4 ms·
> And I wouldn't source script from a 3rd party anyway, I never saw the security tradeoff as worth it. Doesn't subresource integrity [1], i.e. specifying the e
by ptx 5y ago
> And I wouldn't source script from a 3rd party anyway, I never saw the security tradeoff as worth it.
Doesn't subresource integrity [1], i.e. specifying the expected hash of the script, solve those security issues? Unless you need to support Internet Explorer, I suppose.
[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- dspillett 5y agoI want aware that had become so well supported. Something to remember for later. Though for personal projects I'll stick with self-hosting, and in DayJob we unfortunately still have to support IE11 to an extent (and beyond that some of our clients strictly whitelist everything and will reject a 3rd party they can't fully audit, ruling out CDNs for those at least, every with SRI).