Hacker News Reader

Just so anyone searching this thread is aware, "Content-Security-Policy:... frame-ancestors 'none';" is what you are (I think) referring to.

Oh, TIL X-Frame-Options has been superseeded. That was the header I was thinking about.

Yeah I set them both just in case people have an ancient user agent but I think that's not required any more.

Yup. The article mentions it was an “explicit” decision to use this approach instead. Seems much more effective than CSP headers.

They explicitly mention that in the famous article, but concede that they are not mature enough for that.

> The mature and responsible thing to do would have been to add a content security policy to the page

OP knows that