Thank you! I had searched but hadn't been able to find this idea this sounds exactly like what I have had bouncing around in my head for a while now!
I just read the w3c spec it seems more like an integrity check, but it so trivial to just use the integrity hash to download the data that the next step is removing the src tags all-together / using them as a fallback.
Yes. The spec includes the option of providing fallback URLs to fetch from, and gives the browser fairly broad freedom (as I read it) to fulfill the request so long as the response data matches the given hash. How this connects up with the other ideas being discussed in this thread isn't immediately clear to me, as DHTs in practice tend to be too slow to block on for most in-browser resources, but I'd definitely call it an intriguing development.
Comments
Related reading:
ipfs, an optionally-authenticated hash-based global filesystem: http://ipfs.io
subresource integrity: an emerging web standard whereby you can specify a resource by its hash: http://w3c.github.io/webappsec/specs/subresourceintegrity/
Thank you! I had searched but hadn't been able to find this idea this sounds exactly like what I have had bouncing around in my head for a while now!
I just read the w3c spec it seems more like an integrity check, but it so trivial to just use the integrity hash to download the data that the next step is removing the src tags all-together / using them as a fallback.
Yes. The spec includes the option of providing fallback URLs to fetch from, and gives the browser fairly broad freedom (as I read it) to fulfill the request so long as the response data matches the given hash. How this connects up with the other ideas being discussed in this thread isn't immediately clear to me, as DHTs in practice tend to be too slow to block on for most in-browser resources, but I'd definitely call it an intriguing development.