Hacker News Reader

Comment by ksec | Hacker News Reader

How is Web Bundles different from .mht, which I "think", if I remember correctly is the same as MHTML. And Safari somehow support something else.....

This is a genuine question. It is such a simple feature, zipping an HTML file with all of its resources. Why do we need that many standards for it. Is it NIH syndrome or are there technical reasons in doing so?

View on HN

AFAIK bundles are designed to enable Google's CDN to serve up signed bundles from their servers and masquerade the bundles as coming from your site's domain. That's not something MHT files were designed for. (This actual feature is separate.)

It would be nice, though, if a site owner could use an offline private key to sign a web bundle, and then instruct browsers to only load their web app if the signature matches its public key.

The key would probably have to be delivered in-band, requiring a TOFU security policy, but that's not so bad.

Ideally the browser would also keep track of which version of the app it loaded last time, and give the user the option of fetching a newer version if one is available, to prevent malicious updates.

Zipping an HTML file and the resources is not equivalent, since the browser behavior very much depends on HTTP headers etc, which MHTML doesn't capture. From the existing formats, that leaves pretty much just WARC, but that's also already kind of niche, has a a bunch of interoperability issues in practice, would probably need extending/reinterpreting to fit, and just like MHTML uses base64 for binary files, which is needlessly inefficient for the purpose here.

The more important things to specify are the browser behaviors when working with such files and the signature mechanisms, and those specifications you'd also need if you reused a format.

Reply on news.ycombinator.com