I have XHR disabled by default and can enable it with 2 clicks.
> But disabling XHR/fetch/others won't stop your browser from being able to make requests.
> CSS can make requests
Hence it being disabled.
> HTML can also make requests (<img> and <iframe> elements comes to mind).
Which is why I have those disabled by default too.
> CSS cannot be used as an external API as much as HTML cannot be used as an API
But it can be used as an API and because there are people out there, like yourself, who downplay this ability, there are those who will leave it running…
> assumes that JS is activated, otherwise you can't really do anything dynamic with the data
…and hence, may have disabled the usual routes that you listed - XHR, images, frames etc - and leave JS on for some other reason while believing they've mitigated a number of major threats.
It's hard to produce perfect security or anti-tracking behaviour, very hard, but that doesn't mean we should ignore CSS.
Sure, but it's not easy. You'd have to run content-scripts from some browser extension that polyfills the APIs you want to get rid of. But disabling XHR/fetch/others won't stop your browser from being able to make requests. CSS can make requests (like when you provide custom font paths, or images), HTML can also make requests (<img> and <iframe> elements comes to mind). Without those, we don't have a web anymore, we have a document storage without links to other resources.
CSS cannot be used as an external API as much as HTML cannot be used as an API. The trick the author is talking about under "CSS as an API" assumes that JS is activated, otherwise you can't really do anything dynamic with the data. And if you're not doing something dynamic (like you wanna display some text in :content under a :before element), you can just set it in the HTML response instead of in the CSS response.
I'm not saying that disabling JS by default is bad (I do so myself, enabling it only for trusted sites). I'm just pointing out that disabling CSS is not gonna give you any additional benefits. As long as you're in the browser, a HTML page can make requests for you, even if you have CSS disabled.