In the past, changes to internet standards were about enabling better presentation of webpages. Now changes involve JavaScript APIs that access things tradition

In the past, changes to internet standards were about enabling better presentation of webpages. Now changes involve JavaScript APIs that access things traditionally reserved for plugins (which were a security nightmare) and native applications. Doing that can pose unforeseen security risks, such as the supercookie: http://money.cnn.com/2015/01/09/technology/security/super-cookies/ http://money.cnn.com/2015/01/09/technology/security/super-co... Not to mention, I posted elsewhere in this discussion that WebBluetooth seems like a way that an attacker with control of a server can run attacks against bluetooth devices that he otherwise would not have been able to access without breaking out of the sandbox. Once in control of one of those bluetooth devices, it would be possible to attack the system from the compromised devices. It is like giving unrestricted network access to Javascript once a user clicks accept (and they almost all would), except with a different network technology where devices all trust each other not to do malicious things. Given that security flaws can happen when new features are used in unforeseen ways, I am happy to see Apple take its time under the assumption that it is taking its time to implement things correctly.