3 ms·

Please delete JavaScript while we're at it.

• mjevans 3y ago
  JavaScript tends to be fine in specific allow-listed circumstances: * User preference (E.G. plugins/extensions) * Native to the site, when a user is logged in * Trivial and sandboxed to page local data I recall how I used to use Flash, with a plugin that delayed the loading until AFTER I hit 'play' on the plugin frame. I suspect that's the sort of security framework that will solve a lot of the problems. Do not run untrusted code by default. Have the user to enable a site (often during account creation / sign in on a new device). Have the user 'click play' if they expect something to work. Make sites that just work without client side code again.