kid-icarus

While these points may hold true, I’ve often seen the statement thrown around in chats and various forums that, “dart sux.” I don’t understand the hate, nor the juvenile phrasing.

dart sux

Yes, if an extension can override CSP directives to allow arbitrary connect-src exceptions, it effectively means that any data in any form on any page is now susceptible of having that data sent to an attacker-owned URL.

The solution doesn't necessitate removing extensions, it just means potentially constraining the API surface of extensions in order to mitigate the attack surface.

I have that same issue, but I would much rather filter out extraneous CSP violations than have some exploited extension exfiltrate sensitive data.

Edit: typo

Can you specify which policies are a nightmare to develop on? As a security-minded UI eng, I warmly welcome any new security policies that enable me to harden my applications and prevent exfiltration of sensitive data.

Edit: typo.

I don't know how many of the cursed sites you've visited, but in addition to rudimentary styling, some of the sites contain some rather disturbing content.

Hence the "fucked up shit," and "twisted mind," comments. I don't think they are inappropriate or disrespectful.

I don't think tone policing is appropriate or beneficial.

Respectfully disagree. I take delight in observing these artifacts, it's unfortunate you cannot.