[jbarrs]

>Posts of unknown authorship have a disclaimer at the top of the page.

Problem is, the posts can contain <script> elements. So it's easy to just write a little JavaScript that removes the disclaimer at the top. See this hastily-made, immature example of mine:

https://joshcsimmons.com/post/H4sIABO8LmUC/3VT0W7aQBB85yu2QV...

As it stands, this really isn't the most secure system. Something much more malicious could be injected into this!

[joshcsimmons]

This gave me a pretty good laugh. I have some sanitization and guards set up now. TBH I never really expected anyone to visit my blog.

[latexr]

Shouldn’t it be “shat”?

Either way, considering the submission we’re commenting on, the author of the blog may appreciate your humour.

[joshcsimmons]

Correct

[pjot]

I was halfway expecting goatse