4 ms·
> ... it would be a massive XSS vulnerability. Yes, if the MathJax library were to be accessed remotely. This issue is finessed by having a local copy of the l
by lutusp 10y ago
> ... it would be a massive XSS vulnerability.
Yes, if the MathJax library were to be accessed remotely. This issue is finessed by having a local copy of the library. Since it's free, many sites host it locally (including mine).
But others including Reddit, which IMHO really needs this library also, won't host it, I think on the basis that it isn't used by enough people to justify linking it on every page. So there are definitely arguments against. Ideally it would be a selectable option on a page-by-page basis.
- andreareina 10y agoIs there an option for lazy loading? i.e., a lightwieght script that looks for delimited text and pulls in the rest of the library if needed?
- lutusp 10y ago> Is there an option for lazy loading? I believe Apache can run user-defined scripts to perform this sort of thing -- in this case, look at a page's content and decide how to proceed. But high-volume sites don't like such things because it dramatically slows page loading.
- andreareina 10y agoI was thinking client-side: <script>if (document.body.innerHTML.match(...)) {load_script(https://...)}</script>