Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I've wondered in the past why there isn't something like:

    <script src="https://elsewhere.example.com" digest="<SHA-$foo>" />
that refuses to load the referenced script unless it matches the specified digest/signature.

Using anything from sources you don't trust is a bad idea, but even trustworthy partners can be exploited to attack your site as well.

It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible.



"It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible."

You just put the version number in the name somewhere and make deployments immutable. Otherwise you have everything you need for that already, technically, though you might want to add a fallback to a local clone of the resource or something so it isn't just a failure.


it wouldn't be all that hard to implement this yourself if you're willing to load script dynamically. you'd have to maintain your own digest list.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: