Hacker News new | ask | show | jobs
by progmal1 3912 days ago
At its face this looks like a good idea, but given the hassle of injecting the new checksum in the base file for every change I doubt it will be done by anyone but the most security conscious companies.
2 comments

1. Not many people hand-write HTML tags these days, they tend to get generated at the level of apps like WordPress (which already has an SRI plugin) or frameworks like Rails (which can already do things like javascript_include_tag :application, integrity: true).

2. The people who do hand write HTML tags tend to be precisely the type of people who would go out of their way to generate an md5 checksum on the commandline, or write a script to post process their HTML files.

Seems trivial. You go to the CDN page to get the script URL and right next to it is the hash. Maybe they have the whole tag for you to copy and paste.