You have one div tag. What can you do with it? One div. Many possibilities | Hacker News Reader

You have one div tag. What can you do with it? One div. Many possibilities

github.com

4 pointsmanrajsingh7 comments

Nice. A good reminder that you don't always need dozens of nested divs to get some effect in HTML. Not that anyone should start rendering flags as single-div tags in their production code (just use SVG!), but it helps to illustrate the possibilities of CSS, and the ::before and ::after pseudo elements.

I find that we developers are so used to pandering to the lowest common denominator of supported browsers (a holdover from the IE6 days I suppose?), that we forget that there is a lot of really cool CSS we can use in all sensible modern browsers today.

Thank you! My aim was to explore CSS features I didn't know were possible. Supporting different browsers was not aim of the project.

That is a nice reminder that complexity of implementing modern CSS in a browser may well exceed that of implementing JavaScript. So to reduce the attack surface one should block CSS, not script tags.

Sorry, I didn't get your second point. Please elaborate.

A typical assumption behind NoScript and similar blocking browser extensions is that it is executable code that is responsible for most of the bugs in the browser so disabling those reduces the attack surface. But with the complexity of modern CSS this is no longer a priory true. It could be that blocking CSS while allowing JS to execute minimize the attack more that the other way around.

Complexity in CSS itself does not significantly increase the attack surface if the complexity is contained to rendering and layout. There are potential privacy issues in CSS (such as the loading of assets from external URLs, e.g., fonts with @font-face), and I expect there are extensions that block any attempt to perform HTTP requests from CSS to prevent browser fingerprinting.

But JavaScript can do a lot more, even if you disallow it to make HTTP requests; it has access to all of the modern APIs included in the browser. CSS on the other hand is still mostly a declarative language that does not allow for much dynamic cleverness.

Agreed. More damage can be done through JavaScript than CSS.

Reply on news.ycombinator.com