It's very, very difficult to get product managers to internalize that there are real security restrictions on how they can enable users to make things pretty.

It's very, very difficult to get product managers to internalize that there are real security restrictions on how they can enable users to make things pretty. Almost everything is security-related. Almost nobody is willing to work with this.