Post

wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed

Right, but if you loaded the exact same jQuery from a different CDN, there was no cache hit. COS is hash-based, so now you can self host jQuery from swizecs-random-server dot com and still get a cache hit. The Public Hash List (github.com/WICG/cross-o...) proposal aims to mitigate the attacks.

When we split the cache many years ago we anticipated a need for content-addressable storage (CAS) to improve caching. IIRC we envisioned enforcing k-anonymity locally, but big resource lists certainly help bootstrap. We also assumed it would just extend SRI, and just work for any SRI'd resource.

The Public Hash List can be augmented by local k-anonymity, right. But having a common baseline browsers (hopefully) agree on seems to make a lot of sense. The problem with "any SRI'ed resource" is that it includes supercookies a friendly neighborhood tracker would mint for you—so it can't be any.

These are the two big questions that jump out at me: 1. Why a separate API? Just extend SRI, to allow for the broadest and simplest use. 2. Why just published lists? If the browser sees a hash advertised in any form past a k-anonymity threshold then just use the CAS cache implicitly.

Due to the way caches are domain sharded for privacy, it doesn’t really work that well. Caches aren’t as effective as people had hoped. That, and a third party takeover of a CDN is too bigger security risk for most websites

Being hash-based helps us there. You can be sure about the content as long as the hash matches. A resource with hash abc123 put in the COS cache can be trusted, even if it came from sketchy-server dot com. The hash is checked before writing to COS.

Just peeped JS API in the readme and it reminded me of the Dropbox dropship hack where you could spoof file hash IDs to the API and get Dropbox to sync files that other users had in the cloud It immediately got abused as a way to distribute movies 😂

As an aside, we adopted SSRI for @calibreapp.com RUM and it’s a really great assurance to have as a script provider.

Yes, until ~7 years ago caches were *not* domain sharded for privacy. This used to work very well bsky.app/profile/swiz...

Throwback 2024: www.securityweek.com/polyfill-sup...

oh gosh I guess this counts as many years ago now huh

And that time Doug Crockford used this to make every website that used the JSON reference implementation alert("This website is vulnerable to Doug Crockford");