News for hackers. Stuff that matters.

A comment on Protecting sites from Cryptojacking with CSP and SRI. Parent comment

Re:Protecting sites from Cryptojacking with CSP and SRI by IncRnd on Sunday February 11, 2018 @01:06PM (#16353825)
> Proof of stake will solve this.

No. It. Won't. The issue isn't PoW/PoS but the loading of infected code into browsers. PoS may stop the need for this particular JS code to get inserted. However, PoS will hinder no other JS from being inserted.

[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by JoachimSchipper on Sunday February 11, 2018 @01:30PM (#16353965)
In principle, sites should be secure. In practice, putting an implicit bug bounty on every widely-used Javascript library does produce more exploitation.

I think you missed an opportunity to engage your parent comment more productively.

[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by IncRnd on Sunday February 11, 2018 @03:55PM (#16354744)
What principle states sites should be secure?

There is hardly even a nod to security, no defense in depth, and no cryptographic protections. There is widespread loading of untrusted unvetted code. The operating principle of the web seems to be, "it's okay to do this, everyone else is."

[ Parent | on HN ]