> Pushing JavaScript everywhere increases the attack surface for every single user on the web. I understand where you're coming from, but most users browse the

> Pushing JavaScript everywhere increases the attack surface for every single user on the web. I understand where you're coming from, but most users browse the web with Javascript = on. Even as a NoScript user I have Google whitelisted because most of their services are unusable without Javascript. Even automated tools have good Javascript engines now thanks to headless mode in popular browsers. I suspect the next steps in browser security will not be to blanket-deny scripting, but instead focus on containers and sandboxing to make script-based attacks less worthwhile.