Oh I see. This makes sense. This doesn't seem challenging to prevent. A simple replacement of characters on the HTML entity table would have prevented this instead of putting arbitrary text onto standard output.
Yep, missing that is what makes this an "XSS" :)
Correct. The purpose of this post is to demonstrate yet another class of website that does not validate user input.
Yeah... that was actually hugely annoying. A little warning maybe.
Here's your warning: if you ever click on an HN link titled "<something> XSS", prepare for something annoying to happen.