3 ms·

Replacing embeds with plain hyperlinks seems like it would be better from a user privacy perspective.

• JoshTriplett 11y ago
  Or at the very least with iframes. If you run a forum and you're allowing directly embedded content, you're trusting that content not to break your security.
  • richardwhiuk 11y ago
    I think iframes will result in a embedded content warning?
    • justinph 11y ago
      Yes, they do.
    • JoshTriplett 11y ago
      Yes, they will, but they're an improvement over script tags (which will also result in a mixed-content warning).
  • buro9 11y ago
    I use Markdown for user content, this is passed through a Go library I wrote to strip out iframes, embeds, etc... https://github.com/microcosm-cc/bluemonday https://github.com/microcosm-cc/bluemonday and then as a post-processing task once I trust the content, I find the links that I know how to handle (YouTube, Bikely, etc) and embed third party content in iframes. This is basically a way to do the equivalent of Twitter cards, it respects the JavaScript and web security model, but does mean that the iframes contain http content on a page that is https Where I'm trying to get to is to have all iframes, etc be https
    • JoshTriplett 11y ago
      > I find the links that I know how to handle (YouTube, Bikely, etc) and embed third party content in iframes. Ah, that makes sense. From your previous comment, I didn't realize you were recognizing and explicitly handling sites like Bikely.