Thanks for the information. I didn't realize that it is verboten. I presumed it was for efficiency purposes and implementation hassles. I do realize that there

Thanks for the information. I didn't realize that it is verboten. I presumed it was for efficiency purposes and implementation hassles. I do realize that there are plenty of attack vectors the moment you start trusting JS from a remote website. It was just a proof-of-concept of how Dropbox can still allow you to view files in your browser, but perhaps flash a big warning saying that this is a lot weaker security-wise than locally running your dropbox client. That way they cater to people who are willing to forego a little security for convenience.