> I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin Changing the "password" field on http

> I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin Changing the "password" field on http site to "textarea" with hidden css rule is another great one- to get rid off the browser warning. As it was explained to me, because TLS is too much hustle.