webappsec-subresource-integrity

Enabling the `integrity ` attribute on iframes would help: https://github.com/w3c/webappsec-subresource-integrity/issue... But then you'd also want the frame content to use `integrity` on nested resoures. CSP frame-src can help for now.

Seeing this, it reminded me of an interesting topic: caching at browser-level the common external JS libraries, to achieve big performance improvements: https://github.com/w3c/webappsec-subresource-integrity/issue...

It's great to hear that you want this added to browsers themselves, and you're right that browsers are more likely to implement such changes if you can show that users are deliberately installing an extension to add the missing functionality. There has been some discussion at the W3C about extending the SRI spec in this direction[0], but it seems they are reluctant to do that unless "multiple browser vendors" choose to implement something like this.[1] Hopefully the existence and adoption of this browser extension helps to solve that bootstrapping / Catch-22 problem. As for usability, would it be sufficient to just adopt a TOFU model, where the browser pins the first key it sees for a domain? To prevent the risk of permanently bricking a site (if the key gets lost, or the host gets temporarily compromised) you could politely warn the us

Including the hash is exactly what subresource integrity[1] does (it was even designed for a CDN context originally), but so far people haven’t figured out a sufficiently non-leaky design to use it for caching[2,3]. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres... [2] https://github.com/w3c/webappsec-subresource-integrity/issue... [3] https://hillbrad.github.io/sri-addressable-caching/sri-addre...

True, that was somehow expected as obvious characteristics when writing this down. There is now an issue on the spec at https://github.com/w3c/webappsec-subresource-integrity/issue...

Not sure if you are referring about domain-local cache, or a cache shared between domains: https://github.com/w3c/webappsec-subresource-integrity/issue...

He is proposing to use the integrity hash for caching purposes, not for security purposes. This has been discussed before and it is unlikely it will be implemented as it is almost impossible to eliminate finger-printing and privacy issues if this cache is implemented plus it might lead to security problems: https://github.com/w3c/webappsec-subresource-integrity/issue...

It's not clear from the Chromium Design Document[1] whether resources loaded via Subresource Integrity (SRI) will have a shared cache or not. It's not explicitly mentioned, so it's probably best to assume it's not until someone has tested it. [edit] The SRI spec github project has an issue for shared cache [2] that seems to be coming to the consensus that there will not be a shared cache for SRI: > "it seems rather unlikely that we can ever consider a shared cache" [1] https://docs.google.com/document/d/1XJMm89oyd4lJ-LDQuy0CudzB... [2] https://github.com/w3c/webappsec-subresource-integrity/issue...

A "share cache if hashes match" approach was considered with https://developer.mozilla.org/en-US/docs/Web/Security/Subres... but not included in the initial version. There's been talk (https://hillbrad.github.io/sri-addressable-caching/sri-addre... , https://github.com/w3c/webappsec-subresource-integrity/issue...) about allowing sites to opt in, but then you're opening up a new way of tracking users across sites.

I really like the typeface, so I hope this comment won't come off as too negative. In the FAQ the author mentions that you can fetch the typeface directly from his site. I'd advise against relying on third-parties without contractual obligations to you in production. If you decide to take this risk anyway then you should take steps to reduce the risk of future security issues. The most important thing is to use use Subresource Integrity [0] on your <link> tags. However, since the author doesn't provide versioned URLs (the query strings are only being used to bust the cache, not to select which file is served), this would likely cause your site to break on each release. Usually CDNs give you a URL which includes the version as part of the path. Another issue is that SRI only checks top level resources, there's no equivalent for external fo

One of the replies to my similar post in the earlier thread [5] was from btrask who proposes a similar scheme, using a manifest placed in .well-known/, on the issue tracker for the W3C SRI spec [6]. The conversation is still ongoing, but see that for advantages and drawbacks, as well as other proposed solutions (and/or join the conversation!) [5] https://news.ycombinator.com/item?id=13495482 [6] https://github.com/w3c/webappsec-subresource-integrity/issue...

This issue is discussed here, with what I think is a workable solution: https://github.com/w3c/webappsec-subresource-integrity/issue...