5 ms·
If they wanted to fix something on dependency management, they could have started by adding a way to sign the code/packages. Indeed browsers don't allow to sign
by forty 6y ago
If they wanted to fix something on dependency management, they could have started by adding a way to sign the code/packages. Indeed browsers don't allow to sign pages, which means anyone from the hosting provider to the CDN to the mitm corporate proxy can inject any code they want. It sucks and I'm not sure why "Deno is a browser for code" seems to be a good thing....
Hopefully something like google signed http exchange will fix that in the future for browsers at least.
- ccmcarey 6y agoUnless I'm missing what you're referring to, that's not true at all - HTTPS is secure and uses certificates to sign and encrypt traffic.
- kbenson 6y agoI think they are referring to signed content, not singed transport. That is, this blob of content/code I downloaded is signed and I have more trust in it than in some other piece of content/code that's from a server meant to house hundreds or thousands of different people, much less modules. You can trust that the developer meant to release that, and it's not some hack of the system, and you can also require that the code comes from a vetting third party that reviews all modules and updates and signs it itself (i.e. what Linux distro package managers do).
- emerongi 6y agoI think OP is arguing: - Host can change what is in a package at any time. In case Deno calculates a hash on your machine (e.g. package-lock.json), it's not as bad, but still without a signed package you can't be sure that it was the author that released the code in the first place. - Host <-> CDN usually happens over HTTP. Often it is the CDN where HTTPS is terminated. Technically the CDN can deliver whatever code to you. - Corporate HTTPS proxies exist. With a proxy like this, it can also replace the code with whatever it likes.
- brabel 6y ago> In case Deno calculates a hash on your machine (e.g. package-lock.json), it's not as bad, but still without a signed package you can't be sure that it was the author that released the code in the first place. If you trust the URL is in a (sub)domain controlled by the author and it's a HTTPS URL, that's as much guarantee as a signature.
- DagAgren 6y agoHTTPS tells me that I am definitely downloading this package from GitHub. But what exactly am I downloading from GitHub? No clue.
- datalist 6y agoWhile not exactly what you are asking, SRI does address that issue to a certain extent https://medium.com/binary-passion/gentlemen-please-fasten-your-scripts-1e3222acc9b4 https://medium.com/binary-passion/gentlemen-please-fasten-yo...
- ChristianBundy 6y agoDoes SRI allow signatures? I want to have a policy where any script signed by my Ed25519 key is valid, I don't want to have to hardcode the hash everywhere.
- datalist 6y agoThat not, hence "not exactly" but SRI still is nice add-on.
- WealthVsSurvive 6y agoIt doesn't, it's only for verifying that the thing is what it was when hashed and not who it's from. The funniest part of this discussion to me is that we're now discussing features of a, say it with me, a package manager! Only now we get to add them by hand.
- datalist 6y agoTo be honest, I am not sure what should be wrong with adding code by hand. Libraries were added manually by legions of developers long before one thought he'd need to create a downloadable left-pad "package". The whole package management issue is overrated.
- forty 6y agoYes, the only missing thing is the page you initially download and contains all the hashes :)
- datalist 6y agoWell, jQuery has the hashes on-site.