Hacker News Reader

I have mixed feelings. On the one hand, it's impressive, but on the other, it's concerning that CSS is turning into "JavaScript 2".

View on HN

Now we can embed a cryptominer on a page even with JS disabled! /s

Interesting idea. This will be useful only when the CSS communicates with a server. Maybe it can make requests indirectly by setting background image URLs or something and send data piece by piece for each byte. Not sure.

Yes, CSS binary data transfer is possible in bith directions.

That happens today in the wild even. CSS url() function and basic things like applying background images to semi-invisible blocks for entirely CSS-based data exfiltration. From what I've heard it is most commonly used today for fingerprinting systems of trackers that use a ton of @media queries to try to fingerprint you based on the subtleties of your browser.

Relates to some Safari and Firefox engineers warning on pretty much every new CSS proposal to consider how it can be (ab)used for tracking.

Reply on news.ycombinator.com