If you need an example, I hear Gab Pro subscribers get to post with rich text and it has an interface.
This is the site I was talking about: https://gab.com
@rasterman @p Using HTML in posts poses security risks. I'm surprised that you guys are using it in current year.
@p @rasterman The last time I've heard of using direct HTML for post formatting was for Blogspot comments.
Yes, I understand; but I think I'm willing to run that risk.
@rasterman More like hidden links, embedding JavaScript code, iframes, etc. But, as what @p said the malicious tags/attributes are blacklisted. Though personally, I think Markdown or even BBCode is much simpler and easier to understand.
@rasterman @p BBCode is much older and is more used on forums. It uses brackets instead of inequality signs for tags, so you save a keystroke by not having to press shift to enter tags. Markdown uses symbols for each tag and it makes it more natural to read. Both are parsed into HTML at the end of the day.
Honestly, using a markup language makes formatting much faster compared to using buttons. It's just like using keyboard shortcuts in a word processor.
You should have seen the spinning posts when things were not sanitized nicely. (And that's just a benign proof of ability.)
Sure, sorry.
If you allow non-sanitized user html people can write scripts that affect the post in funny ways (like making all the text spin) and also probably some malicious ways. This also effected 4chan with the eval() posting worm, so it's not really new or unique to fedi.
> people can write scripts that affect the post in funny ways (like making all the text spin)
In this case, it was a CSS class that was used in the UI to make stuff spin (like how the star spins until the server confirms that you've smashed that like), no scripts got through.
ELIF rules say "html and css are indistinguishable to normies and all code is a script."
Also, technically, the eval bug is js, so it's worse than you imagined. We're up to 3 distinct languages, one per example, with absolutely no common ground, and what exists is rife with contextual details that make this a technically meaningless comparison.
Related, just for the intro line and not much else.
It's a meta joke: https://videos.lukesmith.xyz/videos/watch/111ae34f-52fc-40d3-844b-d19d7324619c
@moth @p @rasterman Just the fact that we have three separate languages for web pages (not including server-side languages) almost makes me understand why people write sites entirely in JavaScript these days. (Keyword being "almost")
> the eval bug is js
Yes. I ain't been to much since the Boomer Remover failed to remove the boomers, but like half the stuff I go to, Samy Kamkar is there.
> It's a meta joke:
@moth @p @rasterman It was also used as an exploit to create custom backgrounds for Facebook pages back in the day. I'm surprised that a site like Facebook let that slip.
