Provide official browser compatible version in the releases

[ray-lothian]

I know that we can use https://wzrd.in/standalone/tldjs, but there is no version control. We need something that is persistent and can be referenced, so that it can be checked in the future (MD5 for instance).

[remusao]

Hi @ray-lothian,

Did I understand correctly that you would like to have tld.js bundle both the rules (public suffix) and the source code at once so that it can be versioned. If so, I think it's important to point out that there is a trade-off here that not everyone is willing to take:

1. With tld.js you get automatic updates of the rules when you install and sub-sequentially in postinstall hooks. This ensures that your project always gets the latest version of the rules (which are updated continuously with new domains/suffixes) even when there is no new release of the package on npm.
2. You can bundle the rules, which means that the version of the package corresponds to the version of the rules. The trade-off is that you need to update the dependency to get updated rules, and you need to trust the project to release a new version for every new rule update. There are libraries offering this trade-off as well.

Hope that helps,

[ray-lothian]

Right but there are some cases where an external library may need to be verified later.

For instance, in my case, I've just started using this library in my browser extension. Note that browser extensions do not allow remote resources. So anyway I need to download the latest version and pack it with my extension. The problem is that there is no reliable way to check the original library to make sure it is not being modified. This is a requirement that extension reviewers check on each update; https://developer.mozilla.org/en-US/Add-ons/Third_Party_Library_Usage

If we have an official bundle then I can point to the particular version and it is really easy for the reviewer to verify.

[remusao]

I understand. Than I think this is currently not possible with tld.js unfortunately.

[thom4parisot]

If i understand well, you’d like to reference Tld.js within your package.json and to import it within your extension codebase? Or you’d like to fetch a version with all the dependencies + rules to bundle it within your extension?