If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice.

The scripts should be 100% static files hosted by the same origin and not be obfuscated. They should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that user. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).

Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea.

All of that sounds great but also it's important to protect visitors.

Maybe if the site owners experience their sites going down due to this they'll look for some alternatives.

You're totally not getting what I'm saying and that's fine, but why do you post these replies then?

I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain. Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

This is a great list of things “someone” should do. Can the author of TFA do it?

Why haven’t you already done it?