Hacker News Reader

Comment by wscourge | Hacker News Reader

> CSP is one of the worst pieces of Web security infrastructure that modern browsers unwisely agreed to go along with

This got me interested - care to provide a reasoning behind it? I'd love to read more on the subject and better understand it.

Thanks.

View on HN

Unfortunately, someone would have to write it first. (Why not you?)

My reasoning is in the next sentence: «Incredibly user-hostile and worse, effectively irreversible—there's basically no going back now because browsers don't have the option at this point to say, "Yeah, we're not going to honor this anymore," without putting users at an even greater risk than before CSP ever existed.»

I still don't understand WHY is it "Incredibly user-hostile". Will do my own research anyway.

Refer to the place in the linked article where the part I quoted appears in a section called "Limitations"—the bookmarklet is stopped in its tracks when it encounters style sheets that are loaded from off-site (but that are still loaded nonetheless and have an effect on the current page). Considering that the user is the one who invokes bookmarklets and has their own personal accessibility reasons for doing so, that's an unwelcome limitation.

There's a similar effect with CSP: server operators and content authors can use CSP to prevent the use of bookmarklets that ordinarily work by overriding the author's style rules through $element$.style (i.e. the style attribute), inserting style elements with the user's own CSS, or loading/linking against off-site style sheets.