My understanding is that user scripts allow you to match based on the URL. It would still be a predefined set of URLs (or URL patterns) with a binary option for

My understanding is that user scripts allow you to match based on the URL. It would still be a predefined set of URLs (or URL patterns) with a binary option for the user (install and accept everything, or don't). That's essentially what extensions do today. zeta0134's approach would be to put the user in charge of building this white- or blacklist. Following the way plugins are currently implemented, this would allow you to say "I always trust this extension", "I don't trust this by default, ask me every time" and "I trust this extension for example.com". This would definitely need some security UX testing, but it seems like a reasonable approach to me.