3 ms·
If something is so hard to use that nobody can be arsed to do it properly, it's generally a signal that the tool needs to be redesigned.
by thrower123 8y ago
If something is so hard to use that nobody can be arsed to do it properly, it's generally a signal that the tool needs to be redesigned.
- dwheeler 8y agoCSP could be better, but it's perfectly useful as it is. The problem is that too many people did things badly (using inline JavaScript), mixing up code and data. It's time-consuming to fix problems like that, but possible. Enabling CSP is easy... it's fixing your system so it works with it that takes time. The CII Best Practices Badge uses restrictive CSP. You can tell that here: https://securityheaders.com/?q=bestpractices.coreinfrastructure.org&followRedirects=on https://securityheaders.com/?q=bestpractices.coreinfrastruct...
- netsectoday 8y agoI'm not sure redesigning this would help because it's just a mechanism to define an ACL. Yes, it's hard to implement correctly and maintain, but that's because of the wild number of external dependencies developers toss into modern webpages. Start with basic HTML and your header just looks like this: Content-Security-Policy: default-src 'self'