3 ms·
That's like saying not sending Content-Security-Policy when it is needed to prevent XSS is not a security bug, since Chrome can start to ignore Content-Security
by sanxiyn 6y ago
That's like saying not sending Content-Security-Policy when it is needed to prevent XSS is not a security bug, since Chrome can start to ignore Content-Security-Policy (which it can). That is absurd.
- andreareina 6y agoThat's more like the case with the Do Not Track header being defaulted to 1 in some browsers and many (most?) sites using that as an excuse to not honor it.
- sanxiyn 6y agoI think it is a good outcome too. If people really want relevant and targeted ads, they will opt-in to no-DNT and yes-FLoC. The fact that people don't, and that websites don't honor DNT, reveal their lies and hypocrisy.
- berkes 6y ago> ... and that websites don't honor DNT... This is the important part regarding "security". Websites choose to not honor "DNT" headers. Clients can just as easy choose not to honor no-floc headers. Which is why I'm saying that this is not a security-thing. If people can just choose to ignore your security-headers, they are not a security-feature. At most they are a suggestion that, when followed, make the client honor privacy concerns from servers.