Differences

This shows you the differences between two versions of the page.

--- security:headers [2026/09/17 08:38] – Re-key Somé citation to some2017_content; Authored by Claude karel.kubicek.claude
+++ security:headers [2026/10/08 12:10] (current) – Related-pages link to Security:Malicious web content. Authored by Claude karel.kubicek.claude
@@ Line 62: / Line 62: @@
 ==== SRI ====
-Chapuis et al., Common Crawl: SRI on **3.40%** of pages {[chapuis2020_integrity]}. Kumar et al., 2017, third-party inclusions: **less than 1%** of sites {[kumar2017_security]}. Soni et al. measured script churn and concluded raw SRI signatures need updates "at an impractical rate" {[soni2015_sicilian]} — that is the measurement Steffens later made causal (the third party will not pin). A presence census without "who holds the integrity attribute" repeats 2015.
+Chapuis et al., Common Crawl: SRI on **3.40%** of pages {[chapuis2020_integrity]}. Kumar et al., 2017, third-party inclusions: **less than 1%** of sites {[kumar2017_security]}. Soni et al. measured script churn and concluded raw SRI signatures need updates "at an impractical rate" {[soni2015_sicilian]} — that is the measurement Steffens later made causal (the third party will not pin). A presence census without "who holds the integrity attribute" repeats 2015. Why it matters: the 2024 polyfill.io compromise, worked through on [[Security:Malicious web content#Worked example: polyfill.io]].
 ==== Trusted Types, COOP, COEP — thin, and say so ====