[Animats]

It's nice that Github, Inc. likes subresource integrity. Did they put it on their web pages? As of right now, it doesn't seem to be on their home page. The next big step is for Wordpress to support it.

Subresource integrity is in some ways more important than "HTTPS Everywhere", because the MITM-as-a-service sites such as Cloudflare subvert HTTPS Everywhere. For security reasons, you might choose to serve your home page and a few security-critical pages from your own server, without using a CDN. But run everything else through the CDN, using subresource integrity to keep the CDN honest.

With subresource integrity, many items no longer need to be encrypted. This is good for security. Encryption interferes with caching, and HTTPS in front of caches means that the attack surface is larger, and includes the CDN.

(Yes, there's an argument that HTTPS conceals what the user was browsing. Not really. Checking document length will provide a good hint on what static asset was read. The pattern of document lengths requested tends to fingerprint the page being read.)

[gellerb]

Login and inspect the home page afterwards. http://imgur.com/bwUHgcT

[Animats]

I'm logged in. Not seeing it. Maybe it's not deployed for all accounts yet.

[mastahyeti]

It's only included for browsers that support it. That's Chrome>45 and Firefox>43.

[Animats]

Serving different content based on the user agent? Bad site. No donut.