> Note that they are not actually removing any encodings themselves, so the argument from security / attack surface doesn't arise: the website can still send te

> Note that they are not actually removing any encodings themselves, so the argument from security / attack surface doesn't arise: the website can still send text in any of those encodings (or malformed but autodetected as such). No. If the visitor is able to freely choose the page encoding, then the attacker can lure one into doing so by presenting a seemingly malformed partial text. So it will allow the attacker to control the victim page's encoding, only less effectively though. --- I'm also very annoyed about the disproportional amount of criticism received by Firefox compared to Chrome here, because Chrome has proactively removed the encoding selection UI well before Firefox tried to do similar. And---to elaborate what I referred to the "telemetry-like quantification" before---Firefox concluded that the UI can't be completely removed without breaking a lot of existing pages using the telemetry [1], hence this "Repair Text Encoding" feature. It is hopelessly absurd to blame Firefox alone for this issue. [1] https://hsivonen.fi/encoding-telemetry/ https://hsivonen.fi/encoding-telemetry/