Hacker News Reader

You wouldn’t use an SRI integrity attribute on a non-versioned resource from a CDN.

I don’t recall ever seeing ‘don’t use SRI on non versioned resources’ - don’t get me wrong, it makes sense, but I’m a pentester and my clients know less than I do

True, that was somehow expected as obvious characteristics when writing this down. There is now an issue on the spec at https://github.com/w3c/webappsec-subresource-integrity/issue...

Reply on news.ycombinator.com