News for hackers. Stuff that matters.

A comment on Gitlab ‘rethinking’ third-party telemetry. Parent comment

Re:Gitlab ‘rethinking’ third-party telemetry by drako999 on Friday October 25, 2019 @05:39AM (#21353294)
Hey, I'm building an on prem solution and had a question regarding this. Would it still be a problem if the third party was someone like segment whose open source analytics library you're using? https://github.com/segmentio/analytics.js
[ Parent | on HN ]
Re:Gitlab ‘rethinking’ third-party telemetry by krageon on Friday October 25, 2019 @05:43AM (#21353302)
Their problem was third party scripts and you are asking if a third party is okay? Am I missing something here?
[ Parent | on HN ]
Re:Gitlab ‘rethinking’ third-party telemetry by drako999 on Friday October 25, 2019 @06:39AM (#21353588)
Well from what I understand it's that third party scripts are a problem because they may behave maliciously and gain access to parts of the application. If the third party script is an open source project, doesn't that mitigate this?
[ Parent | on HN ]
Re:Gitlab ‘rethinking’ third-party telemetry by thenewnewguy on Saturday October 26, 2019 @09:57AM (#21363691)
Doesn't prevent a malicious/compromised third party from serving code other than what's in the source. I think an acceptable mitigation might be subresource integrity though, so you can lock it to a known-good version of a script?
[ Parent | on HN ]