Tell HN: Crazy sloppiness in X.com Content Security Policy
TL;TR Just uncovered a backdoor into http://X.com’s stack... or more likely some giant sloppiness.First let's define CSP, Content Security Policy. In simple terms, CSP is a browser-side firewall: it lets websites tell the browser exactly which domains it may load scripts, images, or exchange data with; blocking rogue code and data leaks. In my book, it’s one of the greatest inventions of the...