3 ms·

On a technical point, is there a reason that javascript doesn't tend to be signed in any way? A good point. I think it's convenience that we don't do it, but

• ethbro 12y ago
  > A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move. After a bit of Googling, (a) http://stackoverflow.com/questions/1368164/javascript-code-signing http://stackoverflow.com/questions/1368164/javascript-code-s... (b) http://www-archive.mozilla.org/projects/security/components/signed-scripts.html http://www-archive.mozilla.org/projects/security/components/... It seems it's simultaneously too difficult to do without ECMA spec support & would require a certificate chain anyway. And if you're running a cert chain infrastructure, why not use the one that already exists and run TLS? Other side thought: with regards to the usefulness & impracticality of cert pinning, has any work been done on systems specifically designed to target low % injection systems? If 1/10 visitors gets the poisoned page, then it seems you'd have a 9/10 chance to pull a good page for comparison & verification if you (or a proxy you trust) made another request from a different IP.