webappsec-subresource-integrity
semver
Our great sponsors
webappsec-subresource-integrity | semver | |
---|---|---|
5 | 720 | |
69 | 7,026 | |
- | 1.4% | |
0.0 | 0.6 | |
about 1 year ago | 5 days ago | |
HTML | ||
GNU General Public License v3.0 or later | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
webappsec-subresource-integrity
-
JavaScript import maps are now supported cross-browser
Seeing this, it reminded me of an interesting topic: caching at browser-level the external libraries used for big performance improvements: https://github.com/w3c/webappsec-subresource-integrity/issue...
-
📦 Everything you need to know: package managers
All package managers implement strict specifications on this approach to integrity. For example, npm respects the W3C's "Subresource Integrity or SRI" specification, which describes the mechanisms to be implemented to reduce the risk of malicious code injection. You can jump directly here to the specification document if you want to dig deeper.
-
Python 3.11 in the Web Browser
One proposed solution is checksums on CDN provided javascript:
https://w3c.github.io/webappsec-subresource-integrity/
-
How Cloudflare verifies the code WhatsApp Web serves to users
It's great to hear that you want this added to browsers themselves, and you're right that browsers are more likely to implement such changes if you can show that users are deliberately installing an extension to add the missing functionality.
There has been some discussion at the W3C about extending the SRI spec in this direction[0], but it seems they are reluctant to do that unless "multiple browser vendors" choose to implement something like this.[1] Hopefully the existence and adoption of this browser extension helps to solve that bootstrapping / Catch-22 problem.
As for usability, would it be sufficient to just adopt a TOFU model, where the browser pins the first key it sees for a domain? To prevent the risk of permanently bricking a site (if the key gets lost, or the host gets temporarily compromised) you could politely warn the user that the key has changed, or just show a different colour icon representing that the code is correctly signed with an unknown key.
[0] https://github.com/w3c/webappsec/issues/449
[1] https://github.com/w3c/webappsec-subresource-integrity/issue...
-
“Outlook just asked me if I want to upgrade to bigger ads?”
Including the hash is exactly what subresource integrity does (even in a CDN context, conveniently enough), but so far people haven’t figured out a sufficiently non-leaky design to use it for caching[1,2].
[1] https://github.com/w3c/webappsec-subresource-integrity/issue...
[2] https://hillbrad.github.io/sri-addressable-caching/sri-addre...
semver
-
Master the Art of Writing and Launching Your Own Modern JavaScript and Typescript Library in 2024
Following the Semantic Versioning rules, you should raise the version number every time you need to publish your library. In your "package.json" file, you need to change the version number to reflect whether the changes are major, minor, or patch updates.
-
Using semantic-release to automate releases and changelogs
Semantic Versioning: An established convention for version numbers following the pattern MAJOR.MINOR.PATCH
-
Essential Command Line Tools for Developers
Increases the major of the latest tag and prints it As per the Semver spec, it'll also clear the pre-release…
-
Testing Our Tasks
The reason for this is that software libraries and package managers, in general, but specifically here, rely on semantic versioning. Semantic versioning is really useful for distributing packages in a predictable way. What does this look like for our project?
-
What is Semantic Versioning and why you should use it for your software ?
For a more detailed and comprehensive guide on semantic versioning, visit https://semver.org
-
Neovim v0.9.5 Released
I believe neovim follows semantic versioning. https://semver.org/
-
Semver 2.0.0 Released
Semver has been 2.0.0 for 10 years, look at the date of the assets. Multiple releases created today where none existed before. Not sure why someone is creating releases now, perhaps just some housekeeping/cleanup.
https://github.com/semver/semver/releases
-
First purchase advice
All ELRS hardware will talk to all other ELRS hardware, including Radiomaster's ELRS transmitters and receivers. There are one or two exceptions from scummy companies that have been pilloried by the community, and you probably won't find them anymore. So long as the ELRS firmware running on both devices has the same major version number, you're good to go. ie. 3.3.1 will still talk to 3.0.1, but won't talk to 2.0.0. (The "major version" is the 1st number, the "minor version" is the 2nd number, and the "patch version" is the 3rd number. See Semantic Versioning for more info.)
-
fkYAML v0.3.0: Support non-string-scalar nodes as mapping keys
If you're using semver, read the spec it's not overly long or hard to understand.
-
Immich will have breaking changes (again) in the next release
Semantic versioning actually has a clear rule about this:
What are some alternatives?
mma - MMA - Musical MIDI Accompaniment. This is a mirror of the original author's code drops.
react-native - A framework for building native applications using React
Roundcube - The Roundcube Webmail suite
semantic-release - :package::rocket: Fully automated version management and package publishing
compression-dictionary-transport
standard-version - :trophy: Automate versioning and CHANGELOG generation, with semver.org and conventionalcommits.org
ci - NodeSecure tool enabling secured continuous integration
changesets - 🦋 A way to manage your versioning and changelogs with a focus on monorepos
quickjspp
helmfile - Deploy Kubernetes Helm Charts
wasmtime - A fast and secure runtime for WebAssembly
Poetry - Python packaging and dependency management made easy