It looks like the ex-DDG employee got the details wrong, and read the slides backwards.

  • Skull giver@popplesburger.hilciferous.nlOP
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    1 year ago

    I assume it has to do with code filtering out attempts to inject HTML / scripts into comments. Lemmy had a bunch of bugs that allowed hackers to inject Javascript so they turned on quite an aggressive filter.

    • mindbleach@sh.itjust.works
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      They fucked it up completely in a way that raises questions of competence.

      HTML has ways to display angle brackets specifically intended to never be interpreted as tags. “Entity names” will never be code. There’s not even a sensible way to do it deliberately, like %20 nonsense.

    • 0xD@infosec.pub
      link
      fedilink
      arrow-up
      1
      arrow-down
      1
      ·
      1 year ago

      Could have done it with proper encoding, don’t need to remove it lol o.O