News for hackers. Stuff that matters.

A comment on How to gain code execution on hundreds of millions of people and popular apps. Parent comment

Re:How to gain code execution on hundreds of millions of peo... by bastawhiz on Sunday March 02, 2025 @05:46PM (#43236077)
> In dev mode, just issue a warning "loaded script that has hash X but isn't statically defined.

How does the browser know which files to warn you about? What about scripts that are generated dynamically and have no static hash? There's plenty of reasons why you wouldn't want this.

[ Parent | on HN ]
Re:How to gain code execution on hundreds of millions of peo... by valenterry on Monday March 03, 2025 @01:46AM (#43238987)
It just warns about all embedded non-same-origin scripts that don't have a hash.

> What about scripts that are generated dynamically and have no static hash?

Well, then the warning is still valid because this is a security risk. I guess it'd be fine to be able to suppress the warning explicitly in those cases.

> There's plenty of reasons why you wouldn't want this.

For example? Honestly curious where you would not want a warning by default.

[ Parent | on HN ]