Post

daniel r(ooooooh) in nyc 🇺🇸
@danielroe.dev

wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed

github.comGitHub - WICG/cross-origin-storage: Explainer for the Cross-Origin Storage (COS) APIExplainer for the Cross-Origin Storage (COS) API. Contribute to WICG/cross-origin-storage development by creating an account on GitHub.
Swizec Teller
@swizec.com

We used to have this many years ago by default. It was common to load jQuery et al from a public CDN so most people wouldn't have to download it again just for your site. Then marketers started using it to fingerprint. And hackers used it to poison cross-origin JS. The feature got removed sigh

Ben Schwarz
@benschwarz.bsky.social

Due to the way caches are domain sharded for privacy, it doesn’t really work that well. Caches aren’t as effective as people had hoped. That, and a third party takeover of a CDN is too bigger security risk for most websites

Thomas Steiner
@tomayac.com

This attack would not be possible with COS because it's hash-based. Say you expect jQuery 1.2.3 with hash def456 and good-become-evil dot com /jquery1_2_3.js suddenly serves a modified resource, then said resource would not be allowed in the COS cache for the hash mismatch.

0 reposts3 likes

No replies yet.