Subject: [Mathmesh] Using UDF for CDN content

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 11 Nov 2019 12:11:00 -0500

I am just updating the Web site and upgrading to Bootstrap 4. In the
process, I came across this:

<!-- Latest compiled and minified CSS -->
<link rel="stylesheet" href="
https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css">
Of course downloading bootstrap from a CDN makes every bit of sense and
even better to not have to download it more than once. But lets just step
back and think about what this line of code does.

In effect, bootstrapcdn.com has just become a root of trust for my Web
pages. I have handed a vast degree of trust over to a site that I have no
direct connection to. All I did (or would have done if I wasn't a security
nut) was to cut and paste the code from a Web page giving me instructions.

Replacing the variable uri with a hardened one is much better:

<link rel="stylesheet" href="udf:
maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4">

Of course we might well require some sort of transition strategy but it
seems we now EOL Web browsers after 8 years (IE 9 is no longer supported by
BS 4).

Content digest of the content provides a link to a fixed static version of
a resource which is exactly what I think is needed here. I do NOT want
anyone making supposed 'bug fixes' to content I am linking to without
testing them on my end.

If a link to dynamic content was required, the way to effect it would be to
provide the content digest of the signature key.

---

From: Michael Richardson <[email-masked]>
Date: Tue, 12 Nov 2019 15:21:36 +0800

On 2019-11-12 1:11 a.m., Phillip Hallam-Baker wrote:
> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css">  
> Of course downloading bootstrap from a CDN makes every bit of sense
> and even better to not have to download it more than once. But lets
> just step back and think about what this line of code does.
>
> In effect, bootstrapcdn.com <http://bootstrapcdn.com> has just become
> a root of trust for my Web pages. I have handed a vast degree of trust
> over to a site that I have no direct connection to. All I did (or
> would have done if I wasn't a security nut) was to cut and paste the
> code from a Web page giving me instructions.

You are completely correct in your assessment.  You could download the
code and put it on your web site, which would improve your threat
surface, but if you did that you would be defeating a great deal of
caching done by browsers of this kind of content.  You might also miss
out on updates, although if you are linking to a version-numbered
content, then you are not getting any update advantage.
I seem to remember linking to major-version only when pulling in jQuery.

> <link rel="stylesheet" href="udf:maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4
> <http://maxcdn.bootstrapcdn.com/MB5S-R4AJ-3FBT-7NHO-T26Z-2E6Y-WFH4>">  
>
> Of course we might well require some sort of transition strategy but
> it seems we now EOL Web browsers after 8 years (IE 9 is no longer
> supported by BS 4).

Could we rely on some other (more primitive) bit of javascript to go
through and replace this with the correct one?  That probably means
using something other than href=""

> Content digest of the content provides a link to a fixed static
> version of a resource which is exactly what I think is needed here. I
> do NOT want anyone making supposed 'bug fixes' to content I am linking
> to without testing them on my end.
>
> If a link to dynamic content was required, the way to effect it would
> be to provide the content digest of the signature key.

I would like to further remove the hostname from that and just give a hint.
Any content with that hash would satisfy the requirement.

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 12 Nov 2019 13:15:47 +0000

Isn't sub-resource integrity also supposed to address this?

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 12 Nov 2019 16:30:53 +0100

RFC 6920

Sent from mobile, sorry for terse

> On 12. Nov 2019, at 08:44, Michael Richardson <[email-masked]> wrote:
> 
> 
> 
> -- 
> Mathmesh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mathmesh

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 12 Nov 2019 22:52:47 -0500

> Isn't sub-resource integrity also supposed to address this?

Wow it actually happened. Larry Masinter only suggested doing this in 1994
after the first Web conference...

Its been one of those things that has been proposed so often since and
never went anywhere.

---

From: Michael Richardson <[email-masked]>
Date: Fri, 15 Nov 2019 16:35:37 +0800

> RFC 6920

  which is: Naming Things with Hashes

while it provides for retrieving things via a /.well-known interface,
and it provides for human readable (nih), it just feels too hard to use
in practice.  I think that I can build a udf:// server with any stock
static web server by just putting the things into a flat directory, with
the files named for the encrypted/hashed items.

ni:// supports fixing the content, but not encrypting it.

So I agree that there is significant overlap, and maybe we can make
udf:// an extension of ni://.  We should explore that.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 18 Nov 2019 14:25:53 +0800

The encryption piece was dropped from the main document. But it is in the
draft:

https://tools.ietf.org/html/draft-hallambaker-decade-ni-params-03

If there was a ni userbase, I would have resurrected this already. But I
don't think there is.