Hacker News Reader

W3C laid the groundwork for everything on the Web to be heavily cacheable, so it's weird that there are so few general-purpose proxy caches. Are publishers sending short "Cache-Control: max-age" or "Vary: Cookie" responses when they didn't need to? Are too many ISPs paying for transit rather than peering?

View on HN

In general there's no way to ensure the cache hasn't tampered with the contents (e.g. ISP proxy ad injection on non HTTPS sites). For software downloads usually there are signatures and checksums. Arbitrary content, not so much.

There was HTTP SXG (signed exchanges) but it never seemed to get any traction https://web.dev/articles/signed-exchanges

Even if the content is signed, there’s still the issue that the proxy gets to see everything you read, right?

that's the point of a proxy that can share contents between clients...

Maybe use cache only when Subresource Integrity is present.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Reply on news.ycombinator.com