Re: [Mathmesh] Using UDF for CDN content

RFC 6920

Sent from mobile, sorry for terse

> On 12. Nov 2019, at 08:44, Michael Richardson <mcr@sandelman.ca> wrote:
> 
> 
> 
>> On 2019-11-12 1:11 a.m., Phillip Hallam-Baker wrote:
>> I am just updating the Web site and upgrading to Bootstrap 4. In the
>> process, I came across this:
>> 
>> <!-- Latest compiled and minified CSS -->
>> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css">  
>> Of course downloading bootstrap from a CDN makes every bit of sense
>> and even better to not have to download it more than once. But lets
>> just step back and think about what this line of code does.
>> 
>> In effect, bootstrapcdn.com <http://bootstrapcdn.com> has just become
>> a root of trust for my Web pages. I have handed a vast degree of trust
>> over to a site that I have no direct connection to. All I did (or
>> would have done if I wasn't a security nut) was to cut and paste the
>> code from a Web page giving me instructions.
> 
> You are completely correct in your assessment.  You could download the
> code and put it on your web site, which would improve your threat
> surface, but if you did that you would be defeating a great deal of
> caching done by browsers of this kind of content.  You might also miss
> out on updates, although if you are linking to a version-numbered
> content, then you are not getting any update advantage.
> I seem to remember linking to major-version only when pulling in jQuery.
> 
>> Replacing the variable uri with a hardened one is much better:
>> 
>> <link rel="stylesheet" href="udf:maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4
>> <http://maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4>">  
>> 
>> Of course we might well require some sort of transition strategy but
>> it seems we now EOL Web browsers after 8 years (IE 9 is no longer
>> supported by BS 4).
> 
> Could we rely on some other (more primitive) bit of javascript to go
> through and replace this with the correct one?  That probably means
> using something other than href=""
> 
>> Content digest of the content provides a link to a fixed static
>> version of a resource which is exactly what I think is needed here. I
>> do NOT want anyone making supposed 'bug fixes' to content I am linking
>> to without testing them on my end.
>> 
>> If a link to dynamic content was required, the way to effect it would
>> be to provide the content digest of the signature key.
> 
> I would like to further remove the hostname from that and just give a hint.
> Any content with that hash would satisfy the requirement.
> 
> -- 
> Mathmesh mailing list
> Mathmesh@ietf.org
> https://www.ietf.org/mailman/listinfo/mathmesh