default-src. This required some changes to the way one-off scripts and stylesheets are created for individual posts: the generators now create files that are referenced via
scripttags in the individual page’s
head. (This Ink feature hasn’t been used in any published posts yet.)
img-src. At least one major browser has a bug where its default
videocontrols can be blocked when the
Strict-Transport-Securityage from 30 days to 1 year.
X-Frame-Optionswas already being set and hasn’t been modified.
These sorts of changes are about how Diplograph is built behind the scenes, and won’t really be noticed on the site itself.
To be honest, a big reason I started the blog again was to have a coding project to work on. I’m spending more time poking at Ink than, say, editing photos. This is probably bad.