Hacker News Reader

Hacker News

Comment by Liquid_Fire | Hacker News Reader

Full thread

Liquid_Fire

Sounds similar to Decentraleyes. How is LocalCDN different?

View on HN

Look here: https://codeberg.org/nobody/LocalCDN#user-content-difference...

Why is it removing integrity?

"... remove crossorigin and integrity attributes of script and stylesheet tags to increase replacements ..."

Yeah but I don't understand why that would be needed. It sounds dangerous.

With these things you can't replace anything. The website has to be whitelisted or you live with the fact that the libraries can't be replaced and the site is broken.

Indeed - integrity should be dependent on the content, not the URI. It looks like they do it to allow "replacements" (e.g. serve package version x.y.z-1 if it can't find x.y.z).

This sounds like a horrible idea.

It seems that it is "upgrading" libraries. If you look at the graph it replaces jQuery 3.3.1 with 3.4.1.

Two reasons:

1. It deliberately replaces some versions of libraries with different versions. That's a feature I could do without.

2. The use of integrity hashes on cross-origin resources breaks Decentraleyes[0], and it's not fixable without browser changes.[1]

[0]: https://git.synz.io/Synzvato/decentraleyes/-/issues/16 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1419459

It's a fork of decentraleyes, why not contribute to it?

And I'd have to trust substantial permissions to an addon from 'nobody'. I don't believe in mandatory real-world identities but at least have a nick with some street cred :) Trust is important with browser extensions, just look at the news today about Nano Defender being compromised and spamming Instagram likes: https://github.com/jspenguin2017/Snippets/issues/5

Just saying, this is something I'll skip for now for the above reasons, but I'll keep an eye on it.

Loads of people use Signal by "Moxie Marlinspike" though, and whenever I bring that issue up here its RIP karma.

https://en.wikipedia.org/wiki/Moxie_Marlinspike

Yeah but that's an example of a nick with good street cred :)

The developer of this extension doesn't have that.

But the issue itself is what?

The issue is that even with open source software, "trust" enter into play when everyone cannot possibly inspect the source code at every update. So the publisher of the software does need a certain amount of (subjective) "credibility", even though the source is available.

This can be mitigated by disabling auto-update functionality and insisting on reproducible builds.

I agree. Even if I theoretically could inspect the sources I never do, and pretty much solely rely on "if this had something malicious in it, somebody would have screamed about it already".

edit: What I originally wondered was what was meant with the "RIP karma" comment by the parent?

Whenever I brought it up in past, I got downvoted to oblivion. I find that peculiar. Although it is not OK to complain about moderation.

What's the issue though? Their bio seems fine, they're experienced//well known, the signal protocol is open-source with no issues thus far as I'm aware...

I asked this the other day on a similar comment, and the best they could do is critique Moxie for having a savior complex

The issue depends on the software. In this case, the stakes are high, and the government already knows the developers name for sure, so I don't understand why they try to obfuscate their name given the importance of the application.

>It's a fork of decentraleyes, why not contribute to it?

seems to be unmaintained/inactive.

https://news.ycombinator.com/item?id=23780009

The libraries of Decentraleyes are completely outdated

Reply on news.ycombinator.com