Hundred Rabbits is a small collective exploring the failability of modern tech

Re:Hundred Rabbits is a small collective exploring the faila... by simpaticoder on Thursday August 01, 2024 @11:37PM (#41135898)

One solution is to add headers that forbid all includes (and therefore all tracking):

   Content-Security-Policy: 
     default-src 'self';
     frame-src 'self';
     script-src 'self' 'unsafe-inline' 'unsafe-eval';
     style-src  'self' 'unsafe-inline';
     img-src 'self' data:

[ Parent | on HN ]

Re:Hundred Rabbits is a small collective exploring the faila... by donohoe on Friday August 02, 2024 @06:52AM (#41137734)

Yeah, or as a META tag

[ Parent | on HN ]

Re:Hundred Rabbits is a small collective exploring the faila... by jesprenj on Friday August 02, 2024 @08:32AM (#41138312)

Wouldn't this break the embedded video?

[ Parent | on HN ]

Re:Hundred Rabbits is a small collective exploring the faila... by simpaticoder on Friday August 02, 2024 @11:25AM (#41139617)

Yes. The website publisher would add this CSP header to ensure that the browser only loads sub-resources come from the first-party domain. It does not prevent the publisher from writing markup that declares third-party resource loads. The header ensures that the site will "break fast". CSP headers are often more useful in sites that allow clients to write markup, however there is still utility in declaring your intention to not load third-party content in your markup.

[ Parent | on HN ]