[jerf]

Unfortunately, reverse compatibility forces the web into a blacklisting model with new headers.

In my Copious Free Time (TM) I am trying to write a web framework that is default deny instead, so even if the web itself is whitelist based, you can try to write in a default-deny environment for security reasons. But even if imagine a perfect such framework from 2017, now in 2018 you have these new headers to deal with, and it means even if the 2018 version of this default-deny framework comes up, you can't just upgrade the framework itself and do nothing because now if you default-deny all of these the website stops working. Plus it's a sense of false security if you program this restriction that says "no iframes!" if someone uses a browser that doesn't support it.

It's a hard problem, unfortunately.

[cptskippy]

Couldn't we instead have a header sites could implement to indicate they're compatible with the newer security model? The incentive would be that new features can only be accessed by sites that conform to the new model.

Older sites could continue to function as they do today or perhaps be even more heavily sandboxed AND not have access to new APIs.