4 ms·
You can enable content security policy then hash all the javascripts and assets so only prebuilt and hashed stuff is allowed to be loaded in the web browser. Th
by pastage 4y ago
You can enable content security policy then hash all the javascripts and assets so only prebuilt and hashed stuff is allowed to be loaded in the web browser. There is no way to easily check that some one you trust did the hashing, but it is doable with an extension in the web browser.
- Ajedi32 4y ago"Enable content security policy" is something done by the web server (via a header in the response), so that doesn't solve the problem. In theory yes, you could probably create an extension that leverages Content Security Policy as a means of enforcing binary transparency. But at that point you'd basically just be implementing a slightly worse version of web packaging via an extension.
- pastage 4y agoFor me CSP is enough because the apps I need to trust only have one hash. So I do it manually. I will try to switch over to SXG trusting a signer is easier than having a list of trusted hashes, do you know if there some way to require/verify it that is visible on mobile? Web Packaging seems to be vaporware to some extent, and I need something that works now.