Hacker News new | ask | show | jobs
by cxr 37 days ago
> Would moving the untrusted content to be served from a separate domain entirely close the hole?

Yes.