Hacker News Reader

> In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself.

I still wish there was a "hash" attribute to script tags (and others) so that browsers could cache common JS/CSS/etc assets cross-domain.

View on HN

I've been wanting this for a while now. The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes. But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest

Ugh. This proposal also suggests using "magic comments" in scripts, which needs to die. They will get stripped by things like pagespeed and various acceleration proxies, completely outside the developers control.

shouldn't it be something like <script src="blah" data-hash-sha512="...">?

If the hash was SHA-512 wouldn't that be hard?

Reply on news.ycombinator.com