undefined | Better HN

0 pointsporridgeraisin7mo ago0 comments

Not just his convenience. Man-millenia of convenience, if you will ;) I too love the fact that many things can be single index.html's, no need of a zip file then. It's double-click to view. One of the best things about the web platform.

Edit: and "effort", please. The spec has a simple and clear note:

> The easiest and safest way to avoid the rather strange restrictions described in this section is to always escape an ASCII case-insensitive match for "<!--" as "\x3C!--", "<script" as "\x3Cscript", and "</script" as "\x3C/script" when these sequences appear in literals in scripts (e.g. in strings, regular expressions, or comments), and to avoid writing code that uses such constructs in expressions. Doing so avoids the pitfalls that the restrictions in this section are prone to triggering.

Backwards compatibility is easily and completely worth this small amount of effort. It's a one-liner in most languages.

0 comments

tannhaeuser7mo ago

The easiest and safest way to avoid the rather strange restrictions described is to not make use of inline script in a way that makes those restrictions neccessary, though. And a "recommendation" should reflect that (from back when HTML recommendations were actually published rather than random Google shills writing whatever on github). The suggested workaround is also not without criticism (eg [1]).

[1]: https://uploadcare.com/blog/vulnerability-in-html-design/

j / k navigate · click thread line to collapse

0 pointsporridgeraisin7mo ago0 comments

Edit: and "effort", please. The spec has a simple and clear note:

Backwards compatibility is easily and completely worth this small amount of effort. It's a one-liner in most languages.

0 comments

tannhaeuser7mo ago

[1]: https://uploadcare.com/blog/vulnerability-in-html-design/

j / k navigate · click thread line to collapse