Yep pretty much :) Actually it's worse than that. Even without 3rd party JS, most major websites these days run on large piles of open source libraries that ha

Yep pretty much :) Actually it's worse than that. Even without 3rd party JS, most major websites these days run on large piles of open source libraries that have never been security reviewed (e.g. code from npm, rubygems, PyPi, NuGet) and attackers are increasingly targeting those underlying libraries for compromise...