Have you considered adding a capability for plugins to draw HTML into an <iframe sandbox>? I'm always pondering such features, but I'm wary of letting a plugin potentially block the CPU forever with custom <script> elements. I have a solution to plugin CPU blocking for pure API plugins (https://github.com/justjake/quickjs-emscripten) but not a way to meld it safely with HTML access.
Re:Ask HN: What Happened to Evernote?
by randomluck040 on Sunday April 10, 2022 @09:28AM
(#30976775)
I‘ll give it a read, thank you!
https://blog.standardnotes.com/33536/how-not-to-build-a-secu...