I played with this a few days ago when it was submitted as "Show HN" (but only got 3 points). It was originally vulnerable to Javascript injection (with poten

I played with this a few days ago when it was submitted as "Show HN" (but only got 3 points). It was originally vulnerable to Javascript injection (with potential for XSS), since the "ascii stream" had no protection against arbitrary HTML that could be injected by binary-encoding it and sending it using a little script. I only had the time to PoC by injecting goat pictures: the next day, I tried making a more fleshed out potential-XSS demonstration and the author fixed the vulnerability while I was playing with it. There's still a (disputable) glitch that I'd like to point out: the ASCII stream is different for everyone, since it's rendered client-side and simply uses the first available bit on page load as point of reference to know when a byte starts. This "frameshift" glitch obviously marred my injection demonstration, but it's still somewhat annoying for anyone who wants to demo their l33t skills, as other viewers only have 1/8 chance of seeing any binary-encoded text that we send. So currently, the ugly way of forcing a message to be seen is by sending it 7 times, once for every possible alignment. (But why would anyone do that, right?) Edit: It also looks like nothing is working anymore today.