Hacker News Reader

Comment by forty | Hacker News Reader

If they wanted to fix something on dependency management, they could have started by adding a way to sign the code/packages. Indeed browsers don't allow to sign pages, which means anyone from the hosting provider to the CDN to the mitm corporate proxy can inject any code they want. It sucks and I'm not sure why "Deno is a browser for code" seems to be a good thing....

Hopefully something like google signed http exchange will fix that in the future for browsers at least.

View on HN

While not exactly what you are asking, SRI does address that issue to a certain extent

https://medium.com/binary-passion/gentlemen-please-fasten-yo...

Does SRI allow signatures? I want to have a policy where any script signed by my Ed25519 key is valid, I don't want to have to hardcode the hash everywhere.

That not, hence "not exactly" but SRI still is nice add-on.

It doesn't, it's only for verifying that the thing is what it was when hashed and not who it's from. The funniest part of this discussion to me is that we're now discussing features of a, say it with me, a package manager! Only now we get to add them by hand.

To be honest, I am not sure what should be wrong with adding code by hand.

Libraries were added manually by legions of developers long before one thought he'd need to create a downloadable left-pad "package".

The whole package management issue is overrated.

Yes, the only missing thing is the page you initially download and contains all the hashes :)

Well, jQuery has the hashes on-site.

Unless I'm missing what you're referring to, that's not true at all - HTTPS is secure and uses certificates to sign and encrypt traffic.

I think they are referring to signed content, not singed transport. That is, this blob of content/code I downloaded is signed and I have more trust in it than in some other piece of content/code that's from a server meant to house hundreds or thousands of different people, much less modules.

You can trust that the developer meant to release that, and it's not some hack of the system, and you can also require that the code comes from a vetting third party that reviews all modules and updates and signs it itself (i.e. what Linux distro package managers do).

I think OP is arguing:

- Host can change what is in a package at any time. In case Deno calculates a hash on your machine (e.g. package-lock.json), it's not as bad, but still without a signed package you can't be sure that it was the author that released the code in the first place.

- Host <-> CDN usually happens over HTTP. Often it is the CDN where HTTPS is terminated. Technically the CDN can deliver whatever code to you.

- Corporate HTTPS proxies exist. With a proxy like this, it can also replace the code with whatever it likes.

> In case Deno calculates a hash on your machine (e.g. package-lock.json), it's not as bad, but still without a signed package you can't be sure that it was the author that released the code in the first place.

If you trust the URL is in a (sub)domain controlled by the author and it's a HTTPS URL, that's as much guarantee as a signature.

HTTPS tells me that I am definitely downloading this package from GitHub. But what exactly am I downloading from GitHub? No clue.

Reply on news.ycombinator.com