'disable customised profiles' toggle

[ronin3]

The topic of customisations on the profile page has been discussed for quite a while.

For example, this old thread (2018) Feature Request: Profile Page toggle for board/list game display

Or this newer thread (late 2025) a “Tutorial” on “how to custom your profile”.

Many rejoiced, but the discerning reader might have picked up on some concerns, for instance

Tutorial: How to Custom Your OGS Profile Page: A Step-by-Step Guide

IMO if you want to customise your own website it’s okay, but OGS is a website where many users use, so customising it and forcing other users to see what you want to see is just not right. Of course they can choose not to visit your profile or group if they don’t like it, and it’s not like they are customising your screens as well so maybe there’s no need for a strong reaction.

or this other one, which is very thoughtful:

Tutorial: How to Custom Your OGS Profile Page: A Step-by-Step Guide

Mh… couldn’t those flashes trigger a seizure in people who suffer from epilepsy?

Frankly speaking, since the profiles started to go wild, I am finding myself avoiding them as much as possible; all that customisation does not “spark joy” at all. I don’t want to wait two minutes to open up a profile.

Therefore I would like to make a radical suggestion.

A global toggle, to be placed somewhere in Settings.
Light mode profile, vs full profile.

In full mode, the profiles would be rendered as is today: with any and all custom CSS, never-ending list of games, (injected Javascript/XSS attack vectors that may be possible now or in the future), and so on and so forth.

Light mode - a bare-bone version of the profile. NO custom CSS, NO custom scripts, just username, avatar, rank, last 10 finished games, count of currently ongoing games, maybe a tally of the number of trophies awarded, maybe the first 150/200 characters from their bio in plaintext; ladder status, and the ever-important information if they are on vacation.

Something that loads quick, gives the information, and has the added benefit of being more inclusive of hidden health conditions.

Thoughts?

[AdamR]

Honestly, yeah…

I used to be an advocate for custom profiles as a fun quirk of a handful of people who knew how to do it. I must say I don’t encounter them too often (and I do crawl through a lot of profiles), but at this point, when it is becoming so easy to do it (I vaguely recall there is also some vibed add-on to do it?), I would actually be okay with even stripping them completely, no toggle.

Does anyone have a number annoying examples to look at? Might help with the decision making.

@ronin3

injected Javascript/XSS attack vectors that may be possible now or in the future

Is this just speculation, or are you really aware about a possible misuse? That would of course be a very serious concern, but I think we only allow css which can be annoying, but otherwise harmless, and only a handful of sanitized tags. Basically to allow audio and links…

[benjito]

@AdamR

@ronin3

injected Javascript/XSS attack vec

we only allow css which can be annoying, but otherwise harmless

Not true. For example, phishing or tracking.

[ronin3]

@AdamR

Is this just speculation, or are you really aware about a possible misuse?

Not aware about current possible misuses, no.

Just concerned “in principle” about unforeseen zero-day vulnerabilities that might become available (especially with the latest technologies that help find them…)