Hacker News Reader

You are presumably willing to trust the first-party website for content and it is not a big stretch to trust the third-party content they chose to include as well. Not much difference between trusting them to serve jQuery themselves (which they must source from a third-party initially) or link to it directly at the third-party site, for example.

View on HN

The code they source from the third-party initially can be audited and then self hosted. If the code is not self hosted, the third party can change the script to be malicious (or be compromised) without the first party ever knowing.

I think this is why integrity hashes should be included anytime a CDN is used to load a third-party library. Bootstrap does this, for example: http://getbootstrap.com/getting-started/

I'd like to see more lib providers, and even CDNs themselves, follow suit.

Thank you, i always thought about this but didn't know it already existed. This should definitely be used for any content included on a page, especially third party CDN, it could also allow caching if the address changes but the content is the same.

Reply on news.ycombinator.com