Hashes are generally much better than nonces, especially for static assets. They ensure that the contents of the allowed resource are exactly what they're suppo

Hashes are generally much better than nonces, especially for static assets. They ensure that the contents of the allowed resource are exactly what they're supposed to be. They're quite trivial to generate for static resources, though it should be possible to generate them for dynamic resources too. Of course, I don't for a moment wish to excuse the behavior of patent-trolling companies like Datawing. I hope that the combined weight of Google, Mozilla, and the EFF can nip this in the bud.