Differences

This shows you the differences between two versions of the page.

--- security:headers [2026/09/17 07:25] – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude
+++ security:headers [2026/10/08 12:10] (current) – Related-pages link to Security:Malicious web content. Authored by Claude karel.kubicek.claude
@@ Line 62: / Line 62: @@
 ==== SRI ====
-Chapuis et al., Common Crawl: SRI on **3.40%** of pages {[chapuis2020_integrity]}. Kumar et al., 2017, third-party inclusions: **less than 1%** of sites {[kumar2017_security]}. Soni et al. measured script churn and concluded raw SRI signatures need updates "at an impractical rate" {[soni2015_sicilian]} — that is the measurement Steffens later made causal (the third party will not pin). A presence census without "who holds the integrity attribute" repeats 2015.
+Chapuis et al., Common Crawl: SRI on **3.40%** of pages {[chapuis2020_integrity]}. Kumar et al., 2017, third-party inclusions: **less than 1%** of sites {[kumar2017_security]}. Soni et al. measured script churn and concluded raw SRI signatures need updates "at an impractical rate" {[soni2015_sicilian]} — that is the measurement Steffens later made causal (the third party will not pin). A presence census without "who holds the integrity attribute" repeats 2015. Why it matters: the 2024 polyfill.io compromise, worked through on [[Security:Malicious web content#Worked example: polyfill.io]].
 ==== Trusted Types, COOP, COEP — thin, and say so ====
@@ Line 347: / Line 347: @@
 | PETS | 1 | 189 | 0.5% |
-The other 132 web probe hits, so they cannot vanish: mention **72**, homograph **26**, defense **14**, citation **13**, instrument **7** (headers as a feature for tracking or bot detection, not a deployment census). Agarwal et al. are measured: they count the live-site CSP/XFO/HSTS headers that Chrome extensions inject, drop or rewrite (**205** extensions strip CSP; **446** drop XFO) {[agarwal2022_helping]} — the subject is the extension's effect on the site's header, not a site-adoption census. Somé et al. 2017 are measured: **5.29%** of 10,000 Alexa sites had some page with CSP, and **72%** of those CSPs (**12,899** pages) can be potentially violated {[som2017_content]}.
+The other 132 web probe hits, so they cannot vanish: mention **72**, homograph **26**, defense **14**, citation **13**, instrument **7** (headers as a feature for tracking or bot detection, not a deployment census). Agarwal et al. are measured: they count the live-site CSP/XFO/HSTS headers that Chrome extensions inject, drop or rewrite (**205** extensions strip CSP; **446** drop XFO) {[agarwal2022_helping]} — the subject is the extension's effect on the site's header, not a site-adoption census. Somé et al. 2017 are measured: **5.29%** of 10,000 Alexa sites had some page with CSP, and **72%** of those CSPs (**12,899** pages) can be potentially violated {[some2017_content]}.
 ===== What to report =====