News for hackers. Stuff that matters.

A comment on CDN for JavaScript libraries. Parent comment

Re:CDN for JavaScript libraries by kalleboo on Monday June 23, 2014 @07:44AM (#7931357)
> In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself.

I still wish there was a "hash" attribute to script tags (and others) so that browsers could cache common JS/CSS/etc assets cross-domain.

[ Parent | on HN ]
Re:CDN for JavaScript libraries by woadwarrior01 on Monday June 23, 2014 @08:18AM (#7931480)
I've been wanting this for a while now. The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes. But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest
[ Parent | on HN ]
Re:CDN for JavaScript libraries by dsl on Monday June 23, 2014 @11:36AM (#7932494)
Ugh. This proposal also suggests using "magic comments" in scripts, which needs to die. They will get stripped by things like pagespeed and various acceleration proxies, completely outside the developers control.
[ Parent | on HN ]
Re:CDN for JavaScript libraries by voltagex_ on Monday June 23, 2014 @09:57PM (#7935837)
shouldn't it be something like <script src="blah" data-hash-sha512="...">?
[ Parent | on HN ]
Re:CDN for JavaScript libraries by jacobgreenleaf on Monday June 23, 2014 @10:52AM (#7932243)
If the hash was SHA-512 wouldn't that be hard?
[ Parent | on HN ]