Post

Looks like PCI is a real innovation enabler. I was astound when I saw the requirements of CSP, too. Now this.

@javanrasokat.bsky.social

yeah, although the risk is that there'll be funky vendor solutions until there's browser support for proper solutions (like we proxy all scripts through our service or do some funky scanning to check if any of your scripts have changed)

Javan Rasokat

19 Nov 2024

Oh yes, I first became aware of CSP runtime monitoring through a vendor (guilty as charged).

Ben Stock

@benstock.bsky.social

swag.cispa.saarlandswag.cispa.saarland

On the plus side, one of the limitations of SRI was third parties adding random content (see swag.cispa.saarland/papers/steff... final table). However, SRI in its current form protects including sites from a full compromise, whereas this assumption is being relaxed if there are signatures involved.

Mike West

@mikewe.st

19 Nov 2024

You're entirely right. The promises signatures can make are different in kind, but hopefully no less useful. wicg.github.io/signature-ba... and wicg.github.io/signature-ba... get at the distinctions to some extent, and I'd welcome additions to those descriptions.

wicg.github.ioSignature-based Integrity

Indeed signatures have different security properties, but since trusting a signature is an opt-in feature, I'm not worried about this.

Also Signatures allows for nice advanced code provenance use cases like removing the CDN form the TCB by signing an OSS build in a github workflow and have the CDN pass on the pubkey.

also please join me in thanking @mikewe.st, @ddworken.bsky.social and @yoav.ws for pushing this forward!