Hacker News Reader

The method for the BA hack was not from javascript hosted externally. See https://medium.com/asecuritysite-when-bob-met-alice/the-brit...

Yep, was going to say exactly this.

All the SRI, CSP, etc is great, but if you can't control your own site you're screwed regardless.