
You have one div tag. What can you do with it? One div. Many possibilities - manrajsingh
https://github.com/ManrajGrover/SingleDivProject
======
Freak_NL
Nice. A good reminder that you don't always need dozens of nested divs to get
some effect in HTML. Not that anyone should start rendering flags as single-
div tags in their production code (just use SVG!), but it helps to illustrate
the possibilities of CSS, and the ::before and ::after pseudo elements.

I find that we developers are so used to pandering to the lowest common
denominator of supported browsers (a holdover from the IE6 days I suppose?),
that we forget that there is a lot of really cool CSS we can use in all
sensible modern browsers today.

~~~
manrajsingh
Thank you! My aim was to explore CSS features I didn't know were possible.
Supporting different browsers was not aim of the project.

------
fpoling
That is a nice reminder that complexity of implementing modern CSS in a
browser may well exceed that of implementing JavaScript. So to reduce the
attack surface one should block CSS, not script tags.

~~~
manrajsingh
Sorry, I didn't get your second point. Please elaborate.

~~~
fpoling
A typical assumption behind NoScript and similar blocking browser extensions
is that it is executable code that is responsible for most of the bugs in the
browser so disabling those reduces the attack surface. But with the complexity
of modern CSS this is no longer a priory true. It could be that blocking CSS
while allowing JS to execute minimize the attack more that the other way
around.

~~~
Freak_NL
Complexity in CSS itself does not significantly increase the attack surface if
the complexity is contained to rendering and layout. There are potential
privacy issues in CSS (such as the loading of assets from external URLs, e.g.,
fonts with @font-face), and I expect there are extensions that block any
attempt to perform HTTP requests from CSS to prevent browser fingerprinting.

But JavaScript can do a _lot_ more, even if you disallow it to make HTTP
requests; it has access to all of the modern APIs included in the browser. CSS
on the other hand is still _mostly_ a declarative language that does not allow
for much dynamic cleverness.

~~~
manrajsingh
Agreed. More damage can be done through JavaScript than CSS.

