[yourapostasy]

While standalone CSS is not yet Turing complete, I worry about the new attack vector categories opened up by moving it towards that state. Already I believe attackers have a choice to spread the attack payload between CSS, HTML and JavaScript to evade current detectors and analysis at the network borders, and evade CSP's since we're well into undecidability territory, like using CSS attribute selectors if the CSP allows external images or fonts. But I'm far from proficient at web browser red teaming. Is this worry unfounded?

[codethief]

> While standalone CSS is not yet Turing complete

Looks like it is, though? https://news.ycombinator.com/item?id=47558097

[yourapostasy]

Oh yep, looks Turing complete just not performant enough for that use case. But that’s not an issue for APT-style attacks that take their sweet time. So am I off base here?