Re: [packaging-on-the-web] Is it safe to deploy over plain-text HTTP? (#19)

Specifically what worries me is the package's ability to populate caches for URLs that the user has not (yet?) requested, and poison the user's cache.

I'm not sure there's a vulnerability there beyond MITMing simple HTTP traffic, but I think it's a point worth addressing, and getting a proper security review on. 

---
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/packaging-on-the-web/issues/19#issuecomment-69449264