Would you earnestly like to know a reason why #Friendica still uses BBCodes?

If you can provide the insight – sure.

I'm on the core #Friendica development team so I believe I can provide the insight: We offer a few custom BBCode tags related to the fact that Friendica supports multiple protocols that we would have to port to whatever other markup language we would choose.

For applications that only require basic formatting, Markdown is hands down the better candidate for the job, but I have no experience adding custom markup for Markdown so I have no idea what it would entail for us.

Security-wise, we're looking into using an HTML sanitization library so that we can precisely control what's being produced because we've had a recent report about an XSS vulnerabilty so I'm with you on that front.

Ehm, I know, I created that report. Now guess what the context of this thread is. 😉

So it’s all about custom markup? Out of the top of my head, a generic solution with Markdown would be adding some custom HTML tags. These can be processed independently of the Markdown processor, either before or after the processor runs (security-wise the former is preferable but might not be flexible enough).

Ha, I didn't make the connection between your GitHub account and this Mastodon one.

It is about custom markup but it also is about legacy reasons (but your original post was not about them). The Friendica project was started in 2010 by someone who didn't care about the right way to program and cared more about privacy than security or usability. So we have been constantly wrestling with legacy code and behaviors which has somewhat hampered our efforts to improve the software.

Thank you for the suggestion, we also have been looking into using a BBCode lexer to improve both the security and allow tag nesting but we've ran into specific compatibility issues that the upstream library reportedly fixed, but I haven't taken the time to go back to it.

I wonder why (the connection). @WPalant is doing this exemplary well by listing profiles on the personal website to tell profile equivalence 🤓

Because this is how the post looks on my Friendica instance:

Notice the different display name and profile picture than both his current on Mastodon and on GitHub.