Hacker News Reader

doesn't the inline JS (onlick="this.classList.add('green')") harm/complicate CSP headers?

Yes, it all flies in the face of accepted strict Content-Security-Policy best practice.

I've not seen the reasoning for this in the thread.

Best practices are generally called that for a reason.