Hello and welcome to the Thursday, June 11th,

2006 edition of the Sands and then at Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu credit certificate program in industrial control system security.

Jan today published a diary on Consecure Policy and how the X-frame options header is sort of starting to get replaced, supplemented with the frame ancestor property in CSP.

This is something that Jan looked first at three years ago,

so what he published today was an update, essentially,

to what was going on more recently.

Now, the X-frame Options header still works.

So in so far, there's nothing really wrong with it.

However, officially it got now replaced with con security policy.

And what Jan found is actually over the last years, over the last three years,

there was a significant increase in the uptake of con and secure policy

and the frame ancestor directive when it comes

to con and security policy. So it's overall a good thing that this has been improving. I would still

kind of leave the X-frame options header in place personally. Yes, you know, sort of does the same

thing as frame ancestors. I find that with concert policy, it's easier to sort of get lost to

complexity and maybe have a syntax error or something like this. So the frame ancestor directive

may not work as expected. And as far as I know all existing browsers still support

X-frame options, so kind of a nice backup, I guess, in this case.

And in a blog post, NPM did announce some changes in the upcoming NPM 12 release, which is expected in July.

These changes are changes to default behaviors that are not really new features

...