3 ms·
This is super cool, and I love the old school tech stack. It makes for a very approachable codebase and a fast user experience. As a reminder given the recent
by esprehn 2y ago
This is super cool, and I love the old school tech stack. It makes for a very approachable codebase and a fast user experience.
As a reminder given the recent polyfill io attack, don't use public CDN hosted JS without also setting SRI attributes [1]. It's a marginal perf benefit because the cache is partitioned by top level domains now and it opens you up to attacks from the CDN owners.
https://github.com/vshymanskyy/ViperIDE/issues/14 https://github.com/vshymanskyy/ViperIDE/issues/14
As a bonus set CSP headers and a nonce when you can too, but definitely set SRI on any 3p scripts.
[1]: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...