News for hackers. Stuff that matters.

A comment on Protecting sites from Cryptojacking with CSP and SRI. Parent comment

Re:Protecting sites from Cryptojacking with CSP and SRI by dullgiulio on Sunday February 11, 2018 @04:13PM (#16354829)
CSP reporting is an unprotected form, in itself a vulnerability.

The author of the article is biased as he made a SaaS product for CSP reporting.

CSP reporting should be for local debugging only.

[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by orf on Sunday February 11, 2018 @04:56PM (#16355051)
I'm sorry, I'm still not following. How can CSP reporting be used by marketers? It requires a header sent from the server, so it's not like a tracking pixel that can be added by a third party. And I'm not sure about local debugging only, locally it offers no benefits over just viewing the devtools console, whereas it offers a lot of benefits when enabled on users of your sites.
[ Parent | on HN ]