News for hackers. Stuff that matters.

A comment on Fighting cryptojacking and doing good things with content security policies. Parent comment

Re:Fighting cryptojacking and doing good things with content... by dmix on Wednesday March 31, 2021 @08:34PM (#26655231)
This sites example code seems to be taking the blacklist approach instead of whitelist, so I shouldn't break too many sites. Nor give the surprise treats you mentioned.

But I agree, locking down a site with CSP is a great exercise in just how domains get loaded. Especially if you have a marketing team who gets sold on the latest service weekly.

[ Parent | on HN ]
Re:Fighting cryptojacking and doing good things with content... by hn_throwaway_99 on Wednesday March 31, 2021 @10:56PM (#26656137)
I think you may be misunderstanding parent's post. When you run a site with a strict CSP and a reportUri enabled, you will notice that you get tons of blocked scripts reported not because there is a vulnerability in your site, but because clients have installed tons of browser plugins that try to inject scripts into your site, and your CSP will block them.
[ Parent | on HN ]