Comment on WebRTC Copy – OTR and fast file transfers over WebRTCparentComments−sillysaurus212yIf your concern is the host operator, well obv can't circumvent that.Of course we can circumvent that. Make a plugin to alert the user whenever the JS changes.−voltagex_12yWhat do you base your initial known good JS on though? What is the user supposed to do with the information that the JS has changed? A diff of minified JS isn't that helpful.−sillysaurus212yThe author would say "the current version is 0.6.4 and its JS hashes to this SHA256 hash: xxx"Open source already does this for binaries. Why not JS?This assumes it's even possible to get a consistent hash of all javascript executing on a page, though.−mike-cardwell12yScript on a site like this should not be minified. It should be easily readable and well commented, so that people can audit it properly.
Comments
If your concern is the host operator, well obv can't circumvent that.
Of course we can circumvent that. Make a plugin to alert the user whenever the JS changes.
What do you base your initial known good JS on though? What is the user supposed to do with the information that the JS has changed? A diff of minified JS isn't that helpful.
The author would say "the current version is 0.6.4 and its JS hashes to this SHA256 hash: xxx"
Open source already does this for binaries. Why not JS?
This assumes it's even possible to get a consistent hash of all javascript executing on a page, though.
Script on a site like this should not be minified. It should be easily readable and well commented, so that people can audit it properly.