Hacker News Reader

The commit message explains that the terms are verbatim from Wikipedia [1].

Wikipedia [2] attributes it to a Yahoo email filter "which automatically replaced Javascript-related strings with alternate versions, to prevent the possibility of cross-site scripting in HTML email".

[1] https://github.com/minimaxir/big-list-of-naughty-strings/com...

[2] https://en.wikipedia.org/wiki/Scunthorpe_problem

mocha has a naughty german word in its middle, I'm fairly sure.

As a German native speaker, I'm unable to figure it out.

No it doesn't. I believe it can be used for Javascript injections like 'eval' as 'mocha' is/was common a test framework. At least that's the ostensible reason Yahoo replaced 'eval' with 'review', 'mocha' with 'expresso', and 'expression' to 'statement' way back in 2002 [0].

[0] https://www.newscientist.com//article/dn2546-email-security-...

"espresso", not "expresso".

"expresso" with "mocha", surely.

those puzzled me too