webappsec-subresource-integrity VS quickjspp

Seeing this, it reminded me of an interesting topic: caching at browser-level the external libraries used for big performance improvements: https://github.com/w3c/webappsec-subresource-integrity/issue...

All package managers implement strict specifications on this approach to integrity. For example, npm respects the W3C's "Subresource Integrity or SRI" specification, which describes the mechanisms to be implemented to reduce the risk of malicious code injection. You can jump directly here to the specification document if you want to dig deeper.

One proposed solution is checksums on CDN provided javascript:

https://w3c.github.io/webappsec-subresource-integrity/

It's great to hear that you want this added to browsers themselves, and you're right that browsers are more likely to implement such changes if you can show that users are deliberately installing an extension to add the missing functionality.

There has been some discussion at the W3C about extending the SRI spec in this direction[0], but it seems they are reluctant to do that unless "multiple browser vendors" choose to implement something like this.[1] Hopefully the existence and adoption of this browser extension helps to solve that bootstrapping / Catch-22 problem.

As for usability, would it be sufficient to just adopt a TOFU model, where the browser pins the first key it sees for a domain? To prevent the risk of permanently bricking a site (if the key gets lost, or the host gets temporarily compromised) you could politely warn the user that the key has changed, or just show a different colour icon representing that the code is correctly signed with an unknown key.

[0] https://github.com/w3c/webappsec/issues/449

[1] https://github.com/w3c/webappsec-subresource-integrity/issue...

Including the hash is exactly what subresource integrity does (even in a CDN context, conveniently enough), but so far people haven’t figured out a sufficiently non-leaky design to use it for caching[1,2].

[1] https://github.com/w3c/webappsec-subresource-integrity/issue...

[2] https://hillbrad.github.io/sri-addressable-caching/sri-addre...

JSX is useful not just for advanced string interpolation but for representing/generation of tree alike structures / literals in PL. JSX is not only about HTML but XML too.

I don't know how JSX is made in LuaX but in my QuickJS fork [1] JSX allows to generate as tree literals as procedure calls (JSX(tag,props,kids)) that can be used for various purposes - DOM population, VDOM generation, HTML/XML string composition, etc.

And being embedded into a compiler JSX a) prevents common mistakes like non-closed tags and b) effective internalization ( translation happens at compile time once ).

[1] JSX implementation for QuickJS : https://gitlab.com/c-smile/quickjspp/-/blob/master/quickjs-j...

In Sciter I did just that - JSX is an integral part of JS compiler - patched version of QuickJS : https://gitlab.com/c-smile/quickjspp/-/blob/master/quickjs-j...

So in Sciter this works out of the box:

Only when code tries to access props/methods of the loaded object it gets fetched from disk, its __proto__ is set to particular class, etc.

More on this architecture: https://gitlab.com/sciter-engine/sciter-js-sdk/-/blob/main/d...

Patched QuickJS with storage support is here: https://gitlab.com/c-smile/quickjspp - it uses DyBase of Konstantin Knizhnik as a storage.