Hacker News Reader

Hacker News

Comment by crabmusket | Hacker News Reader

Parent Full thread

crabmusket

Lockfiles should be used for production code, as per https://deno.land/manual/linking_to_external_code/integrity_...

View on HN

Can checksums/hashes be specified directly in the source file?

EDIT: I mean hashes of dependencies.

That is important for single-file scripts, if this is meant to be useful as a bash replacement for scripting.

Having to download two separate files for a script and execute it with special arguments already adds too much friction to that scenario.

>Can checksums/hashes be specified directly in the source file?

That would defeat their point actually :D malicious attacker could inject any script by hacking on the network and replace modules that are downloaded through http

How? Say I have `script.ts`. That file exists locally on my computer and the code inside it is trusted (say it was downloaded from a trusted github project via https). It contains

    import { dependency } from 'http://whatever.url/@1.0.3'
        with hash '6f09aa686a6263f9e992'

or something like that. If an attacker replaces stuff during transfer of the dependency, then the hash won't match (assuming a collision resistant hash function). This can be transitive if the dependency also has hashes of its dependencies directly inside it (and a "only allow that" mode could enforce it).

The additional benefit is that you also don't need to trust the server to not replace code for a URL under your nose from one you have previously verified. So like a lockfile, but without needing to download a separate file (because you also want verification on the first run) and a command-line argument on launch - which makes it a much more viable replacement for bash scripts (in fact, that's why I care about the ability, I wouldn't mind https-only). Am I missing something here?

Oh, I did not get what you meant ^^ well, there are still other issues than integrity with not using https.

Yeah, I'll edit the original comment to clarify that I mean hashes of dependencies.

there are a lot of issues with using a non secure protocol to do anything over the internet, actually someone summarized the issue on the Deno issue tracker.

According to them, confidentiality is also a risk. also someone could also send you garbage that would polute the memory of deno until it explode.

That is not enough at all and there are other attacks! I can't belive in 2020 some people still need to be explained why not enforcing https is a terrible thing!

For instance, will a lockfile prevent someone from eavesdropping on the download of a modules through http? If so, please kindly tell me how!

https prevents MITM but doesn't prevent the modules being backdoored or otherwise altered at the source.

I would prefer https-only, sure, but it doesn't buy you very much security.

Well, diasabling http by default is basically "Internet 101" here.

I don't want to write an full lecture on how many attacks are possible when people don't use https. It has been commmon knowledge for way more than a decade

Reply on news.ycombinator.com