I default deny all, then selectively enable scripts to add missing functionality. It can be a pain to get Gawker sites to work, but the vast majority work perfectly after enabling first party scripts and maybe cloudfront.