Is a technical solution necessary? Is there consensus that "new message" spoofing should be prohibited?

On Jan 24, 2008 7:42 AM, Huji <huji.huji(a)gmail.com> wrote: will time, Repeating (and expanding on) my comment from there: this is pointless, IMO. The usertalk thing can still easily be spoofed with absolute positioning, unless bug 9526 (http://bugzilla.wikimedia.org/show_bug.cgi?id=9526) is fixed. Adding the current user's name to the message is a much more sensible tactic; it would be impossible to spoof unless someone adds a JS-based {{username}} hack or something. Of course, this doesn't affect me at enwiki. I decided more than a year ago (in the midst of some fight or other, I guess, I don't remember) that the default orange color was too traumatizing, so I added some user CSS: .usermessage { background: lightgreen no-repeat 4px center url( http://upload.wikimedia.org/wikipedia/commons/thumb/b/b0/Smiley_head_happy.… ); border-color: green; padding: 0.5em 13px 0.5em 33px; } _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l

Even that can be spoofed with something like <div class="usermessage" ....> I guess! ;)

I don't see how is that "spoofing" dangerous. Sure, you can make them click a link, but so you can putting it anywhere else, and that way it's even easier to notice if it is doing any harm. What's the matter?