News for hackers. Stuff that matters.

A comment on Supporting Let’s Encrypt, the nonprofit making HTTPS free for all. Parent comment

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by randomhodler84 on Monday June 14, 2021 @08:46PM (#27510137)
No kid, SRI : Sub Resource Integrity is exactly this and an important way to secure CDN hosted js you are using on your site, however if the channel itself has no integrity protection, like HTTP does not (but https does via TLS), an attacker can dynamically replace SRI values with their malicious equivalents. So, both?
[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by merb on Tuesday June 15, 2021 @07:23AM (#27513688)
yeah that's why I said just kidding. basically you would need to host your sha hashes somewhere else, which is probably a little bit wierd. also sub resource integrity, only works with sub resources ;-) (and I think sub resource integrity is stupid, because the future is only useful for external resources, which you should trust?! I would never trust external resources)
[ Parent | on HN ]