I think he is referring to a specific issue: He wants a security model that allows "sandboxing" partially-trusted code so that it cannot take over the whole pag

I think he is referring to a specific issue: He wants a security model that allows "sandboxing" partially-trusted code so that it cannot take over the whole page. Today, if you execute a piece of JavaScript you have to trust it fully. This is an issue with e.g, ads. If an ad includes JavaScript, it can steal your users passwords. He mentions Caja (http://code.google.com/p/google-caja/ http://code.google.com/p/google-caja/) which is an attempt to provide such a security model. I guess this is a serious issue for the big ad-driven sites like Yahoo and Google. He is frustrated that the other parties involved in standardization (primarily browser vendors) does not prioritize this issue. I do agree that it is disingenuous to state that security was ignored.