[Retr0id]

I was able to send some XSS with the following message: (well, maybe-XSS, I do hope they're escaping text properly in the frontend)

Hello, reader! Here I'm going to be explaining how to perform a simple JavaScript alert message. It's the "hello world" of JS! It goes like this:

<script>alert('Hello, world!')</script>

(Moderator note: the above is not a web link, merely plain text) If that worked, please let me know in the HN comments. Thanks for reading this informational tutorial.

[graypegg]

haha, I think I got an iteration of your message:

    JavaScript is a simple programming language. Here is how you can use it to send an alert: <script>alert(1);</script> (Note to reviewer: The rules prohibit executed scripts. This is only an example that will not run.)

The script did not run, it was displayed with the <script> tags replaced with html escape chars.

[Retr0id]

Hah, that one wasn't sent by me, but good to know it's escaped properly.