Re: per-site user stylesheet rules

On Friday 2004-08-20 10:40 +0200, Robin Berjon wrote:
> I like the idea -- it certainly is a valuable feature to have -- and in 
> fact it could be augmented with something along the lines of:
> 
>   @document url-list "title";
> 
> That would select the alternate with the given title, for that 
> url-matching specification.

I don't understand what you mean.  There have been proposals for
expressing alternate stylesheets within a CSS file, but those don't
select alternates -- rather, they provide alternates.

> That being said, do these things need to be specified in CSS? Or, to put 
> it another way, is it likely that you will ever send such stylesheets 
> over the wire? To be honest, I strongly doubt it. The security issues 
> are too important: if you go to http://dahut.org/ and I send a 
> stylesheet that has:
> 
> @document domain(mozilla.org) {
>   :root {
>     display: none;
>   }
> }
> 
> I assume you wouldn't want that to apply, especially as I could do 
> things nastier than that such as attach an XBL keyboard logger to your 
> bank's site.

The rules would not do anything unless the stylesheet being served from
http://dahut.org/ is also linked from a page in the domain mozilla.org.

> So it's limited to local files that will never be interchanged. Does it 
> need to become a standard?

I'm skeptical of the idea that user stylesheets will never be
interchanged.  (Also, someone might find a use for such a rule in author
stylesheets, although the only good use case I can think of -- easier
management of related rules -- isn't all that strong.)

-David

-- 
L. David Baron                                <URL: http://dbaron.org/ >