Protecting sites from Cryptojacking with CSP and SRI
I use uMatirx and it’s given me a pretty good lesson on how much stuff sites load from 3rd-parties.  Many sites need me to play whack-a-mole to get them to display - which 3rd party sites do I need to allow to get the content to show up.<p>I’m really torn by this sort of thing.<p>On one hand, when many sites use jQuery (for example), there’s huge benefits (bandwidth, speed, etc) in having it loaded from one location relatively infrequently and cached for many pages.  This is exactly the promise of shared libraries, just on a much wider scale.<p>On the other hand, why aren’t web site operators delivering all of the code that is needed for the site to function?  If they want all their users to execute that code, why aren’t they willing to serve it themselves?<p>I’m not sure what the right answer is, but this incident is a pro for pulling in all of your dependencies.  The limited data plans that a lot of people have are a big pro for hosting libraries centrally.