Hacker News new | past | comments | ask | show | jobs | submit login

A more interesting question would be if it is possible to disable the "dynamic" part of the CSS in any browser. Things like ":hover", ":active" that this proof of concept abuses and leave just the more benign static styling rules.



Perhaps preventing the loading of URLs in the dynamic parts would be enough?


Probably not, you'd also need to disable a lot of other optimizations.

For example, a browser will not load an image if it's set to `display: none` in CSS (at least not right away). That could be abused to then trigger the download when CSS changes without a URL needing to be on the CSS at any point.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: