CSS is DOOMed

The question is really about where the boundary between presentation (CSS) and interactivity (JavaScript) lies.

For static content like documents the distinction is easy to determine. When you think about applications, widgets, and other interactive elements the line starts to blur.

Before things like flex layout, positioning content with a 100% height was hard, resulting in JavaScript being used for layout and positioning.

Positioning a dropdown menu, tooltip, or other content required JavaScript. Now you can specify the anchor position of the element via CSS properties. Determining which anchor position to use also required JavaScript, but with things like if() can now be done directly in CSS.

Implementing disclosure elements had to be done with a mix of JavaScript and CSS. Now you can use the details/summary elements and CSS to style the open/close states.

Animation effects when opening an element, on hover, etc. such as easing in colour transitions can easily be done in CSS now. Plus, with the reduced motion media query you can gate those effects to that user preference in CSS.

Yeah. I came here to say: "this is awesome, but it's not evidence that css is awesome".

    IDDQD

and

    IDKFA

did not work unfortunately.

While standalone CSS is not yet Turing complete, I worry about the new attack vector categories opened up by moving it towards that state. Already I believe attackers have a choice to spread the attack payload between CSS, HTML and JavaScript to evade current detectors and analysis at the network borders, and evade CSP's since we're well into undecidability territory, like using CSS attribute selectors if the CSP allows external images or fonts. But I'm far from proficient at web browser red teaming. Is this worry unfounded?

I feel there should be a gov dep where all the "i turned this into DOOM" folks get hired, to build the next spicy interplanetary propulsion systems. They are clearly needing an exotic task to stop twiddling their fingers.