Hacker News Reader

> don't allow unsanitized user-provided HTML through raw.

It's sad that you even need to say this, both for the fact that Javascript sandboxing is so terrible and the fact that developers aren't aware of the hazards of just blindly taking user-provided HTML.

View on HN

As a point of honor, I feel obligated to mention that @rockbot and I are very aware of these hazards, but our website was put together in somebody's spare time when Node had like 100 users in total :-)

I read that 'as a point of horror'.

Reply on news.ycombinator.com