5 ms·

Sounds similar to Decentraleyes. How is LocalCDN different?

URfejk 6y ago
Look here: https://codeberg.org/nobody/LocalCDN#user-content-differences-between-localcdn-and-decentraleyes https://codeberg.org/nobody/LocalCDN#user-content-difference...
- im3w1l 6y ago
  Why is it removing integrity?
  - URfejk 6y ago
    "... remove crossorigin and integrity attributes of script and stylesheet tags to increase replacements ..."
    - im3w1l 6y ago
      Yeah but I don't understand why that would be needed. It sounds dangerous.
      - u566 6y ago
        With these things you can't replace anything. The website has to be whitelisted or you live with the fact that the libraries can't be replaced and the site is broken.
  - 3np 6y ago
    Indeed - integrity should be dependent on the content, not the URI. It looks like they do it to allow "replacements" (e.g. serve package version x.y.z-1 if it can't find x.y.z). This sounds like a horrible idea.
  - xtanx 6y ago
    It seems that it is "upgrading" libraries. If you look at the graph it replaces jQuery 3.3.1 with 3.4.1.
  - jorams 6y ago
    Two reasons: 1. It deliberately replaces some versions of libraries with different versions. That's a feature I could do without. 2. The use of integrity hashes on cross-origin resources breaks Decentraleyes[0], and it's not fixable without browser changes.[1] [0]: https://git.synz.io/Synzvato/decentraleyes/-/issues/16 https://git.synz.io/Synzvato/decentraleyes/-/issues/16 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1419459 https://bugzilla.mozilla.org/show_bug.cgi?id=1419459
- GekkePrutser 6y ago
  It's a fork of decentraleyes, why not contribute to it? And I'd have to trust substantial permissions to an addon from 'nobody'. I don't believe in mandatory real-world identities but at least have a nick with some street cred :) Trust is important with browser extensions, just look at the news today about Nano Defender being compromised and spamming Instagram likes: https://github.com/jspenguin2017/Snippets/issues/5 https://github.com/jspenguin2017/Snippets/issues/5 Just saying, this is something I'll skip for now for the above reasons, but I'll keep an eye on it.
  - Fnoord 6y ago
    Loads of people use Signal by "Moxie Marlinspike" though, and whenever I bring that issue up here its RIP karma.
    - gogopuppygogo 6y ago
      https://en.wikipedia.org/wiki/Moxie_Marlinspike https://en.wikipedia.org/wiki/Moxie_Marlinspike
    - GekkePrutser 6y ago
      Yeah but that's an example of a nick with good street cred :) The developer of this extension doesn't have that.
    - kreetx 6y ago
      But the issue itself is what?
      - Santosh83 6y ago
        The issue is that even with open source software, "trust" enter into play when everyone cannot possibly inspect the source code at every update. So the publisher of the software does need a certain amount of (subjective) "credibility", even though the source is available. This can be mitigated by disabling auto-update functionality and insisting on reproducible builds.

Look here: https://codeberg.org/nobody/LocalCDN#user-content-differences-between-localcdn-and-decentraleyes https://codeberg.org/nobody/LocalCDN#user-content-difference...

im3w1l 6y ago
Why is it removing integrity?
- URfejk 6y ago
  "... remove crossorigin and integrity attributes of script and stylesheet tags to increase replacements ..."
  - im3w1l 6y ago
    Yeah but I don't understand why that would be needed. It sounds dangerous.
    - u566 6y ago
      With these things you can't replace anything. The website has to be whitelisted or you live with the fact that the libraries can't be replaced and the site is broken.
- 3np 6y ago
  Indeed - integrity should be dependent on the content, not the URI. It looks like they do it to allow "replacements" (e.g. serve package version x.y.z-1 if it can't find x.y.z). This sounds like a horrible idea.
- xtanx 6y ago
  It seems that it is "upgrading" libraries. If you look at the graph it replaces jQuery 3.3.1 with 3.4.1.
- jorams 6y ago
  Two reasons: 1. It deliberately replaces some versions of libraries with different versions. That's a feature I could do without. 2. The use of integrity hashes on cross-origin resources breaks Decentraleyes[0], and it's not fixable without browser changes.[1] [0]: https://git.synz.io/Synzvato/decentraleyes/-/issues/16 https://git.synz.io/Synzvato/decentraleyes/-/issues/16 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1419459 https://bugzilla.mozilla.org/show_bug.cgi?id=1419459
GekkePrutser 6y ago
It's a fork of decentraleyes, why not contribute to it? And I'd have to trust substantial permissions to an addon from 'nobody'. I don't believe in mandatory real-world identities but at least have a nick with some street cred :) Trust is important with browser extensions, just look at the news today about Nano Defender being compromised and spamming Instagram likes: https://github.com/jspenguin2017/Snippets/issues/5 https://github.com/jspenguin2017/Snippets/issues/5 Just saying, this is something I'll skip for now for the above reasons, but I'll keep an eye on it.
- Fnoord 6y ago
  Loads of people use Signal by "Moxie Marlinspike" though, and whenever I bring that issue up here its RIP karma.
  - gogopuppygogo 6y ago
    https://en.wikipedia.org/wiki/Moxie_Marlinspike https://en.wikipedia.org/wiki/Moxie_Marlinspike
  - GekkePrutser 6y ago
    Yeah but that's an example of a nick with good street cred :) The developer of this extension doesn't have that.
  - kreetx 6y ago
    But the issue itself is what?
    - Santosh83 6y ago
      The issue is that even with open source software, "trust" enter into play when everyone cannot possibly inspect the source code at every update. So the publisher of the software does need a certain amount of (subjective) "credibility", even though the source is available. This can be mitigated by disabling auto-update functionality and insisting on reproducible builds.