Fair enough. It's similar to embedding third-party gadgets for things like iGoogle. However, in practice that content is sanitized. Note there are risks to hos

Fair enough. It's similar to embedding third-party gadgets for things like iGoogle. However, in practice that content is sanitized. Note there are risks to hosting arbitrary Javascript beyond stealing cookies. For example, you can steal browser history, discover NAT IP addresses, scan intranet ports, etc. Here's a presentation by Jeremiah Grossman covering some of these attacks: http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Grossman.pdf http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Gro... Of course, attackers can host malicious content anywhere they control. I could just as easily send someone a bit.ly link to a malicious site I control.