bugmen0t

For static resources, it's nothing more than sending this HTTP header "Acess-Control-Allow-Origins: *".

We reached out to jQuery and code.jquery.com does this for a few months now.

We've been toying with this idea in earlier revisions of the spec, basically using the hash as a cache key and not loading the same file from websiteB if it has already been loaded form websiteA.

Unfortunately, this could be used as a cache poisoning attack to bypass Content Security Policy.

See the section about "Content addressable storage" at <https://frederik-braun.com/subresource-integrity.html>.

(If you can come up with a magical solution to this problem, join the W3C web application security group mailing list and send us an email.)

spec co-editor here.

SRI returns false (i.e. non-matching integrity) for scripts (or stylesheets) that do not enable CORS and are not same-origin [1]. Otherwise, an attacker could just disable CORS to bypass SRI.

flies away

[1] https://w3c.github.io/webappsec/specs/subresourceintegrity/#...

The bug impact description is completely false. Mozilla has "corporate confidential" bugs behind the @mozilla.com email check, but everything with a security rating is restricted to specific accounts that have been explicitly vouched for.

You must be looking for the Underhanded Crypto Contest: The Underhanded Crypto Contest is a competition to write or modify crypto code that appears to be secure, but actually does something evil. See https://underhandedcrypto.com/

There are so much more emojis just in this block, I think it could be squeezed down to at least half as many.

> (N.B.: This is mostly exploratory work and as such doesn't really try to be cross browser - your best bet is a recent Chrome or Chromium, but some clocks work in recent Firefox or Safari.)

works well in Firefox.

it has its problems here and there, but 2.0 on the Flame is really nice!

Are these codes in any particular order?

Attesting software (i.e. JavaScript, even from third parties) might be possible if https://w3c.github.io/webappsec/specs/subresourceintegrity/ gains traction.

You can have closed-source or you can have secure. This is the former.

two comments from a German: 1) Most of this applies to Bavaria, not to the rest of Germany. The US isn't just Texas, you know ;) 2) All - I repeat - ALL generalizations are wrong :-)

</conspiracy> This one explains the issue quite well: http://www.reddit.com/r/RTLSDR/comments/1le3if/so_i_discover...

Learn your electronics and don't believe in rumors ;)

There's a pluggable no-login audio-version of this already present today: Mozilla's TowTruck: https://towtruck.mozillalabs.com/