At least with external entities you could deny the parser an internet connection and force it to only load external documents from a cache you prepopulated and vetted. Turing completeness is a bullshit idea in document formats.

With SVGs you can serve them from a different domain. IIUC the issue from TFA was that the SVGs were served from the primary domain; had they been on a different domain, they would have not been allowed to do as much.

Postscript is pretty neat IMHO and it’s Turing complete. I really appreciated my raytraced page finally coming out of that poor HP laser after an hour or so.

I once sent a Sierpinski's Triangle postscript program to a shared printer. It took 90 minutes, and pissed off everybody else trying to print.

One of the very first SVG documents I encountered was a port of the PS Tiger to SVG. It loaded a lot faster than the PostScript Tiger.

PostScript can emulate the ZMachine (Zork text adventures and all of infocom) with "zmachine.ps". Look it up at DDG/GG.

How does it do I/O?

A monad. It’s just a class of abstract Endor Moon or something. Probably you have to send all commands up to the current state to it. :)

Sounds almost like a fun crypto mining opportunity.

calling Leonard Rosenthol ...

XXE should have never existed.

Whoever decided it should be enabled by default should be put into some sort of cybersecurity jail.

It's no different from links to googlesyndication in offline html docs.