[Mathmesh] Using UDF for CDN content

[Phillip Hallam-Baker <[e-mail]>]

I am just updating the Web site and upgrading to Bootstrap 4. In the
process, I came across this:

<!-- Latest compiled and minified CSS -->
<link rel="stylesheet" href="
https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css">
Of course downloading bootstrap from a CDN makes every bit of sense and
even better to not have to download it more than once. But lets just step
back and think about what this line of code does.

In effect, bootstrapcdn.com has just become a root of trust for my Web
pages. I have handed a vast degree of trust over to a site that I have no
direct connection to. All I did (or would have done if I wasn't a security
nut) was to cut and paste the code from a Web page giving me instructions.

Replacing the variable uri with a hardened one is much better:

<link rel="stylesheet" href="udf:
maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4">

Of course we might well require some sort of transition strategy but it
seems we now EOL Web browsers after 8 years (IE 9 is no longer supported by
BS 4).

Content digest of the content provides a link to a fixed static version of
a resource which is exactly what I think is needed here. I do NOT want
anyone making supposed 'bug fixes' to content I am linking to without
testing them on my end.

If a link to dynamic content was required, the way to effect it would be to
provide the content digest of the signature key.