This is just the beginning, once kimi k3.1 is out with cyber curated dataset post training we will likely see far more advanced attacks.

For now most of these appear to be related to supply chain attacks which can be avoided with basic discipline and using features that browsers had for years: https://developer.mozilla.org/en-US/docs/Web/Security/Defens...

▲

youngtaff 4 hours ago | parent [-]

SRI only really works if the 3rd-party script never changes, in which case why is it a third-party script?

If it changes and the hash no longer matches perhaps due customer changing config then the site is faced with the challenge of either the browser refusing to load the script (with potential breakage) or reporting the change which then is probably ignored

It's not really a simple fix for the way the web is built today

	▲	himata4113 4 hours ago \| parent \| next [-]
		usually scripts have versions, this protects you from compromised cdns as well where you publish assets in a different location compared to where your frontend is served. If a library serves a script and your site manages user funds you should probably avoid using it or use a cdn that does. I am not quite sure, but there's also other integrity mechanisms that gurantee that a file was signed by the library developer via a served header with the signature of the file.
	▲	skinfaxi 2 hours ago \| parent \| prev [-]
		Letting any vendor arbitrarily update code running on your customer's computers without even your knowledge is insane.