muffin.ink

Block-based programming language. JIT compiler runs 100x faster than Scratch. Cross-platform desktop app using Electron. Extensive custom extensions ecosystem including 1400+ new blocks in curated extension gallery . Packager converts projects to HTML or app for Windows/macOS/Linux.

Popular posts: 1
Total points: 271
HN comments: 109
Rank: #9,787 personal

Visit muffin.ink → RSS feedOn Hacker News Apr 2026 – Apr 2026

Web & Frontend 1 Security & Privacy 1

Most points Most discussed Most cited Newest

The woes of sanitizing SVGs

2026271 points109 comments Web & Frontend details

Scratch has a long history of SVG-related vulnerabilities. The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations (eg. measuring SVG bounding box in a more reliable way than viewbox or width/height).