3 ms·
Agreed, and I think Markdown's inclusion of HTML makes it a bad choice for this application* as well - why put yourself in the position of being in an arms race
by allertonm 18y ago
Agreed, and I think Markdown's inclusion of HTML makes it a bad choice for this application* as well - why put yourself in the position of being in an arms race with spammers and scammers, when there are other valid choices (WikiText being the most obvious example.)
(* This is not a slam on Markdown, which I quite like, but John Gruber created it for himself and his uses as a writer with complete ownership over his servers.)
- stcredzero 18y agoThe problem with sanitizing all possible XSS exploits in all HTML accepted by browsers is similar to being the outlaw vs. being the cop. As an outlaw, you have to make good your escape every single time. The cop only has to catch the outlaw once. Admittedly, this is confusing because Jeff, be being an HTML cop, has put himself in the position of outlaw.