h5bp/html5-boilerplate — comment on commit 2727fa23a6715080f120fd41792a6a8c1b112125
File:  line 0
By mathiasbynens:

Ok, so @paulirish asked:

> should it be default on for JUST images.. for everything.. or for nothing?

Then [Michael Hausenblas](http://sw-app.org/mic.xhtml#i) (the guy behind http://enable-cors.org/) was all like:

> IMHO it doesn't really depend on the media type. My rule of thumb is: esp. if you want enable machines/APIs to get the most out of it (that is, essentially enable full-blown apps in the browser) enable CORS for all content that is supposed to be public accessible. Due to my background re Open Data, this is only logical to me, personally, but I also acknowledge that there may be cases where this *could* be problematic (esp. if ACLs are involved).