3 ms·
1. Tracking is not really effective if the user agent caches the font aggressively. 2. Subresource integrity takes care that at least the file cannot be modifi
by webjunkie 9y ago
1. Tracking is not really effective if the user agent caches the font aggressively.
2. Subresource integrity takes care that at least the file cannot be modified freely without you knowing.
So there is only the case that the file either is there as you expect, or it is not available. Does that leave room for malicious intent?
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- hdhzy 9y agoSubresource integrity is a double edged sword because when a third party updates a resource then your page breaks. Of course you can build fallbacks by loading from your domain in case of errors but then you just doubled engineering effort and have rarely executed code paths in your source.
- webjunkie 9y agoTrue. I'm not saying this solves the problem, but at least the "outside of your control" part is not absolute.
- AndrewStephens 9y agoSubresource integrity is OK, but in this case would have totally broken the site in a different way. If you want to make sure a resource can't change, host it yourself and don't change it.