You have one div tag. What can you do with it? One div. Many possibilities (opens in new tab)

(github.com)

4 pointsmanrajsingh10y ago7 comments

7 comments

5 comments · 2 top-level

_0w8t10y ago· 2 in thread

That is a nice reminder that complexity of implementing modern CSS in a browser may well exceed that of implementing JavaScript. So to reduce the attack surface one should block CSS, not script tags.

manrajsinghOP10y ago

Sorry, I didn't get your second point. Please elaborate.

_0w8t10y ago

A typical assumption behind NoScript and similar blocking browser extensions is that it is executable code that is responsible for most of the bugs in the browser so disabling those reduces the attack surface. But with the complexity of modern CSS this is no longer a priory true. It could be that blocking CSS while allowing JS to execute minimize the attack more that the other way around.

1 more reply

Freak_NL10y ago· 1 in thread

Nice. A good reminder that you don't always need dozens of nested divs to get some effect in HTML. Not that anyone should start rendering flags as single-div tags in their production code (just use SVG!), but it helps to illustrate the possibilities of CSS, and the ::before and ::after pseudo elements.

I find that we developers are so used to pandering to the lowest common denominator of supported browsers (a holdover from the IE6 days I suppose?), that we forget that there is a lot of really cool CSS we can use in all sensible modern browsers today.

manrajsinghOP10y ago

Thank you! My aim was to explore CSS features I didn't know were possible. Supporting different browsers was not aim of the project.

j / k navigate · click thread line to collapse

7 comments

5 comments · 2 top-level

_0w8t10y ago· 2 in thread

That is a nice reminder that complexity of implementing modern CSS in a browser may well exceed that of implementing JavaScript. So to reduce the attack surface one should block CSS, not script tags.

manrajsinghOP10y ago

Sorry, I didn't get your second point. Please elaborate.

_0w8t10y ago

A typical assumption behind NoScript and similar blocking browser extensions is that it is executable code that is responsible for most of the bugs in the browser so disabling those reduces the attack surface. But with the complexity of modern CSS this is no longer a priory true. It could be that blocking CSS while allowing JS to execute minimize the attack more that the other way around.

1 more reply

Freak_NL10y ago· 1 in thread

Nice. A good reminder that you don't always need dozens of nested divs to get some effect in HTML. Not that anyone should start rendering flags as single-div tags in their production code (just use SVG!), but it helps to illustrate the possibilities of CSS, and the ::before and ::after pseudo elements.

I find that we developers are so used to pandering to the lowest common denominator of supported browsers (a holdover from the IE6 days I suppose?), that we forget that there is a lot of really cool CSS we can use in all sensible modern browsers today.

manrajsinghOP10y ago

Thank you! My aim was to explore CSS features I didn't know were possible. Supporting different browsers was not aim of the project.

j / k navigate · click thread line to collapse