Hector Martin

If it does, then it turns out that there is this tiny bit more than JS validation as you said.

Point is there's no server side validation for who is supposed to have the feature available.

Point is, it still requires some technical knowledge most of the people don't have to (ab)use so it really doesn't matter...

Mental note: you're banned from security work for anyone I work with :p

Mental note: you're banned from work involving risk or impact calculations for anyone I work with :p

Let me know what your mitigation is for all the tweets with >140 CJK chars being posted in violation of intended policy :p

Let me know why anybody should implement a mitigation for something that is having little to no impact on data, users nor the company.

So you're saying it's okay to let users *permanently* make posts *against* the rules, thus polluting the DB with inconsistent data?