3 ms·
It should just not be done at all. But the main browser vendor loves tracking so they won't forbid this.
by LtWorf 2y ago
It should just not be done at all. But the main browser vendor loves tracking so they won't forbid this.
- valenterry 2y agoMaybe, but just from a security point of view it's totally fine.
- LtWorf 2y agoGetting tracked is less secure than not getting tracked.
- SideQuark 2y agoGetting hacked is less secure than getting tracked.
- LtWorf 2y agoVery clever. But getting tracked doesn't in any way protect you from getting hacked. It just exposes you to more risks, including getting hacked.
- valenterry 2y agoFair enough.
- Thorrez 2y agoAre you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1]. Disclosure: I work at Google, but not on Chrome. [1] https://flbrack.com/posts/2023-02-15-dont-break-the-web/ https://flbrack.com/posts/2023-02-15-dont-break-the-web/
- LtWorf 2y agoAlso expired certificates break a lot of websites… should we disable checking?
- ameliaquining 2y agoCertificate expiration isn't an unanticipated regression. You know when you get a certificate when it will expire.
- hyperdimension 2y agoI don't mean to be pedantic, but not always--see the recent DigiCert delayed revocation issues. I will admit it is rare though and more often than not, you (should) know when your certs are going to expire.
- Thorrez 2y agoThose websites set up the expiring certificate themselves.