Submitted via IRC for TheMightyBuzzard
The popular content blocking extension uBlock Origin blocks CSP reporting on websites that make use of it if it injects neutered scripts.
CSP, Content Security Policy, can be used by web developers to whitelist code that is allowed to run on web properties. The idea behind the feature is to prevent attackers from injecting JavaScript on websites protected by CSP.
CSP reports any attempt of interfering with the site's policies in regards to scripts to the webmaster. This happens when users connect to the site, and is used by webmasters to analyze and resolve the detected issues.
[...] Raymond Hill, the developer of uBlock Origin, replied stating that this was not a bug but by design. The extension blocks the sending of CSP reports if it injects a neutered Google Analytics script.
Source: https://www.ghacks.net/2017/10/19/ublock-criticized-for-blocking-csp/
(Score: 0) by Anonymous Coward on Monday October 23 2017, @06:01PM (2 children)
Isn't that why they're trying to teach basic comp sci to everyone?
(Score: 0) by Anonymous Coward on Monday October 23 2017, @06:37PM
"which code is trustworthy to run?" is similar to the halting problem. Except that in many cases you don't get the full code and inputs till you run the initial code. Heck you might never get the full code either.
Of course in that case you can probably deduce that particular code is not safe to run, but you might go all the way and decide that no javascript is safe to run.
A workaround of course is to sandbox and restrict stuff (solving the halting problem by making sure that everything will halt even if the code isn't written that way ;) ). CSP was supposed to be one of those tools to help limit damage.
(Score: 1, Informative) by Anonymous Coward on Monday October 23 2017, @09:15PM
They're not. They're mostly just teaching people to use Microsoft and Apple tools and calling it computer science.