mdirolf

We're moving 8 domains over right now.

Yeah, I decided not to get into all of the options of each header. Partially because I was writing from a plane without wifi and partially because the response I was hoping for was "these things exist - I'll go read the docs on them".

That said, your points about X-Frame-Options and CSP are definitely important for usability. Maybe I'll update the post w/ some of those details.

Ha fair enough, and thanks! One problem with the CA system is that (as far as I understand) it really doesn't matter whether you choose a particularly secure CA or not - you're as vulnerable as the most vulnerable CA. That's why something like public-key pinning is important.

Good to know - thanks. More support is better, but the thing I really like about CSP is how it is still useful as a canary even with only partial browser support.

No problem - I definitely recommend reading the linked Mozilla docs on them.

Glad you enjoyed it.

Thanks!

We'll try to keep adding whatever information we can about our deployment. If you have specific questions just shoot us an email - they'll probably be good inspiration for future posts.