Hacker News Reader

Well we can absolutely talk semantics. Code written by a third-party is third-party code however it is hosted. Your conclusion is right however. If you are serious with your security and change management you host all scripts yourself. Or use sub-source integrity:

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

View on HN

Of course it's third party code. I meant that it's not really third party in the context of this article advocating for a same origin policy for javascript.

I only came across SRI while dealing with CSP, and I didn't quite understand why anyone would subject themselves to that until just now. Thanks for pointing it out.

Reply on news.ycombinator.com