We're running untrusted code from dozens or hundreds of sources, every time we click the mouse button. This isn't a platform designed for maximum security. Ye

We're running untrusted code from dozens or hundreds of sources, every time we click the mouse button. This isn't a platform designed for maximum security. Yes, JS is the sand. TBL has written about the Principle of Least Power, and the specific benefits of HTML/CSS. By putting JS on every document on the internet, we've already lost.