3 ms·
You can't put third party javascript through change management. Unless you download and host it yourself, in which case it's not really third party.
by dec0dedab0de 5y ago
You can't put third party javascript through change management. Unless you download and host it yourself, in which case it's not really third party.
- Puts 5y agoWell we can absolutely talk semantics. Code written by a third-party is third-party code however it is hosted. Your conclusion is right however. If you are serious with your security and change management you host all scripts yourself. Or use sub-source integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- dec0dedab0de 5y agoOf course it's third party code. I meant that it's not really third party in the context of this article advocating for a same origin policy for javascript. I only came across SRI while dealing with CSP, and I didn't quite understand why anyone would subject themselves to that until just now. Thanks for pointing it out.