undefined | Better HN

0 pointsvalenterry1y ago0 comments

Yes it is. Hashes must absolutely be used in that case.

0 comments

It should just not be done at all. But the main browser vendor loves tracking so they won't forbid this.

Are you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1].

Disclosure: I work at Google, but not on Chrome.

Also expired certificates break a lot of websites… should we disable checking?

Maybe, but just from a security point of view it's totally fine.

Getting tracked is less secure than not getting tracked.

j / k navigate · click thread line to collapse

It should just not be done at all. But the main browser vendor loves tracking so they won't forbid this.

Are you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1].

Disclosure: I work at Google, but not on Chrome.

Also expired certificates break a lot of websites… should we disable checking?

Maybe, but just from a security point of view it's totally fine.

Getting tracked is less secure than not getting tracked.

j / k navigate · click thread line to collapse