Hacker News Reader

1. Tracking is not really effective if the user agent caches the font aggressively.

2. Subresource integrity takes care that at least the file cannot be modified freely without you knowing. So there is only the case that the file either is there as you expect, or it is not available. Does that leave room for malicious intent? https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

View on HN

Subresource integrity is OK, but in this case would have totally broken the site in a different way. If you want to make sure a resource can't change, host it yourself and don't change it.

Subresource integrity is a double edged sword because when a third party updates a resource then your page breaks. Of course you can build fallbacks by loading from your domain in case of errors but then you just doubled engineering effort and have rarely executed code paths in your source.

True. I'm not saying this solves the problem, but at least the "outside of your control" part is not absolute.

Reply on news.ycombinator.com