News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by MarsIronPI on Thursday December 18, 2025 @06:06PM (#46320071)
Shouldn't the ignoring of scripting be done at the user agent level? Maybe some kind of HTTP header to allow sites to disable scripts in SVG ala CORS?
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by antiloper on Friday December 19, 2025 @05:10AM (#46324136)
Content-Security-Policy: default-src 'none'
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by demurgos on Friday December 19, 2025 @09:32PM (#46333189)
It's definitely a possible solution if you control how the file are displayed. In my case I preferred the files to be safe regardless of the mechanism used to view them (less risk of misconfiguration).
[ Parent | on HN ]