Hey, @p, can we get an interface for rich text on our posts? It's a minor inconvenience to have to switch to HTML and manually add the <b>'s and <i>'s and shiet.
If you need an example, I hear Gab Pro subscribers get to post with rich text and it has an interface.
This is the site I was talking about: https://gab.com
If you need an example, I hear Gab Pro subscribers get to post with rich text and it has an interface.
This is the site I was talking about: https://gab.com
@rasterman @p Using HTML in posts poses security risks. I'm surprised that you guys are using it in current year.
Yes, I understand; but I think I'm willing to run that risk.
@rasterman @xianc78 @p
You should have seen the spinning posts when things were not sanitized nicely. (And that's just a benign proof of ability.)
You should have seen the spinning posts when things were not sanitized nicely. (And that's just a benign proof of ability.)
@rasterman @p @xianc78
Sure, sorry.
If you allow non-sanitized user html people can write scripts that affect the post in funny ways (like making all the text spin) and also probably some malicious ways. This also effected 4chan with the eval() posting worm, so it's not really new or unique to fedi.
Sure, sorry.
If you allow non-sanitized user html people can write scripts that affect the post in funny ways (like making all the text spin) and also probably some malicious ways. This also effected 4chan with the eval() posting worm, so it's not really new or unique to fedi.
@moth @rasterman @xianc78
> people can write scripts that affect the post in funny ways (like making all the text spin)
In this case, it was a CSS class that was used in the UI to make stuff spin (like how the star spins until the server confirms that you've smashed that like), no scripts got through.
> people can write scripts that affect the post in funny ways (like making all the text spin)
In this case, it was a CSS class that was used in the UI to make stuff spin (like how the star spins until the server confirms that you've smashed that like), no scripts got through.
@p @rasterman @xianc78
ELIF rules say "html and css are indistinguishable to normies and all code is a script."
ELIF rules say "html and css are indistinguishable to normies and all code is a script."
@p @rasterman @xianc78
Also, technically, the eval bug is js, so it's worse than you imagined. We're up to 3 distinct languages, one per example, with absolutely no common ground, and what exists is rife with contextual details that make this a technically meaningless comparison.
Related, just for the intro line and not much else.
It's a meta joke: https://videos.lukesmith.xyz/videos/watch/111ae34f-52fc-40d3-844b-d19d7324619c
Also, technically, the eval bug is js, so it's worse than you imagined. We're up to 3 distinct languages, one per example, with absolutely no common ground, and what exists is rife with contextual details that make this a technically meaningless comparison.
Related, just for the intro line and not much else.
It's a meta joke: https://videos.lukesmith.xyz/videos/watch/111ae34f-52fc-40d3-844b-d19d7324619c
Follow
@moth @p @rasterman Just the fact that we have three separate languages for web pages (not including server-side languages) almost makes me understand why people write sites entirely in JavaScript these days. (Keyword being "almost")
