> The amount of obscure APIs being added just boosts the surface area for vulnerabilities It’s often the ancient APIs from around 1995-2001 that are the most v

> The amount of obscure APIs being added just boosts the surface area for vulnerabilities It’s often the ancient APIs from around 1995-2001 that are the most vulnerable ones, with information leaking across origins (like todays) needing hacky fixes to stay secure and compatible. window.open(), target=_blank, cross site request forgery, etc. IE6 from 2001 had a ton of these modern security issues, and Netscape before it probably had them too. At that time there were tons of buffer overflow security holes so no on cared about side-channel attacks.