Not allowing remote code execution seems like a reasonable step. There’s no simple, generalizable way to ensure remote data being loaded isn’t code, that isn’t

Not allowing remote code execution seems like a reasonable step. There’s no simple, generalizable way to ensure remote data being loaded isn’t code, that isn’t easily circumvented. That being said, the other changes are clearly anti-adblock.