4 ms·
Maybe Its time to introduce reproducible buulds to the JavaScript word? So that we can prove that the minified version is the same as the source.. Or just rele
by arianvanp 12y ago
Maybe Its time to introduce reproducible buulds to the JavaScript word? So that we can prove that the minified version is the same as the source.. Or just release the code as a nonminified AGPL set of ES6 files. With the coming of http2 it's going to be less of a problem
But I still think we need to think of an out of band way to verify trust. Just like I can verify that my install of gpg or tails is legit
- diafygi 12y agoYou're in luck! There's a working group called "Subresource Integrity" that's developing a way to allow websites to restrict a resource (including javascript files) to a defined hash. http://www.w3.org/TR/SRI/ http://www.w3.org/TR/SRI/
- deanclatworthy 12y agoThis is a step in the right direction for embedding external resources. It'd remove CDNs as an attack vector (once it's rolled out everywhere). It'd be great to come up with some kind of way to also tell the client what resources are expected, and if a new one is loaded (e.g. <iframe src="http://dangerous.malware.com"></iframe> http://dangerous.malware.com"></iframe>) the client would not even connect to it.