Post

wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed

The amount of pain that this would cause a regulated software product would be horrifically large without an ability to opt out entirely. It’s a great idea, but hashes aren’t sufficient anymore for where regulations are trending Now, combine this with attestation and you have me very interested :)

this is opt in only

but i would love to know more about the issue with regulated sites… is it related to privacy?

No it’s about being able to guarantee your supply chain. Having the runtime of your software not under your control has large implications for risk management and for producing the evidence required to demonstrate compliance

As a trivial example, how do I prove I did the appropriate work to verify that my code and its dependencies are free of known vulnerabilities when part of that code is no longer produced by my software packaging and deployment process?

As a less trivial consequence, if this mechanism was used for critical software, it means that this new and not battle hardened code path is 1. Highly visible for attackers 2. A perfect way to enable invisible supply chain attacks 3. Comes with a list of vulnerable and easily targeted humans

That’s a big reason why I care about attestation here. It’s not just about verifying that the files are the “right ones”. it’s also about verifying that they were produced correctly, and that the mechanism to produce them (ie, the COS api + storage path itself) wasn’t tampered with by attackers

i would assume legally (i only really known about cra) that this is no different than package managers no? ie you need to ensure the hash you pin fulfills your requirements and the browser vendor has to ensure the API remains correctly implemented

It seems a little different because when a package manager pulls in the pin you see the code yourself, you can scan it, and then you serve it; so the chain of evidence is preserved all the way through. With this, you don’t necessarily deliver the code, and you remotely fetch it, so there’s a “gap”

(I’m abusing the word “remotely”, here. It’s the fetch being non-deterministic that’s weird. If I fetch it from *my* server, it’s fine; but if the file already existed and was downloaded from *their* server… is that continuity of evidence? Or not? I genuinely don’t know)