So I've done that, which is half of the solution,
a very important part of the solution.
The other part of the solution as well is that they're
using a content security policy.
And if I go back to the website itself, I'm going to hit the dev tools,
go into the Network tab here, I'm going to reload this page,
I'm going to go and grab the very first request,
and I'm going to look at the response headers,
and we'll see here that there is a Content-Security-Policy.
Now, there is a lot of text here.
We're not going to go into the detail of all of what this does
because there's a heap of Pluralsight courses from people like
myself on content security policies,
but in a nutshell what this does is gives you a what list of
where you can load different content types from.
And, in fact, I can see down here that BrowseAloud is actually in here.
In fact, this is plus.
browsealoud.
com.
And in this particular case, this is saying that the connect-src content type,
so if you make an XML HTTPs to our request,
requests can be made to BrowseAloud.
Inevitably there is no what list for Coinhive in here.
So even without the SRI, which should protect that file from being modified,
if there was maybe another file downstream of that file,
which then embedded something from Coinhive,
because Coinhive is not in the CSP, it wouldn't run.
And what's even better again is down towards the end of this CSP,
they've defined a report-uri.
And what this does is it says, hey,
if my content security policy ever gets violated,
so for example,
if someone tries to load a script from Coinhive it will violate it,
we're going to send a report to this host name and then the rest of the URL.
And they're in this case using the report-uri.
com service to send all of their reports to,
so if they're monitoring the reports, they'll be able to say,
hey, there's a request for a crypto-miner or something like that on my site.
So we get some detection now.
Yes, yes.
And that's our next bit we're going to look at in about five minutes' time.
You like how I did that?
I did like how you did that, yeah!
Good.
So this is awesome.
What I love about these tools, both SRI and CSP,
is that they are free, they're baked into the browser,
they run in every major browser.
Microsoft Edge added them in Edge 17 as well,
so they're in Edge as of today,
as well as obviously Firefox and Safari and Chrome and all the other things.