you could just add a new public=true option to counter this. I think you can eve... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

realusername on Sept 18, 2015 | parent | context | favorite | on: Subresource Integrity

you could just add a new public=true option to counter this. I think you can even already check that with an iframe (or js head inject & timing) anyway, no need for CSP for that.

riking on Sept 19, 2015 [–]

Or require crossorigin="anonymous", maybe in combination with Cache-Control: public.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact