2 ms·

A possible solution for this would be for the extension blocking third party scripts to have a list of domains that are known to be associated, like stackoverfl

by zrm 7y ago

A possible solution for this would be for the extension blocking third party scripts to have a list of domains that are known to be associated, like stackoverflow.com and sstatic.net, and then consider the latter to be first party for the former, pre-populated for all the major sites.

munk-a 7y ago
If the list is domain based then you run into a "Who is paying to maintain the list" problem, and if it's self-registered (i.e. stackoverflow tells you sstatic.net is legit) then who verifies it was actually stackoverflow that told you that - and if you manager to verify that it came from someone within the domain or the registered owner... then how can you verify that sstatic isn't a domain serving malicious scripts and the owner isn't selling out users to the site to make a quick extra buck from some third party ad provider - or that it isn't the former owner who is acting maliciously - or that it isn't the current owner who is trying to undo the former owner who acted maliciously. I think you could quite sanely track a few sites, maybe the top 200 or 300... after that it'd get unwieldy. And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up. A peer vetting system might work well (like DNS) but it'd need a lot of careful thought.
- zrm 7y ago
  Maintaining the list for the most popular sites is not a huge ordeal. You have a bug tracker where people can submit issues, when you get one you take a few minutes to check that the whois matches the main site and the page actually links the script in a way consistent with what we want to approve, and the opposite if you get a report of something having changed the other way. An individual could do it by spending a few hours a month. For less popular sites, the user can add it manually, or the site operator notices their site is broken for increasingly many users and stops linking scripts from other domains. > And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up. That's an independent problem. You could have the same thing happen for actual first party scripts. And in this context if they're really good actors then they fix it as soon as it's discovered, and if they're not then you take them off the approved list.
  - zzzcpan 7y ago
    It can be done and can be pretty nice. I got to around 30 websites myself with just custom CSP policies for each and plenty of ideas what to do next. Like making CSP policies composable, so I can define a rule for say recaptcha and include it for websites that use it and things like that. Javascript walls (cloudflare, sucuri, etc.) is another problem, you wouldn't want to enable javascript just to pass them and you wouldn't want to pass them automatically as it would allow websites to enable javascript. They also may include recaptcha, etc. Still, nothing that can't be solved.

by zrm 7y ago

munk-a 7y ago

If the list is domain based then you run into a "Who is paying to maintain the list" problem, and if it's self-registered (i.e. stackoverflow tells you sstatic.net is legit) then who verifies it was actually stackoverflow that told you that - and if you manager to verify that it came from someone within the domain or the registered owner... then how can you verify that sstatic isn't a domain serving malicious scripts and the owner isn't selling out users to the site to make a quick extra buck from some third party ad provider - or that it isn't the former owner who is acting maliciously - or that it isn't the current owner who is trying to undo the former owner who acted maliciously. I think you could quite sanely track a few sites, maybe the top 200 or 300... after that it'd get unwieldy. And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up. A peer vetting system might work well (like DNS) but it'd need a lot of careful thought.

zrm 7y ago
Maintaining the list for the most popular sites is not a huge ordeal. You have a bug tracker where people can submit issues, when you get one you take a few minutes to check that the whois matches the main site and the page actually links the script in a way consistent with what we want to approve, and the opposite if you get a report of something having changed the other way. An individual could do it by spending a few hours a month. For less popular sites, the user can add it manually, or the site operator notices their site is broken for increasingly many users and stops linking scripts from other domains. > And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up. That's an independent problem. You could have the same thing happen for actual first party scripts. And in this context if they're really good actors then they fix it as soon as it's discovered, and if they're not then you take them off the approved list.
- zzzcpan 7y ago
  It can be done and can be pretty nice. I got to around 30 websites myself with just custom CSP policies for each and plenty of ideas what to do next. Like making CSP policies composable, so I can define a rule for say recaptcha and include it for websites that use it and things like that. Javascript walls (cloudflare, sucuri, etc.) is another problem, you wouldn't want to enable javascript just to pass them and you wouldn't want to pass them automatically as it would allow websites to enable javascript. They also may include recaptcha, etc. Still, nothing that can't be solved.