Post

wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed

The amount of pain that this would cause a regulated software product would be horrifically large without an ability to opt out entirely. It’s a great idea, but hashes aren’t sufficient anymore for where regulations are trending Now, combine this with attestation and you have me very interested :)

but i would love to know more about the issue with regulated sites… is it related to privacy?

No it’s about being able to guarantee your supply chain. Having the runtime of your software not under your control has large implications for risk management and for producing the evidence required to demonstrate compliance

As a trivial example, how do I prove I did the appropriate work to verify that my code and its dependencies are free of known vulnerabilities when part of that code is no longer produced by my software packaging and deployment process?

I want to make a comment about the fact that I JUST gave a talk about this on a stage we both spoke from, but to be fair I did say websites aren’t covered by the CRA without clarifying that there are plenty of other regulations that cover many industries (finance, healthcare, etc) that may apply.

Oh whoops. I should’ve clarified that I didn’t necessarily mean the CRA. It’s definitely covering more things! But this isn’t one of them and I appreciate you clarifying that here 🥰