Hacker News Reader

Why is blacklisting not safe, assuming you contextually blacklist?

There are a huge number of contextual corner cases, this cheat sheet lists just a few:

I don't understand what that page is trying to tell me. What is the "filter" that <body onload=alert()> evades?