> clearly had no controls to understand the code running in production
This applies to everyone who has advertising or third party anything on their page, no?
This applies to everyone who has advertising or third party anything on their page, no?
BA however are a company selling their own product, no need for them to have adverts. If they want to dilute their product with adverts then they take the risk of fines (as well as losing custom)
In addition, if they themselves _advertise_, they'll need to add tags to track attribution, conversions, etc.
Actually it's worse than that. Even without 3rd party JS, most major websites these days run on large piles of open source libraries that have never been security reviewed (e.g. code from npm, rubygems, PyPi, NuGet) and attackers are increasingly targeting those underlying libraries for compromise...
Yes. Which is why you shouldn't run third-party advertising.