CSS is not a Turing-complete language on which the bulk of security vulnerabilities relies. The majority of CSS used on webpages is truly beneficial to the user.
(That said, I will turn off CSS on a page that abuses it; the majority of them don't, it's not a security risk, and it makes the page look better most of the time, so no problems with having it on by default.)
stupid question - what do you consider an abuse of CSS?
Do people abuse javascript? Absolutely! However, I think JS can make the page look much better. Ajax loads are quicker than page refreshes, autocomplete is very useful, reply boxes that are loaded inline on demand, Hiding of parts of the page if the user wants to, (long comment threads...) table headers that scroll with the table, etc, etc. The really crummy thing about JS is it has gotten so much negative attention because of the abuses and that's what people focus on.
I really don't like the move to JS dialogs myself though. I don't think that they are beneficial to the user in many cases. Especially when a video or picture is displayed in a JS dialog.
> it's Turing-complete so long as you consider an appropriate accompanying HTML file and user interactions
In other words, CSS won't just sit there and consume CPU cycles unless you actively interact with the page, unlike JS. The highest-voted comment on the first answer there says that a bit more explicitly.
