Allowing JavaScript is only going to get closer to being equivalent to allowing untrusted, unsigned code on your machine. Atwood's Law applies to malware too.

Allowing JavaScript is only going to get closer to being equivalent to allowing untrusted, unsigned code on your machine. Atwood's Law applies to malware too. Before I edited this comment, I had a laugh at the expense of people who think I'm in some way misguided for using NoScript and complaining when sites break with JavaScript off. That was wrong. I think that those critics are also wrong, though, and this sort of thing is why. Even if this particular code is a non-starter, the plausibility of this kind of threat, this kind of nightmare scenario, is a huge problem. JavaScript is a general-purpose programming language that's present on nearly every user-facing computer in the world, with all the security issues that come with that. It is in some ways the world's biggest and most-rewarding malware attack surface. A working 0-day attack in JavaScript itself could be worth millions or billions in the right hands.