4 ms·
Subresource integrity can help a bit. You still need to bootstrap from a trusted source though (eg a minimal index.html stored locally). And at that point, you
by e12e 7y ago
Subresource integrity can help a bit. You still need to bootstrap from a trusted source though (eg a minimal index.html stored locally). And at that point, you really are back to figuring out a way to distribute a "known good" piece of software.
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Ed: it might, for example be easier to email an attached minimal html file, than a 50mb electron app (multiply by 5 for working on the five major platforms; windows, Linux, Macos, Android and ios). That email might be internal, or signed however you usually sign mails (gpg, s/mime). Or you could host it on a minimal, secure webserver that only served static files over ssl etc
- cdata 7y agoA known good entry point could be delivered over a content-addressed medium like IPFS, and if you layer on SXG the consumer might still be able to validate the origin of the entry point. https://docs.ipfs.io/guides/concepts/ https://docs.ipfs.io/guides/concepts/ https://github.com/ipfs/in-web-browsers/issues/121 https://github.com/ipfs/in-web-browsers/issues/121
- the8472 7y agoYou would still have to combine SRI with a fairly strong CSP to avoid any code execution except SRI-covered stuff. It would be a good PoC I guess, but not practical yet for most people.
- e12e 7y agoWe're talking about a html file that's basically: <html> <script src=example.cdn/app.js (SRI hash) /> </html> If your app.js go including unknown fonts and js etc... Then, yeah, you've got problems.
- AgentME 7y agoCSP would only be necessary if the SRI-covered stuff had bugs that let it accidentally load unverified resources. (To be clear, I think CSP is a necessary defense-in-depth measure for everyone, but this case doesn't uniquely require it.)