* add Content Security Policy
* remove reflect-metadata on production builds to get rid of unsafe-eval
* fix baseCSP usage
* add SRI to CSP
* add blob: to media-src
* remove SRI
* CSP set to reportOnly
* adding data: to connect-src CSP
* remove block-all-mixed-content
* add report-uri support
- make the placeholder disappear on focus in the search bar
- make the placeholder disappear on focus in the comment textarea
- make the texarea resize automagically
- refactor the watch view to use bootstrap 4's flexgrid
- move action buttons of the watch view to the right of the video info
- responsive tweaks and margin adjustments in the watch view
We want to be inclusive to the largest number of participants, with the most varied and diverse backgrounds possible. As such, we should take position as to how we will defend our contributors. Better settle on how we handle dire situations before they happen.
Nota: the code of conduct isn't clear on the disclosure of an incident per se. That should be investigated further.
- added precisions and suggestions about how to generate Let's Encrypt certificates. Users have reported their installations didn't work when the problem came from missing certificates (false positives).
- security defaults of Nginx follow the basic robustness principle "be conservative in what you send, be liberal in what you accept", which isn't enough with modern security standards, so we should be picky with the cipher suites we use, among other things. Extra comments (especially for the TLS1.3 protocol support parameter) make the requirement of a recent Nginx installation obvious, and the downgrade alternative remains clear to the system administrator.
All in all, we should aknowledge users will most often copy and paste the configuration files. Making them secure by default may force a few users to read their configuration, but on the long run we are making the fediverse more secure.
Since I've come to modify a bit the Nginx config in `support/doc/production.md`, I've merged it with the template so that they stay consistent.
Rigel Kent