<story><title>Node.js adds support for direct registry-less HTTPS imports</title><url>https://github.com/nodejs/node/pull/36328</url></story><parent_chain><item><author>BeefWellington</author><text>My main problem with this is that they punted the integrity check work down the line.&lt;p&gt;If this had been implemented as something akin to the integrity HTML attribute, e.g.:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    express = require(
        &amp;#x27;https:&amp;#x2F;&amp;#x2F;my_local_repo.tld&amp;#x2F;express&amp;#x2F;current&amp;#x2F;4.17.1&amp;#x27;,
        &amp;#x27;sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K&amp;#x2F;uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC&amp;#x27;
    )
&lt;/code&gt;&lt;/pre&gt;
It would be vastly superior. I&amp;#x27;d go so far as to &lt;i&gt;require&lt;/i&gt; it without an additional --unsafe-import type flag.&lt;p&gt;However, I think they did not do this because the import of dependencies then comes into question. IMO this feature should not have been added until developers could guarantee the expected integrity hash matches.
We&amp;#x27;ve seen time and again what will happen now is hundreds of blog posts talking about this new feature, none of which will mention the integrity hashing functionality (because it&amp;#x27;s not there). When it does eventually get added, those posts will be the most popular anyone can find, and thus new users will end up using those eventually-wrong posts and implementing things in a less-secure way.&lt;p&gt;Huge disservice to the developer community.</text></item></parent_chain><comment><author>jeroenhd</author><text>But what would be the point? Why would you load code over HTTPS if you&amp;#x27;re going to make it static anyway? If the code can&amp;#x27;t change dynamically, then you might as well put it next to the JS file on the filesystem.&lt;p&gt;I think this is a terrible idea that can only end in misery but I can understand why they don&amp;#x27;t add integrity validation by default.</text></comment>
<story><title>Node.js adds support for direct registry-less HTTPS imports</title><url>https://github.com/nodejs/node/pull/36328</url></story><parent_chain><item><author>BeefWellington</author><text>My main problem with this is that they punted the integrity check work down the line.&lt;p&gt;If this had been implemented as something akin to the integrity HTML attribute, e.g.:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    express = require(
        &amp;#x27;https:&amp;#x2F;&amp;#x2F;my_local_repo.tld&amp;#x2F;express&amp;#x2F;current&amp;#x2F;4.17.1&amp;#x27;,
        &amp;#x27;sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K&amp;#x2F;uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC&amp;#x27;
    )
&lt;/code&gt;&lt;/pre&gt;
It would be vastly superior. I&amp;#x27;d go so far as to &lt;i&gt;require&lt;/i&gt; it without an additional --unsafe-import type flag.&lt;p&gt;However, I think they did not do this because the import of dependencies then comes into question. IMO this feature should not have been added until developers could guarantee the expected integrity hash matches.
We&amp;#x27;ve seen time and again what will happen now is hundreds of blog posts talking about this new feature, none of which will mention the integrity hashing functionality (because it&amp;#x27;s not there). When it does eventually get added, those posts will be the most popular anyone can find, and thus new users will end up using those eventually-wrong posts and implementing things in a less-secure way.&lt;p&gt;Huge disservice to the developer community.</text></item></parent_chain><comment><author>__s</author><text>There&amp;#x27;s already syntax to implement it with imports through import assertions: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;v8.dev&amp;#x2F;features&amp;#x2F;import-assertions&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;v8.dev&amp;#x2F;features&amp;#x2F;import-assertions&lt;/a&gt;</text></comment>