On Thu, Jan 29, 2015 at 10:50 PM, Yan Zhu <y...@yahoo-inc.com> wrote:
> Say that resource Y is a javascript file that listens for users typing in
> password fields and shows them a warning if the password is weak. The user
> verifies and loads the HTML page that includes Y but an attacker then blocks
> the request to fetch Y, so the user picks a weak password.
The application developer could cope with this in the top-layer code:
===
<script>
var passwordChecker = null;
...
</script>
<script src="password-checker.js"></script>
<script>
if (null == passwordChecker) {
// handle failure of security dependency
}
</script>
===
Just as a native application developer should do:
===
void* passwordChecker = dlopen("password-checker.so", ...);
if (NULL == passwordChecker) {
// handle failure of security dependency
}
===
But,
> My intuition is that most developers think about the security of their app as
> a whole, not the security of their app minus any-given-subset-of-resources.
You're probably right, about both web developers and native code developers.
But, if we provide a declarative interface for the package format that
allows developers to declare that a given dependency should be
pre-loaded when possible and mandatorily pre-loaded, they might be
more likely to use that than to write the tedious error-handling code
like that above. I.e. we can create good affordances, and thus get the
benefits of security and performance most of the time.
