12 ms·

Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's h

Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided. The same can be used with all other "subresources" like stylesheets and fonts! However Google specifically makes this hard as they have been known to update the served font from time to time, which if you are using SRI will break the font entirely.

blattimwind 8y ago
> Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided. That's true, but SRI is still rarely deployed; and no surprise there: the official Google docs don't use SRI in their "paste this into your code" examples: https://developers.google.com/speed/libraries/ https://developers.google.com/speed/libraries/ Also, Edge still doesn't support SRI. So, yes, for some UAs this specific problem (resource integrity) is a solved problem, but like I said, it's far from the default. The other issues - lack of necessity, load time, degraded visual quality, giving user data away for free to an advertiser etc. - remain untouched.
- Klathmon 8y ago
  I completely agree that it needs to be more widely used, and I absolutely think that google could go a long way toward making it more common. But to be completely honest, lack of user agent support shouldn't be a reason to not use a feature. Edge doesn't support it, so Edge users are less secure. There are also user agents that have CORS restrictions disabled or don't support HSTS, but i'm still going to use and rely on both of those for security. And it sounds like you and I disagree completely on the usefulness of fonts. For me a font isn't "unnecessary" any more than paint isn't necessary on a house. Sure, you could live in a house without paint, but I want paint on my house. As for longer load times, and degraded visual quality. The previous is being dealt with via new font-display css descriptor, and in browsers that don't support that they have timeouts of normally 3 seconds at most, and the former is an opinion that I absolutely don't share.

blattimwind 8y ago

> Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided. That's true, but SRI is still rarely deployed; and no surprise there: the official Google docs don't use SRI in their "paste this into your code" examples: https://developers.google.com/speed/libraries/ https://developers.google.com/speed/libraries/ Also, Edge still doesn't support SRI. So, yes, for some UAs this specific problem (resource integrity) is a solved problem, but like I said, it's far from the default. The other issues - lack of necessity, load time, degraded visual quality, giving user data away for free to an advertiser etc. - remain untouched.

Klathmon 8y ago
I completely agree that it needs to be more widely used, and I absolutely think that google could go a long way toward making it more common. But to be completely honest, lack of user agent support shouldn't be a reason to not use a feature. Edge doesn't support it, so Edge users are less secure. There are also user agents that have CORS restrictions disabled or don't support HSTS, but i'm still going to use and rely on both of those for security. And it sounds like you and I disagree completely on the usefulness of fonts. For me a font isn't "unnecessary" any more than paint isn't necessary on a house. Sure, you could live in a house without paint, but I want paint on my house. As for longer load times, and degraded visual quality. The previous is being dealt with via new font-display css descriptor, and in browsers that don't support that they have timeouts of normally 3 seconds at most, and the former is an opinion that I absolutely don't share.