I’m not going to continue this discussion because I feel you are just trying to excuse yourself from the embarrassing mistake you made.

XSS attacks exploit a client-side context and are therefore bound by the same-origin policy:

http://en.wikipedia.org/wiki/Same_origin_policy

For example, if a web site is mostly static, and the only non-static part is a broken 404 handler that has an XSS vulnerability, exploiting it is almost useless. If a web site doesn’t use cookies, or if the cookies it uses aren’t sensitive or trusted, stealing them is not the all-powerful exploit you seem to think it is. Consider a blog where a cookie is used to remember someone’s name, and the next time that person comments, their name is pre-filled. Stealing such a cookie gains you very little. You can already fill out the form yourself and provide any name you want.

The vast majority of people who visit my site are readers. A very small minority join the discussions. An even smaller minority maintain modest profiles. It is the latter group that motivated me to restrict the schemes that the CSRF Redirector allows. Isolating it to its own domain would give me the opportunity to loosen this restriction without putting any of my readers at risk, which is why I mentioned this as an option.

I did not elaborate on these points previously out of respect. (In fact, I only mentioned the same-origin policy after it seemed necessary.) You blog about web application security, so explaining the mundane details of XSS seemed disrespectful. The fact that your response lacks this same respect is disappointing.

I could transfer the cookies from your domain to any domain if a XSS hole is found on your site.

Imagine a attacker who uses your tool then creates a tinyurl of it and then posts an interesting comment with a link to the tinyurl. The attacker could gain the cookies of the user or yourself.

I could always isolate it to its own domain or something, and maybe that would be a good thing to do at some point. It would be nice to explore the opportunities that other schemes present.

Glad you fixed it