I agree with the sentiment, but too many companies are using javascript. That said, I only enable ecmascript for sites that I do business with. If I don't kno

I agree with the sentiment, but too many companies are using javascript. That said, I only enable ecmascript for sites that I do business with. If I don't know where the site owners work, I won't enable it. I make a few exceptions for a few sites under heavy scrutiny. Even CSS has some exfil risks, but there are browser addons to block that as well. [1] [1] - https://www.mike-gualtieri.com/css-exfil-vulnerability-tester https://www.mike-gualtieri.com/css-exfil-vulnerability-teste...