On Tue, Jul 22, 2014 at 11:12 AM, Guido Witmond <[email protected]> wrote:
> That way you could host all your javascript at the site. (but not at the > CDN). > If Subresource Integrity (SRI) were actually implemented by browsers, serving JS via a CDN would be fine (and could even be done safely over plaintext HTTP) because the parent page includes a digest of each subresource, forming a Merkle tree with its root at the parent page: http://www.w3.org/TR/SRI/ Of course, we're still left with the bootstrapping problem of getting an authentic parent page. -- Tony Arcieri
-- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at [email protected].
