Hacker News Reader

I agree that it should be fixed but we can't know that the cost is going to be small. Some websites are generated via dozens of layers of abtractions and maybe there's no options to add the sri without going deep inside some messy frameworks and changing several of these layers.

Also, “risk acceptance” and “vulnerability” aren't mutually exclusive. Vulnerability is the risk, the acceptance is deciding that the vulnerability is necessary because the cost to avoid or fix it is too high.

But making that choice doesn't stop it from being a vulnerability.

I read that and translated it to, "This is between our customers and their credit card company. It's not like we'll get in any real trouble."