News for hackers. Stuff that matters.

A comment on Protecting sites from Cryptojacking with CSP and SRI.

Re:Protecting sites from Cryptojacking with CSP and SRI by baybal2 on Sunday February 11, 2018 @03:43PM (#16354697)
A useful tech it is. The problem is 3rd party code from adnets is changing all the time, and they will never tell you about that because they hide all kind of anti-clickfraud trick there. From intentionally broken JS syntax, to intentionally broken Unicode, to actual 0day exploits.
[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by rspeer on Sunday February 11, 2018 @05:48PM (#16355295)
When I first read this discussion, I just assumed that BrowseAloud was some sort of ad-tech or analytics code. But it's assistive technology for screen readers. The list of web sites that were compromised were web sites that were trying to do the right thing to help disabled users.

Ad-tech is a giant security hole that can't be fixed without burning it all down, but BrowseAloud could be fixed.

[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by kevin_b_er on Monday February 12, 2018 @01:31PM (#16360726)
I consider ad-tech to be fundamentally malicious and block it. It is only reasonable course of action.
[ Parent | on HN ]