I already keep SVG disabled for security reasons, but it's increasingly looking like I'll have to find some way to disable CSS too. It's too bad people couldn't leave CSS alone as a nice simple (sort of) way to format text because turning it into another programing langue is begging for it to be abused by hackers and other malicious actors (like advertisers) just like JS
paulpauper•5m ago
nah, that is overkill. the probability of falling for this is still tiny and it cannot break the sandbox, steal session cookies, or anything like that .
scoofy•3m ago
As someone who runs a site that uses inline SVG, this is unfortunate. Hopefully it won't be a problem for me.
autoexec•23m ago
paulpauper•5m ago