Finally found the time to open a discussion on the Snowpack forums about the lack of subresource integrity (SRI) in Skypack: https://github.com/snowpackjs/snowpack/discussions/2569

(Background: my post from the end of last year titled Skypack: backdoor as a Service? https://ar.al/2020/12/30/skypack-backdoor-as-a-service/)

#skypack #snowpack #SubresourceIntegrity #SRI #security #privacy

If you specify subresource integrity in a script tag and then import that script also from a separate tag later on, and the source fails the integrity check, on

1. Firefox (Gecko): script doesn’t execute
2. Ungoogled Chromium (Chromium): script doesn’t execute
3. Epiphany (WebKit): script tag is blocked but script executes via the import

Not sure if Safari does the same but that’s not good.

#SubresourceIntegrity #security

Crafty Web Skimming Domain Spoofs “https” - Earlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that o... more: https://krebsonsecurity.com/2020/03/crafty-web-skimming-domain-spoofs-https/ #grandwesternsteaks.com #contentsecuritypolicy #subresourceintegrity #alittlesunshine #cheneybros.inc. #thecomingstorm #denissinegubko #jeromesegura #malwarebytes #webfraud2.0 #privacy.com #ryanbarnett #publicwww #akamai #.ps