Re: [w3c/ServiceWorker] Preventing server-forced updates (#822)

> deploy [SRI] to DNS

This might be really useful for concerns about a CDN becoming malicious while the legitimate operator still controls the DNS, but doesn't do anything for the "don't trust the operator" use case.

> similar to Certificate Transparency

Actually sounds compelling!… with the caveat that not every app is public and wants to be transparent, I guess.

---

Now that I think about it, what if we could have ServiceWorker/page-controlled updates under a special "installed web app" concept? So instead of imposing the controlled update model onto regular `https://` origins, there would be an action to "install" an app that would move it to a special `app://` origin that is basically a Cache-only one.. (For "add to home screen" this could happen implicitly, otherwise with a permission prompt for that in particular)

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/822#issuecomment-1867966171
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/ServiceWorker/issues/822/1867966171@github.com>