Hacker News new | past | comments | ask | show | jobs | submit login

The project looks very promising but relies on running a lot of javascript from untraceable sources in the browser.

Given the long history of vulnerabilities in the the browsers, trusting js from a well-known website might be OK, trusting js from zeronet is unreasonable.

If ZeroNet could run with js code generated only by the local daemon or without js it would be brilliant.




Chrome added a feature a long while back I really wanted for ages. The ability to specify the checksum of a linked asset, so that it can be verified as it's downloaded (and untrusted/discarded if not). I just can't find the docs for it. :( My Google-fu is not strong.

EDIT:

Found it :D

https://w3c.github.io/webappsec-subresource-integrity/



It's kind of a shame they didn't let their imagination fly with that one... I wish integrity were a global attribute, because I could totally see using it for things like images and audio/video.


It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Another option would be to just use a subresource-integrity protected script to check the hash of a downloaded image/video before displaying it.


That is clever and I like you.


And then any site could check whether you've seen a particular image before just by including it and seeing how long it takes to load, yay!


Nice feature but you need to trust the HTML page that is pulling the js. ZeroNet allows any HTML page to pull any script.


And... we're back to loving IPFS :3


I was pretty sure I knew what you meant but to be a bit more explicit: it's a real integrity check using hashes and not merely a checksum.


If we are nitpicking like this: It uses cryptographic hash functions and not merely the hash functions commonly used by hash tables.


This is why native clients (real native clients, not browsers-in-cans) are so important: they enable one to be more secure against targeted attacks, and they enable many eyes to review code and hence make one more secure against untargeted attacks.

Frankly, given much of the history of successful Internet tools & protocols, I'd love to see some text-UI clients for ZeroNet.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: