Re:Where Am I? NYTimes or Google?
by vinay_ys on Saturday July 04, 2020 @01:01AM
(#23730251)
Along with signing, we need explicit content cache busting and explicit allowed mirrors list (which can be revoked instantly). Then it would be at par with TLS + current cache busting mechanisms on top of TLS.
[ Parent
| on HN ]
Re:Where Am I? NYTimes or Google?
by londons_explore on Saturday July 04, 2020 @05:19AM
(#23731167)
As long as javascript on the page has some way to inspect the signatures and where it was delivered from, you can implement cache busting, allowed mirrors, and invalidation yourself however you please.