4 ms·
> It won't help when a new version or an entirely new library is released. That could be accounted for pretty easily, no? > raised several security concerns.
by schwartzworld 3y ago
> It won't help when a new version or an entirely new library is released.
That could be accounted for pretty easily, no?
> raised several security concerns.
I'd think that having the file included in Chrome or Firefox would alleviate those concerns though. If you can't trust your browser vendor to bundle the right version of a library
- theandrewbailey 3y agoThere are reasons why all browsers partition their file cache by domain. Having some things pre-loaded makes things worse: https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/ > However, the time a website takes to respond to HTTP requests can reveal that the browser has accessed the same resource in the past, which opens the browser to security and privacy attacks, like the following: > Detect if a user has visited a specific site > Cross-site search attack > Cross-site tracking With this suggestion, I guess we can add browser version (and thus, which vulnerabilities can be exploited) to that list. Chrome is trying to freeze the user-agent string, but this would defeat the point.