[kzahel]

I have an exercise: is it possible to create a javascript file (served over https) that, when included in a non-https HTML page, is able to determine whether any other scripts were included on the page or will be included on the page by a man-in-the-middle?

If this were possible (I suspect it is not), then it might be possible to have secure javascript code running over a non-HTTPS url. (the motivation for this is to have some form of security and still be able to load websockets and make CORS xmlhttprequests to other (non-secure) hosts - with the assumption that these hosts may also be man-in-the-middled). For now, the only alternative is to use something like a packaged app, if you want to make sure your code is actually your code, and still be able to load insecure resources.

[judofyr]

An attacker can just remove the <script>-tag that points to the HTTS-served verifier.

In general: If the site the user visits is plain HTTP then there's no way to trust the site.

[vikstrous4]

It's not possible. What's possible is using a browser extension to verify some of the essential javascript and use that javascript to do further verification.