3 ms·
You don't know - which is why javascript needs to be whitelist-only, no exceptions. > performance-related reasons Security is always more important than perfo
by pdkl95 11y ago
You don't know - which is why javascript needs to be whitelist-only, no exceptions.
> performance-related reasons
Security is always more important than performance. It's irresponsible to sacrifice security simply to make page loads faster.
Some of these problems can be worked around in the future with authenticated hrefs (such as with a hash-check aka subresource integrity).
- Silhouette 11y agoSecurity is always more important than performance. It's irresponsible to sacrifice security simply to make page loads faster. And where does functionality fit in, in your black and white world? It's easy to make a lot of things perfectly secure, but if in doing so you give up the essential functionality that made those things useful in the first place, what have you really achieved? If you make JS whitelist-only, no exceptions, then you will break the web for huge numbers of people on huge numbers of sites they value, because JS is useful. Those people aren't going to thank you for keeping them safe, they're going to say your browser doesn't work, and then they're going to use someone else's browser that does work instead. In reality, security is nearly always a sliding scale, and the best results are nearly always achieved by balancing security against other factors like performance and functionality to keep the user as safe as possible while still providing whatever it is they actually want.