Themes bad, skins good?

Question

I found few posts where people were basically complaining about themes and at the same time thought skins were useful:

a) But aren’t skins only used in combination with themes, thus isn’t a skin inseparable part of a theme?

b) So why are skins considered useful, while themes not so much?

Thanx

Answer 1

A theme includes one or more skins and CSS.

Allowing custom themes means allowing custom CSS, which is a vector for certain security exploits.

You can have just one theme, with multiple skins for that theme. The skins allow some freedom of choice in how things look, while avoiding potential security pitfalls.

Note that if you control your themes (you provide the themes, including CSS, rather than allowing users to upload their own CSS) then the security consideration isn't a big deal.

Answer 2

Don't use either: use CSS. It's the de facto standard.