Hacker News Reader

You can't put third party javascript through change management. Unless you download and host it yourself, in which case it's not really third party.

View on HN

Well we can absolutely talk semantics. Code written by a third-party is third-party code however it is hosted. Your conclusion is right however. If you are serious with your security and change management you host all scripts yourself. Or use sub-source integrity:

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Of course it's third party code. I meant that it's not really third party in the context of this article advocating for a same origin policy for javascript.

I only came across SRI while dealing with CSP, and I didn't quite understand why anyone would subject themselves to that until just now. Thanks for pointing it out.

Reply on news.ycombinator.com