>You might dislike the idea that document authors can run arbitrary Javascript on your personal computer. How I feel about this depends a lot on how much I tru

>You might dislike the idea that document authors can run arbitrary Javascript on your personal computer. How I feel about this depends a lot on how much I trust the people who created the document and/or the person who sent it to me. I would trust a website I specifically selected with a defined TLS web of trust more than I would trust a random spam email. When we think about the risks associated with the complex and inherently insecure format known as HTML we tend to assume the level of trust available on the web. If we package up a bunch of HTML in a standalone document then we lose that assumption.