2 ms·

https://github.com/LedgerHQ/connect-kit/pull/30/files https://github.com/LedgerHQ/connect-kit/pull/30/files Come on. This sensitive an application using a CDN

by dwb 3y ago

https://github.com/LedgerHQ/connect-kit/pull/30/files https://github.com/LedgerHQ/connect-kit/pull/30/files Come on. This sensitive an application using a CDN at all, let alone a URL without version pinning?

WXLCKNO 3y ago
They've proven time and time again that they do not take security seriously enough.
- lyu07282 3y ago
  I don't have that expectation, why would some library for dApps (or some other crypto nonsense) care about security? Like do you take this industry seriously? Why on earth would you?
aftbit 3y ago
This is literally done intentionally so that Ledger can update the library underneath dApp developers, without requiring them to release an upgrade to their apps. Was this a good choice? No. But it was done on purpose.
- dwb 3y ago
  I didn't say if I thought it was done intentionally or not. Either way it's extremely unwise.