It wasn't clear to me from reading this whether
Removing XSLT for a more secure browser
41–50 of 352 posts
Re: Removing XSLT for a more secure browser
#42[dead]
Re: Removing XSLT for a more secure browser
#43Ah, so this is removing libxslt. For a minute I thought XSLT processing was provided by libxml2, and I remembered seeing that the Ladybird browser project just added a dependency on libxml2 in their latest progress update https://ladybird.org/newsletter/2025-10-31/.
I'm curious to see what happens going forward with these aging and under-resourced—yet critical—libraries.
Re: Removing XSLT for a more secure browser
#44"The reality is that for all of the work that we've put into HTML, and CSS, and the DOM, it has fundamentally utterly failed to deliver on its promise.
It's even worse than that, actually, because all of the things we've built aren't just not doing what we want, they're holding developers back. People build their applications on frameworks that _abstract out_ all the APIs we build for browsers, and _even with those frameworks_ developers are hamstrung by weird limitations of the web."
- https://news.ycombinator.com/item?id=34612696#34622514
I find it so weird that browser devs can point to the existence of stuff like React and not feel embarrassed.
Re: Removing XSLT for a more secure browser
#45I don't use XSLT and don't object to this, but seeing "security" cited made me realize how reflexively distrustful I've become of them using that justification for a given decision. Is this one actually about security? Who knows!
Its "Security" when they want to do a thing, its "WebCompat" when they don't.
Re: Removing XSLT for a more secure browser
#46Earlier quoted context omitted.
Last I heard for WebKit removing it was the only outcome they saw.
Yeah all these billion dollar corporations that can’t be bothered see it as the only path forward not because of technological or practical issues, but because none of them can be asked to give a shit and plan it into their budgets. They’re MBAs who only know how to destroy and consolidate as trained.
I get the frustration but I don’t believe that’s really accurate. It’s not widely used and modern developers don’t see it as valuable.
Re: Removing XSLT for a more secure browser
#47If you are using XSLT to make your RSS or atom feeds readable in a browser should somebody click the link you may find this post by Jake Archibald useful: https://jakearchibald.com/2025/making-xml-human-readable-wit... - it provides a JavaScript-based alternative that I believe should work even after Chrome remove this feature.
Re: Removing XSLT for a more secure browser
#48The "severe security issue" in libxml2 they mention is actually a non-issue and the code in question isn't even used by Chrome. I'm all for switching to memory-safe languages but badmouthing OSS projects is poor style.
Re: Removing XSLT for a more secure browser
#49Destroying the open web instead of advocating to fix one of the better underutilized browser technologies for a more Profitable Google. I will not forget the name Mason Freed, destroyer of open collaborative technology.
> Destroying the open web instead of advocating to fix one of the better underutilized browser technologies for a more Profitable Google.
Google, Mozilla and Apple do not care if it doesn't make them money, unless you want to pay them billions to keep that feature?
> I will not forget the name Mason Freed, destroyer of open collaborative technology.
This is quite petty.
Re: Removing XSLT for a more secure browser
#50Earlier quoted context omitted.
Yeah all these billion dollar corporations that can’t be bothered see it as the only path forward not because of technological or practical issues, but because none of them can be asked to give a shit and plan it into their budgets. They’re MBAs who only know how to destroy and consolidate as trained.
I get the frustration but I don’t believe that’s really accurate. It’s not widely used and modern developers don’t see it as valuable.
I’m a modern developer and I see it as valuable. Why side with the browser teams and ignoring user feedback?
If “modern developers” actually spent time with it, they’d find it valuable. Modern developers are idiots if their constant cry is “just write it in JS”.
No idea what’s inaccurate about this. A billion dollar company that has no problem pivoting otherwise, can’t fund open technology “because budgets” is simply a lie.