> Of course domain change risk is not new to us. It’s a common attack vector in the client-side security world. The "client-side security world" is just thrown

> Of course domain change risk is not new to us. It’s a common attack vector in the client-side security world. The "client-side security world" is just thrown out there! I always assumed slapping an integrity attribute on script tags was just about the limit of what one could do to block hijacked scripts and otherwise yolo. This is making me think there's lots more that can be done and there's a discipline to practice.