{"action":"created","issue":{"url":"https://api.github.com/repos/w3ctag/packaging-on-the-web/issues/19","labels_url":"https://api.github.com/repos/w3ctag/packaging-on-the-web/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/w3ctag/packaging-on-the-web/issues/19/comments","events_url":"https://api.github.com/repos/w3ctag/packaging-on-the-web/issues/19/events","html_url":"https://github.com/w3ctag/packaging-on-the-web/issues/19","id":53886752,"number":19,"title":"Is it safe to deploy over plain-text HTTP?","user":{"login":"yoavweiss","id":786187,"avatar_url":"https://avatars.githubusercontent.com/u/786187?v=3","gravatar_id":"","url":"https://api.github.com/users/yoavweiss","html_url":"https://github.com/yoavweiss","followers_url":"https://api.github.com/users/yoavweiss/followers","following_url":"https://api.github.com/users/yoavweiss/following{/other_user}","gists_url":"https://api.github.com/users/yoavweiss/gists{/gist_id}","starred_url":"https://api.github.com/users/yoavweiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yoavweiss/subscriptions","organizations_url":"https://api.github.com/users/yoavweiss/orgs","repos_url":"https://api.github.com/users/yoavweiss/repos","events_url":"https://api.github.com/users/yoavweiss/events{/privacy}","received_events_url":"https://api.github.com/users/yoavweiss/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-09T16:36:36Z","updated_at":"2015-01-10T09:07:18Z","closed_at":null,"body":"Quoting from the document:\r\n> Developers who cannot yet use HTTP/2 may find that using packages can provide performance benefits through reducing numbers of requests\r\n\r\nI think there's an assumption here that this file format is safe to deploy over plain-text HTTP (Since TLS is probably the main hurdle to adoption of HTTP/2).\r\n\r\nSince this format enables cache population under a certain path, is it not something we know to be safe to use with HTTP? Can't it be abused, beyond the current possible abuse of HTTP cache in MITM scenarios?\r\n\r\nI think it'd be good if the document addressed that point."},"comment":{"url":"https://api.github.com/repos/w3ctag/packaging-on-the-web/issues/comments/69449264","html_url":"https://github.com/w3ctag/packaging-on-the-web/issues/19#issuecomment-69449264","issue_url":"https://api.github.com/repos/w3ctag/packaging-on-the-web/issues/19","id":69449264,"user":{"login":"yoavweiss","id":786187,"avatar_url":"https://avatars.githubusercontent.com/u/786187?v=3","gravatar_id":"","url":"https://api.github.com/users/yoavweiss","html_url":"https://github.com/yoavweiss","followers_url":"https://api.github.com/users/yoavweiss/followers","following_url":"https://api.github.com/users/yoavweiss/following{/other_user}","gists_url":"https://api.github.com/users/yoavweiss/gists{/gist_id}","starred_url":"https://api.github.com/users/yoavweiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yoavweiss/subscriptions","organizations_url":"https://api.github.com/users/yoavweiss/orgs","repos_url":"https://api.github.com/users/yoavweiss/repos","events_url":"https://api.github.com/users/yoavweiss/events{/privacy}","received_events_url":"https://api.github.com/users/yoavweiss/received_events","type":"User","site_admin":false},"created_at":"2015-01-10T09:07:18Z","updated_at":"2015-01-10T09:07:18Z","body":"Specifically what worries me is the package's ability to populate caches for URLs that the user has not (yet?) requested, and poison the user's cache.\r\n\r\nI'm not sure there's a vulnerability there beyond MITMing simple HTTP traffic, but I think it's a point worth addressing, and getting a proper security review on. "}}