[Dillo-dev] css :visited and security

On Tue, Jan 05, 2010 at 03:36:24PM +0000, corvid wrote:

The other day, I saw another of those pages about using :visited and display in order to allow others to learn whether the user has visited a page. (I remember Johannes pointing to a page about this last year, too.)

I wonder whether it would be sensible to have a dillorc option defaulting to NO for whether to use :visited.

Yes, that sounds good. We should distinguish between remote / embedded CSS and user agent and user stylesheet though. For the latter two we don't need any restrictions. We might also do some other restrictions on remote CSS in the future, e.g. possible dillo specific extensions should also be only accessible via the user agent and user stylesheet.