Hacker News Reader

Comment by donohoe | Hacker News Reader

One way to help reduce overall weight of embeds (and improve the UX imho) is to block the ads - if you are able to leverage "Content Security Polices" on your pages.

Example META tag:

  <meta http-equiv="Content-Security-Policy" 
  content="default-src 'self' 'unsafe-inline' *.your-cdn-if-any.com 
  www.youtube.com *.googlevideo.com *.ytimg.com">

More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

View on HN

PSA: Try not to chuck 'unsafe-inline' into your Content-Security-Policy thoughtlessly--it disables the anti-injection protections of CSP. There are safe ways to permit inline scripts, if you even need them.

https://content-security-policy.com/

That's clever, well worth its own blog post.

can you tldr it? just one little meta tag defeats google's ad services? why dont we all slap it on our html templates?

This seems to be allowing unsafe script injection from ONLY certain whitelisted urls, presumably excluding the url globs required for the ads. Haven't tested it, and not sure the full extent of pshc's sibling response either.

Reply on news.ycombinator.com