3 ms·

One problem with SRI and locking down your version of a third party JavaScript library is you won't get security updates the third party makes to that library u

One problem with SRI and locking down your version of a third party JavaScript library is you won't get security updates the third party makes to that library until you manually update your link. Another issue is third parties don't offer versioned links at all so SRI will prevent the link from loading when the library code is updated. What's the best solution to this? Expecting every website owner to manually review and approve each library version update has problems too and you have to be realistic in accepting most website owners aren't going to be constantly reviewing their libraries. Why is there no mechanism to allow a JavaScript bundle to be signed so we can be more confident the original developer made the modification like we do in other ecosystems? Are there ways you could add more sandboxing to scripts to limit their potential damage? Iframes let you do this (i.e. so scripts can't modify or read the outer page) to an extent for some scenarios.

edent 8y ago
The majority of those scripts are version controlled already. They're explicitly using V1.0.3 or whatever. So responsible site owners are already testing and approving version changes.
- numbsafari 8y ago
  Indeed, to comply with PCI-DSS v3.2.1, requirement 6.1 you must "Establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information", and requirement 6.2 you must "Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security patches." So you need to have an inventory of all vendor supplied software and hardware, monitor for security advisories from those vendors, and have an adequate change management process to respond to those advisories in a timely fashion. All of that needs to be auditable.
- seanwilson 8y ago
  > So responsible site owners are already testing and approving version changes. I'm not saying it's not possible, I'm asking how it could be made easier and for sites in general, not just payment websites. The more resources something takes, the less developers that are going to do it so the web will be less secure.

edent 8y ago

The majority of those scripts are version controlled already. They're explicitly using V1.0.3 or whatever. So responsible site owners are already testing and approving version changes.

numbsafari 8y ago
Indeed, to comply with PCI-DSS v3.2.1, requirement 6.1 you must "Establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information", and requirement 6.2 you must "Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security patches." So you need to have an inventory of all vendor supplied software and hardware, monitor for security advisories from those vendors, and have an adequate change management process to respond to those advisories in a timely fashion. All of that needs to be auditable.
seanwilson 8y ago
> So responsible site owners are already testing and approving version changes. I'm not saying it's not possible, I'm asking how it could be made easier and for sites in general, not just payment websites. The more resources something takes, the less developers that are going to do it so the web will be less secure.