On Tue, Jul 22, 2014 at 11:12 AM, Guido Witmond <[email protected]> wrote:

> That way you could host all your javascript at the site. (but not at the
> CDN).
>

If Subresource Integrity (SRI) were actually implemented by browsers,
serving JS via a CDN would be fine (and could even be done safely over
plaintext HTTP) because the parent page includes a digest of each
subresource, forming a Merkle tree with its root at the parent page:

http://www.w3.org/TR/SRI/

Of course, we're still left with the bootstrapping problem of getting an
authentic parent page.

-- 
Tony Arcieri
-- 
Liberationtech is public & archives are searchable on Google. Violations of 
list guidelines will get you moderated: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, 
change to digest, or change password by emailing moderator at 
[email protected].

Reply via email to