Re: Subresource Integrity strawman.

Another interesting use case is #2 in the spec: advertising networks
generally review submitted ads in some way, approve them, and then delegate
the actual _serving_ of ad content out to third-party servers. This often
goes awry in spectacularly malicious ways.

It would be valuable for advertising networks to be able to specify
integrity metadata for ad content to ensure that _exactly_ the reviewed ad
is served, and no malicious substitutions are made.


Mike West <>
Google+:, Twitter: @mikewest, Cell: +49 162 10 255 91

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

On Thu, Jan 9, 2014 at 12:45 AM, Devdatta Akhawe <>wrote:

> > may want to use a third-party service to host this resource (e.g. a CDN),
> > but I don't (entirely) trust the third party and want to make sure they
> > don't swap the content on me, so to guard against that I'm going to
> specify
> > an integrity hash in the markup.
> >
> > Does that sound about right?
> yes. That's the main motivation of the specification.
> =Dev

Received on Thursday, 9 January 2014 08:19:43 UTC