3 ms·
I ALWAYS run 3rd party JavaScript on my payments page. That's what Stripe is, after all. In this blog post the author identifies probably 1 questionable third
by ejcx 8y ago
I ALWAYS run 3rd party JavaScript on my payments page. That's what Stripe is, after all.
In this blog post the author identifies probably 1 questionable third party resource. As scary as it sounds it's not exactly easy to just compromise major JS providers and start stealing cc data. It's possible but instances of it happening are extremely rare.
Knowing what you're loading is more important than not loading anything. It's not realistic to expect no third party js in today's world, and even versioning+SRI has issues because it solves one problem by creating a new one.
- wccrawford 8y agoI think they point they're trying to make is that there's no guarantee the script you get isn't hacked unless you use SRI. The focus isn't on third-party javascript, but un-secured javascript.