Government, IT and Workshop - Information Management Today

The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries

Troy Hunt

FEBRUARY 11, 2018

This tag was in the source code over at secure.donaldjtrump.com/donate-homepage yet it was pulling script directly off Igor Escobar's GitHub repository for the project. Even my own state government down here had been hit. I know, we're all shocked but bear with me because it's an important part of the narrative of this post.

Libraries

Libraries Risk Government IT

Subresource Integrity and Upgrade-Insecure-Requests are Now Supported in Microsoft Edge

Troy Hunt

MAY 1, 2018

I recently wrote about the Browsealoud problem where a cryptominer ended up on a bunch of government websites due to them embedding an external script and allowing it to run whatever it wanted to in the context of their site. No - cyber-sticky tape! And so it is with trusting JavaScript served from third parties.

IT Security Government

Information Management Today

The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries

Subresource Integrity and Upgrade-Insecure-Requests are Now Supported in Microsoft Edge

Webinars

Stay Connected