I disagree heavily with the core thesis of this article–that Javascript is in need of replacement–but the treatment of it and the ideas explored are quite interesting.
I’d honestly settle for browsers handling JS the way they do cookies. Let me decide whether to allow all JS, allow only self-hosted JS, or disable JS entirely – and let me blacklist/whitelist particular domains.
You could write or use a browser extension that injects a Content Security Policy into the response. Make it configurable on a per-site basis is a stretch goal. :-)
I disagree heavily with the core thesis of this article–that Javascript is in need of replacement–but the treatment of it and the ideas explored are quite interesting.
I’d honestly settle for browsers handling JS the way they do cookies. Let me decide whether to allow all JS, allow only self-hosted JS, or disable JS entirely – and let me blacklist/whitelist particular domains.
Have you looked at umatrix?
I use a hosts file.
I use a hosts file too, but umatrix allows more fine-grained controls than just blocking all requests to a domain, in addition to doing things like only allowing iframes/cookies/media from domain X to be loaded from domain Y.
You could write or use a browser extension that injects a Content Security Policy into the response. Make it configurable on a per-site basis is a stretch goal. :-)