Simon Pieters

@zcorpan
458 Followers
335 Following
152 Posts

Mozilla is looking for a Staff Security Engineer, Product Security in Remote Canada/US/UK/Germany - https://www.mozilla.org/en-US/careers/position/gh/7539147/

This role expects a significant level of experience in penetration testing, code review, SAST/DAST. (This is not my team, so I won't be able to answer a lot of the typical questions. But you'll get to work on cool products with lots of cool people! :))

Mozilla Careers — Staff Security Engineer, Product Security — Open Positions

Mozilla is hiring a Staff Security Engineer, Product Security in Remote US, Security, Security, Security, Firefox, Firefox, Finance, Security, Security, Marketing, Firefox,…

Mozilla

Intutively for a DOM Sanitizer configuration that looks like the following:

{
elements: ["div", "span"],
attributes: ["class"],
}

For a <div> element, which attributes do you think should/would be allowed?

(Boost appreciated)

No attributes
0%
All attributes
0%
Only the "class" attribute
89.5%
Other (please specify)
10.5%
Poll ended at .
Just published: "The Web's Most Tolerated Feature" by @jugglinmike https://www.bocoup.com/blog/the-webs-most-tolerated-feature
A Worker-Owned Tech Consultancy - Bocoup

Web Platform Consulting Services

HTML Standard

⚠️ Last chance to fill out #StateOfHTML 2025 and get browsers to pay attention to your web platform pain points!

After popular demand, the survey closing date has been extended for a few more days so that returning OOO folks get a chance to fill it out too!

https://survey.devographics.com/en-US/survey/state-of-html/2025/?source=leaverou

State of HTML 2025

Take the State of HTML survey

State of HTML 2025
[mXSS] Consider making HTML parsing of `style`, `script`, `xmp` etc consistent between SVG, MathML, HTML · Issue #11397 · whatwg/html

What is the issue with the HTML Standard? Elements that are parsed as RAWTEXT or RCDATA in HTML context but as normal elements in foreign content context have been used for mXSS vectors. Examples: ...

GitHub

@securitymb Right. But script and style are actual SVG elements so those are likely most risky compat-wise.

Elements or character references or CDATA sections, or even comments.

@asuh @keithamus @bramus can you expand on why widows & orphans? Do you want them for print or multicol?