https://caniuse.com/subresource-integrity
It is basic available for every browser except IE and Opera Mini, so I think it is user's problem to use an old browser that don't support a wide supported security feature.
It is basic available for every browser except IE and Opera Mini, so I think it is user's problem to use an old browser that don't support a wide supported security feature.
And your response is: "that's their problem" ??
I hope you're not in charge of any important or large sites or anything that handles financial data (ecommerce, etc)... because this isn't a good attitude when it comes to security.
It's perhaps worth accepting there's no silver bullet here but a combination of initiatives like SRI is still worthwhile to help reduce the attack surface for the majority of users?
SRI is the equivalent of just enabling 1.2. You haven't disabled access to browsers that dont support SRI.
You 2nd sentence sounds remarkably similar to my first post that maple responded to: SRI can help mitigate the damage, but it cant fix it.
You seem confused about the difference between mitigation and fixing.
Mitigation: the action of reducing the severity, seriousness, or painfulness of something.
Key work there is reducing. A fix actually eliminates the issue.. like enabling 1.2 + disabling 1.1 eliminates the potential for communicating insecurely.
It's important to understand the difference because anything short of actually fixing the issue leaves some users exposed to the vulnerability.