4 ms·

you can publish a sha256 hash for every site/resource. (just kidding of course)

• randomhodler84 5y ago
  No kid, SRI : Sub Resource Integrity is exactly this and an important way to secure CDN hosted js you are using on your site, however if the channel itself has no integrity protection, like HTTP does not (but https does via TLS), an attacker can dynamically replace SRI values with their malicious equivalents. So, both?
  • merb 5y ago
    yeah that's why I said just kidding. basically you would need to host your sha hashes somewhere else, which is probably a little bit wierd. also sub resource integrity, only works with sub resources ;-) (and I think sub resource integrity is stupid, because the future is only useful for external resources, which you should trust?! I would never trust external resources)
• tialaramex 5y ago
  If the only things on your site are resources for other sites, you could actually make this work using a technology called Subresource Integrity where the hashes live in the link origin (and the browser verifies the content matches the hash on load). Unfortunately SRI is only deployed for CSS and Javascript (so your collection of JPEGs, or videos, or text snippets aren't eligible unless you somehow wrap them as a Javascript which is horrible) and most sites will themselves be HTTPS so they don't want to have active links (even with SRI) to non-HTTPS sites.