the content was signed by the site on the package. If a hosting site can serve up the content, can't they also serve up the signing, unbeknownst to the end user?
- dragonwriter 9y ago
  > A better question: how does the spec guarantee that the content isn't fraudulent? It has to be signed by a certificate for the original source domain, so its the same kind of security that TLS provides. > It doesn't seem like there's a way to guarantee that the content was signed by the site on the package. It seems to me it guarantees that the same way your browser guarantees that an HTTPS page was signed by the site on the URL.

dfabulich 9y ago

The package is cryptographically signed by the original web site; the signed package includes a signed expiration date.

kuschku 9y ago
In other words, the issue isn't solved at all, and either we end up with expiration dates of a few minutes, and Google crawling every page on the web every 5 minutes, or we're ending up with horribly outdated content, or any mix of the negatives of both.
- Spivak 9y ago
  So don't package sites with volatile content? Or package the client and pull the content dynamically with JS.
  - colemannugent 9y ago
    >package the client and pull the content dynamically with JS Please don't do this. Most pages are documents, not interactive web apps. This bugs the crap out of me when the online documentation for a language/framework/program refuses to render without JS. It's completely unnecessary.
    - superkuh 9y ago
      Upvoting this is just not enough. This is the worst aspect of the web currently. Even NASA.gov is just a blank black page without JS enabled. It's completely unecessary and sacrifices accessibility for ease of development.
      - JoshMnem 9y ago
        Sometimes is not even about ease of development, but just a following of trends without thinking. SPAs are a bad choice for content-based sites for several reasons. People often ask the wrong question: "which JS framework should I use?" (wrong first question) instead of "should I build a site that requires users to execute JS?"

drivingmenuts 9y ago

A better question: how does the spec guarantee that the content isn't fraudulent? It doesn't seem like there's a way to guarantee that the content was signed by the site on the package. If a hosting site can serve up the content, can't they also serve up the signing, unbeknownst to the end user?

dragonwriter 9y ago
> A better question: how does the spec guarantee that the content isn't fraudulent? It has to be signed by a certificate for the original source domain, so its the same kind of security that TLS provides. > It doesn't seem like there's a way to guarantee that the content was signed by the site on the package. It seems to me it guarantees that the same way your browser guarantees that an HTTPS page was signed by the site on the URL.