> because it was central to the project of making the web an application platform This is very insightful. A lot of web standards are attempts to add what trad

> because it was central to the project of making the web an application platform This is very insightful. A lot of web standards are attempts to add what traditional native-app capabilities to the browser (e.g. 2D Graphics => Canvas). What's very clear now is that native-like web capabilities imply native-like vulnerabilities, but delivered over the network. Browser vendors rethinking what causes a user to launch complex Javascript on tabs they visit (or worse, in invisible iframes) would be a great start. It was one thing when all Javascript could do is style and manipulate the DOM. We can now compile vim into Javascript and that demands a completely different response. This is not to stop progress on web standards, but if the web community takes this opportunity to level-up their security practices, it'll help them (and web application developers and users) in the long run.