You're correct that it's not using CSP headers (which is difficult in practice to use), which is why I call it a virtual content security policy. Yes, it's anot

You're correct that it's not using CSP headers (which is difficult in practice to use), which is why I call it a virtual content security policy. Yes, it's another resource that expands your attack surface but when you have sites running tens of scripts already, I think one more is a small attack surface delta, and there's ways to minimize that risk too. For knowing what to allow/deny yes there's blacklists but also various more intelligent things as well. That's one of the problems with CSP headers is that they're too black and white today. With Enchanted Security, for example, you can configure it to say things like "allow Google Analytics but only for my tracking id UA-123456789-1" (this is because hackers have used Google Analytics as a data exfiltration mechanism where they sent data back to their hacker-controlled GA account)