>The focus on Javascript as though it's somehow special is rather baffling to me One of the most common ways major ad networks get compromised to the extent th

>The focus on Javascript as though it's somehow special is rather baffling to me One of the most common ways major ad networks get compromised to the extent that they serve malware to hundreds of thousands of web users (this happens at least once a year) is that they hotlink to JS libraries, that hotlink to JS libraries, that hotlink to more JS libraries. If you use a script blocker, it's not that uncommon to see that once you get down far enough, scripts are being loaded from bare IP addresses rather than domain names. Every now and again, someone compromises one of these deep-nested hotlinked JS files and maliciously modifies the javascript, and random sites all over the web dutifully serve the malware. It's not that I don't trust the first-party website owners, more like I don't trust their friends friends friend.