Did a PR to gnosis safe UI to add missing SRI protection

https://github.com/safe-global/safe-wallet-monorepo/pull/5186/files

For those not in loop SRI tells the browser to not load javascript files that don't match an integrity hash

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

 All bundlers support this with plugins

Still seems not super useful so long as the top-level page itself isn't integrity-verifiable... Especially if all these bundles are served from the same server.

Contributor @ /walletbeat.

Censorship resistance requires privacy.

I think this is mostly useful for ensuring that third party scripts keep the integrity

probably not as useful for local ones

building Stauro ❇ frontend dev at @ensdomains ❇
prev. @rainbow, @geniexyz, @fleek

It makes auditing the site super simple. If you ensure your root HTML is correct you can be confident all other assets will have integrity

can't imagine a scenario where local JS scripts are compromised and HTML is left untouched

usually the whole front-end is compromised

I can. It can happen if the app is a PWA that doesn't have autoupdates on and you haven't downloaded an asset yet.