Hacker News Reader

Could you clarify your objection? Presumably clients would never immutably cache a resource they couldn't validate.

How does validation work in the case of a 200 status and no Content-Length header?

I'd also like to know. I hope subresource integrity can be implemented alongside the cache control and prevent caching a bad file.