the security model of this seems dubious for JS. every untrusted client can execute arbitrary code in the other clients. this is equivalent to letting every vis

the security model of this seems dubious for JS. every untrusted client can execute arbitrary code in the other clients. this is equivalent to letting every visitor inject JS code to your website. It's a great thing if you're a rootkit distributor I suppose.