Hacker News Reader

Comment by conartist6 | Hacker News Reader

Is anyone talking about any web page being a zip bomb even without JS turned on?

How would that work? I think you posted something on the github but I don't think what you're conceiving here is possible with this API. It just reroutes HTML insertions from the template to a different location, there is no duplication.

The Content-Encoding header allows any page to be a literal zip-bomb. That's how early versions of Tailwind worked; you'd deliver a 50KB Brotli payload that exploded into 2MB of CSS ( https://v1.tailwindcss.com/docs/controlling-file-size ). So pages potentially being zip-bombs is already a well-accepted part of the Web platform.

Sure, but how is this related to out of order streaming?

<template for="placeholder"> Here is some <em>HTML content</em>! </template>

Before you couldn't make this dangerous (without JS) because there was no way to auto expand the templates

This would end up as:

<div> Here is some <em>HTML content</em>! <?marker name="placeholder"> <?marker name="placeholder1"> </div>

(only the first matching marker set is replaced.

So... you'll have to write Javascript that goes and replaces the additional markers with the stuff they're supposed to expand to? Because what I see there is just a state of partial evaluation, and that leads me to ask (and would lead anyone to ask) how evaluation of all substitutions can be completed...

At the moment - you can treat it as a single "search & replace", and not as a replace all. And yes JS can do the rest atm. Hopefully introducing this (and processing instructions in general) can lead to additional enhancements in the future. But it would have to be gradual, kind of like how modern CSS evolved.

It just feels half-done. This seems to be a loose end left hanging because this is all rooted in theory and not in practice. In theory it doesn't matter if you have to polyfill half the builtin feature with JS because otherwise it doesn't work. In practice, yes it matters.

That's a valid opinion!

Reply on news.ycombinator.com