Hacker News Reader

Comment by scotty79 | Hacker News Reader

Why does anyone think that blacklisting things they know about makes html more secure?

I guess whitelisting only the things they are absolutely sure are harmless is way more work.

Even whitelisting is dangerous for web/html. Given any tag, there's probably a large number of things you can do with them that boggles the mind as in "whoa I didn't know you could do that..." including things that are not in the w3c specs but are coded into the interpreters.

Basically the experience of a web developer every day, no matter how experienced you are.

I you whitelist tags and then whitelist attributes and then whitelist attribute values and for attributes that have values with its own structure, like style whitelist allowed things in that structure, you should be fine.

But it's hard to restrain yourself from doing: allow any (possibly except some) at any stage of whitelisting.

Even to a point of not allowing string of any characters as attribute value.

How about “not using a bazooka to kill a mosquito”? There's no reason why a text editor needs a frigging browser engine as a core component.

Apparently there's a reason because VS Code (and Atom) is way more useful than any other editor built over last few decades.

And yet somehow neither of them can compare to text-mode editors built more than 30 years ago.

I like to use both, depending on what I'm working on. If I'm writing code then a vim / tmux combo can be great but if you're editing markdown or an html / css website having the live preview and same developer tools as the browser is really nice.

Unsure how to quantify this kind of hyperbole. Compared to SublimeText 2 which is outdated at this point, VS Code and Atom are only getting back to the standard of fast code editors from the last few years ...

If you go back a few decades, you're competing against vi/vim and emacs, and there's no way you can say VS Code (and atom) can go against the "usefulness" or even productivity of either of those editors and their development environments.

Reply on news.ycombinator.com