Hector Martin

Have you actually tried the linked userscript? I assume enabling cramming changes the POST data in some other way.

If it does, then it turns out that there is this tiny bit more than JS validation as you said.

Point is there's no server side validation for who is supposed to have the feature available.

Point is, it still requires some technical knowledge most of the people don't have to (ab)use so it really doesn't matter...

Mental note: you're banned from security work for anyone I work with :p

Mental note: you're banned from work involving risk or impact calculations for anyone I work with :p

Let me know what your mitigation is for all the tweets with >140 CJK chars being posted in violation of intended policy :p