Post

wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed

The amount of pain that this would cause a regulated software product would be horrifically large without an ability to opt out entirely. It’s a great idea, but hashes aren’t sufficient anymore for where regulations are trending Now, combine this with attestation and you have me very interested :)

this is opt in only

but i would love to know more about the issue with regulated sites… is it related to privacy?

I want to make a comment about the fact that I JUST gave a talk about this on a stage we both spoke from, but to be fair I did say websites aren’t covered by the CRA without clarifying that there are plenty of other regulations that cover many industries (finance, healthcare, etc) that may apply.

Oh whoops. I should’ve clarified that I didn’t necessarily mean the CRA. It’s definitely covering more things! But this isn’t one of them and I appreciate you clarifying that here 🥰

Yes! And you and I talked about some industries that are functionally exempt from the CRA because they already have even stricter regulations they have to follow. I was ready to roast @danielroe.dev bc this particular talk I gave was *last week* but I suppose I didn’t dig in to specifics here 😆

oh you know i hung on your every word - but i’m just not sure what the issue with cos is. the cryptographic guarantee is meant to ensure that the chunk you get is byte-for-byte identical with the one produced by your own build

It’s more that security people operate on an elevated level of paranoia, and admittedly for good reason. How do we secure the supply chain? How do we describe “cryptographically secure”? Does it support PQC methods? The security obsessed tend to get itchy until proven otherwise.

There’s also the whole thing of security might say one thing, but risk might say another, and the engineers might have their own opinions, all of which result in a way overblown series of steps that don’t actually do what they claim to do It’s a fun puzzle 😅