We do in fact care. I put up a fix on https://bugzilla.mozilla.org/show_bug.cgi?id=1478037 https://bugzilla.mozilla.org/show_bug.cgi?id=1478037 just yesterday

We do in fact care. I put up a fix on https://bugzilla.mozilla.org/show_bug.cgi?id=1478037 https://bugzilla.mozilla.org/show_bug.cgi?id=1478037 just yesterday which will make https://alisdair.mcdiarmid.org/kill-sticky-headers https://alisdair.mcdiarmid.org/kill-sticky-headers work in Firefox no matter what the CSP says. I fully expect to get that landed sometime in the next few weeks. Making CSP not affect bookmarklets at all (as opposed to not affecting whether they execute) is a different situation entirely, because bookmarklets by definition execute in the JS environment of the page (unlike extensions, say), so it's not really possible to tell apart things that the bookmarklet does from things the page does. For example, what should happen if the bookmarklet calls a page-defined function that then does a subresource load? What if a bookmarklet defines a function to do a subresource load that the page later calls? Note that from the point of view of the JavaScript engine the functions the bookmarklet defines and the ones the page defines are indistinguishable from each other...