4 ms·
I had this conversation countless times with developers: are you really ok if someone hijacks the CDN for the code you're including? They almost always seem to
by mihaic 2y ago
I had this conversation countless times with developers: are you really ok if someone hijacks the CDN for the code you're including? They almost always seem to be fine with it, simply because everyone else is doing it like this. At the same time they put up with countless 2FAs in the most mundane places.
The follow up of "you know that the random packages you're including could have malware" is even more hopeless.
- fkyoureadthedoc 2y agoyes you just put integrity="sha384-whatever" and you're good to go
- ok123456 2y agoCan't do that with this one because it generates the polyfill based on the user agent.
- fkyoureadthedoc 2y agoyeah that's nuts, I would never use a random site for that, but in general people's opinion on CDN use is dated. Tons of people still think that cached resources are shared between domains for example.
- tentacleuno 2y agoWhy not? The `integrity` attribute accepts more than one value[0]. This would technically be feasible, if my understanding of the service is correct. Hashes could be recorded for each combination of feature -- you could then give those list of hashes to the user to insert into the attribute. Of course, the main difficulty here would be the management of individual hashes. Hmm, definitely interesting stuff. [0]: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#using_subresource_integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- delfinom 2y agoWe are talking potentially hundreds of hashes because of how the polyfills service worked.
- tentacleuno 2y agoThat depends on how many polyfills are served via each script.
- mihaic 2y agoSure, but why risk a developer making a typo, saying integrty="sha384-whatever", and that attribute simply being ignored in the html?
- cqqxo4zV46cp 2y ago“A developer could typo something” is kind of weak because you could use this argument for basically anything.
- mihaic 2y agoWhy? If you host everything on the same domain there's no possibility of a typo. And, developers could maliciously make a typo that can get past code review, don't you take that into account? In a lot of situations the system can be designed that a mistake has to be obvious at review for it to even pass the build step. Why not strive for that level of robustness?
- radlad 2y agoIn general, SRI (Subresource Integrity) should protect against this. It sounds like it wasn't possible in the Polyfill case as the returned JS was dynamic based on the browser requesting it.
- liveoneggs 2y agonow you are a bummer and a roadblock so your career suffers