Hey, I actually wrote an application that produced strict xhtml2, and served it with a application/xml+xhtml content type (iirc). It was a page that displayed

Hey, I actually wrote an application that produced strict xhtml2, and served it with a application/xml+xhtml content type (iirc). It was a page that displayed IRC logs, with linkable anchors for each line, automatically breaking words that were too long for the browser, turning text into links by regex, interpreting terminal colors etc. Each time I had a tiny cross-site scripting bug in there (some part wasn't XML-escaped properly), some data would eventually trigger it (you wouldn't believe the amount of encoding junk on IRC), the browser would simply refuse to render anything at all. Inconvenient for my users, but it made sure such things didn't slip by unnoticed. --- This was a side project, done for fun, and a few friends that used my site. If I had been trying to make money from it, the first thing I would've done is to switch to something less strict, so that tiny errors wouldn't stop rendering the whole page.