Re: [Mathmesh] Using UDF for CDN content

[Michael Richardson <[e-mail]>]

On 2019-11-12 1:11 a.m., Phillip Hallam-Baker wrote:
> I am just updating the Web site and upgrading to Bootstrap 4. In the
> process, I came across this:
>
> <!-- Latest compiled and minified CSS -->
> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css">  
> Of course downloading bootstrap from a CDN makes every bit of sense
> and even better to not have to download it more than once. But lets
> just step back and think about what this line of code does.
>
> In effect, bootstrapcdn.com <http://bootstrapcdn.com> has just become
> a root of trust for my Web pages. I have handed a vast degree of trust
> over to a site that I have no direct connection to. All I did (or
> would have done if I wasn't a security nut) was to cut and paste the
> code from a Web page giving me instructions.

You are completely correct in your assessment.  You could download the
code and put it on your web site, which would improve your threat
surface, but if you did that you would be defeating a great deal of
caching done by browsers of this kind of content.  You might also miss
out on updates, although if you are linking to a version-numbered
content, then you are not getting any update advantage.
I seem to remember linking to major-version only when pulling in jQuery.

> Replacing the variable uri with a hardened one is much better:
>
> <link rel="stylesheet" href="udf:maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4
> <http://maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4>">  
>
> Of course we might well require some sort of transition strategy but
> it seems we now EOL Web browsers after 8 years (IE 9 is no longer
> supported by BS 4).

Could we rely on some other (more primitive) bit of javascript to go
through and replace this with the correct one?  That probably means
using something other than href=""

> Content digest of the content provides a link to a fixed static
> version of a resource which is exactly what I think is needed here. I
> do NOT want anyone making supposed 'bug fixes' to content I am linking
> to without testing them on my end.
>
> If a link to dynamic content was required, the way to effect it would
> be to provide the content digest of the signature key.

I would like to further remove the hostname from that and just give a hint.
Any content with that hash would satisfy the requirement.