Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

One thing about SRI that's also great - even beyond the security concerns with 3rd party scripts - is the benefit of stability. You know whoever controls the other end of the src attribute on your 3rd party <script> tag won't go changing things (even with the best of intentions) quietly that break your site. It's an out-and-out win and I hope all browsers support it soon.


I'd guess that the more annoying 3rd party scripts (looking at you, addthis) would simply tell people not to use this attribute as it will "break compatibility and hinder our ability to deploy critical, potentially security impacting, fixes". In fact, if I were a 3rd party script provider, I'd want to make sure people don't do this to my scripts if I haven't "opted in" to keeping compat (i.e. never modifying the content at a URL). In addition to what you say, it'll also happen in reverse: Well-meaning webmasters will add this tag to improve security, then end up with a broken site.

I'd be surprised if 3rd party providers don't start intentionally adding a random byte on each request (or every hour or something) to make sure that webdevs don't take a dependency on the contents of their files.


What is "addthis" anyway? I always wondered if the domain was targeted at NoScript users. It's telling me to add it -- maybe I should whitelist it!


I think it's a vile "sharing" widget thingy. Nothing of value lost by blocking it.


Any idea if there is a catchable event to detect an integrity check failure?


"On a failed integrity check, an error event is thrown. Developers wishing to provide a canonical fallback resource (e.g., a resource not served from a CDN, perhaps from a secondary, trusted, but slower source) can catch this error event and provide an appropriate handler to replace the failed resource with a different one."

Source: https://w3c.github.io/webappsec/specs/subresourceintegrity/#...


Just have JavaScript code check for variables that would show up in the load, no?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: