#subresourceintegrity — Public Fediverse posts

If you're still using polyfill.io you probably want to replace/remove it IMMEDIATELY. The domain has been sold and the new owners are injecting #malware (1).

If you absolutely have to use externally hosted #JavaScript and #CSS, it's a good idea to secure it with #SubresourceIntegrity (2). It's supported by most old browsers you're probably polyfilling for.

(1) https://polykill.io/
(2) https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

#polyfillio #polyfillioattack #supplychainattack

If you're still using polyfill.io you probably want to replace/remove it IMMEDIATELY. The domain has been sold and the new owners are injecting #malware (1).

If you absolutely have to use externally hosted #JavaScript and #CSS, it's a good idea to secure it with #SubresourceIntegrity (2). It's supported by most old browsers you're probably polyfilling for.

(1) https://polykill.io/
(2) https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

#polyfillio #polyfillioattack #supplychainattack

I've written a new blog post for #Mozilla's MDN.

https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/

All about #SubResourceIntegrity and why it is so important for securing your sites and its visitors.

Please share and provide feedback 🙂

I've written a new blog post for #Mozilla's MDN.

https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/

All about #SubResourceIntegrity and why it is so important for securing your sites and its visitors.

Please share and provide feedback 🙂

Finally found the time to open a discussion on the Snowpack forums about the lack of subresource integrity (SRI) in Skypack: https://github.com/snowpackjs/snowpack/discussions/2569

(Background: my post from the end of last year titled Skypack: backdoor as a Service? https://ar.al/2020/12/30/skypack-backdoor-as-a-service/)

#skypack #snowpack #SubresourceIntegrity #SRI #security #privacy

If you specify subresource integrity in a script tag and then import that script also from a separate tag later on, and the source fails the integrity check, on

1. Firefox (Gecko): script doesn’t execute
2. Ungoogled Chromium (Chromium): script doesn’t execute
3. Epiphany (WebKit): script tag is blocked but script executes via the import

Not sure if Safari does the same but that’s not good.

#SubresourceIntegrity #security

We had #SRI #SubresourceIntegrity for a while now, And we now have also #ES6 modules, but they totally cannot be combined. Either you use SRI or ES6 modules… https://discourse.mozilla.org/t/using-sri-for-es6-module-import/33749 #js

@x_cli @varx First, BTW, all browsers nowadays have very secure sandboxes – as if CHrome would be effectively better here. Also Firefox e.g. introduced multi-processes (electrolysis) architectures and also improved the speed quite a lot.
(There may rather be privacy problems with Chrome though: https://social.wiuwiu.de/@rugk/101111620938232666)

Anyway, yes, that's a problem, but (theoretically) a solved one: #SubresourceIntegrity (#SRI) can e.g. be used.