News for hackers. Stuff that matters.

A comment on Major sites running unauthenticated JavaScript on their payment pages. Parent comment

Re:Major sites running unauthenticated JavaScript on their p... by fredley on Thursday November 29, 2018 @08:25AM (#18559979)
The source doesn't matter, only the content. If the hash of the file matches the hash you've already approved for jquery-3.3, then the file is (unless someone's found a collision in the hashing algorithm that hasn't been disclosed) jquery-3.3.
[ Parent | on HN ]
Re:Major sites running unauthenticated JavaScript on their p... by sprt on Thursday November 29, 2018 @08:30AM (#18560006)
I think what they meant is how do you identify the authentic content the first time around?
[ Parent | on HN ]
Re:Major sites running unauthenticated JavaScript on their p... by throwaway899 on Thursday November 29, 2018 @08:43AM (#18560068)
By manually reviewing the said file or by trusting a central authority of some sort.
[ Parent | on HN ]