3 ms·

> CSP is one of the worst pieces of Web security infrastructure that modern browsers unwisely agreed to go along with This got me interested - care to provide

> CSP is one of the worst pieces of Web security infrastructure that modern browsers unwisely agreed to go along with This got me interested - care to provide a reasoning behind it? I'd love to read more on the subject and better understand it. Thanks.

cxr 3y ago
Unfortunately, someone would have to write it first. (Why not you?) My reasoning is in the next sentence: «Incredibly user-hostile and worse, effectively irreversible—there's basically no going back now because browsers don't have the option at this point to say, "Yeah, we're not going to honor this anymore," without putting users at an even greater risk than before CSP ever existed.»
- wscourge 3y ago
  I still don't understand WHY is it "Incredibly user-hostile". Will do my own research anyway.
  - cxr 3y ago
    Refer to the place in the linked article where the part I quoted appears in a section called "Limitations"—the bookmarklet is stopped in its tracks when it encounters style sheets that are loaded from off-site (but that are still loaded nonetheless and have an effect on the current page). Considering that the user is the one who invokes bookmarklets and has their own personal accessibility reasons for doing so, that's an unwelcome limitation. There's a similar effect with CSP: server operators and content authors can use CSP to prevent the use of bookmarklets that ordinarily work by overriding the author's style rules through $element$.style (i.e. the style attribute), inserting style elements with the user's own CSS, or loading/linking against off-site style sheets. See also: Google's WEI ("Web Environment Integrity") proposal from earlier last year that was justifiably opposed by pretty much everyone[1] The W3C's Priority of Constituencies[2] (part of its Web Platform Design Principles) and its Ethical Web Principles related to putting users in control[3] 1. <https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity> 2. <https://www.w3.org/TR/design-principles/#priority-of-constituencies https://www.w3.org/TR/design-principles/#priority-of-constit...> 3. <https://www.w3.org/TR/ethical-web-principles/#control https://www.w3.org/TR/ethical-web-principles/#control>

cxr 3y ago

Unfortunately, someone would have to write it first. (Why not you?) My reasoning is in the next sentence: «Incredibly user-hostile and worse, effectively irreversible—there's basically no going back now because browsers don't have the option at this point to say, "Yeah, we're not going to honor this anymore," without putting users at an even greater risk than before CSP ever existed.»

wscourge 3y ago
I still don't understand WHY is it "Incredibly user-hostile". Will do my own research anyway.
- cxr 3y ago
  Refer to the place in the linked article where the part I quoted appears in a section called "Limitations"—the bookmarklet is stopped in its tracks when it encounters style sheets that are loaded from off-site (but that are still loaded nonetheless and have an effect on the current page). Considering that the user is the one who invokes bookmarklets and has their own personal accessibility reasons for doing so, that's an unwelcome limitation. There's a similar effect with CSP: server operators and content authors can use CSP to prevent the use of bookmarklets that ordinarily work by overriding the author's style rules through $element$.style (i.e. the style attribute), inserting style elements with the user's own CSS, or loading/linking against off-site style sheets. See also: Google's WEI ("Web Environment Integrity") proposal from earlier last year that was justifiably opposed by pretty much everyone[1] The W3C's Priority of Constituencies[2] (part of its Web Platform Design Principles) and its Ethical Web Principles related to putting users in control[3] 1. <https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity> 2. <https://www.w3.org/TR/design-principles/#priority-of-constituencies https://www.w3.org/TR/design-principles/#priority-of-constit...> 3. <https://www.w3.org/TR/ethical-web-principles/#control https://www.w3.org/TR/ethical-web-principles/#control>