I agree in principal, with a few nitpicks. The javascript bit irritates me the most, especially the suggestion that only crazy people would need to disable it.

I agree in principal, with a few nitpicks. The javascript bit irritates me the most, especially the suggestion that only crazy people would need to disable it. The post is absolutely right, though, whitelisting javascript breaks the internet. I learned that when a family member found some new cooking blog on tumblr. The site was compromised, and serving malware to make people join a botnet. After cleanup, we started whitelisting javascript, leading to howls of protest over the next week as every site loaded broken. Eventually I realized that she was just automatically whitelisting any site she visited. (I'd laugh, but I'm probably just doing the same thing... someone posts a new demo here... I usually give it a pass.) So we've decided we want to read random paragraphs or recipes from anonymous strangers. And we somehow decided that that means the strangers get to run code on our machines. I don't know why we thought this was smart, but fine, that's the ecosystem, how do we let it work? Ignoring javascript vulnerabilities doesn't work, user management of javascript doesn't work, what's left? Browsers should have managed, up-to-date blacklists built in. Maybe antivirus companies could help carry the load and manage the lists, but someone should be out there actively hunting down malicious sites so we can break them for all users. Users shouldn't have an "add exception" option, either, we all just prop that door open. It absolutely should NOT be an add on. If javascript security is saved for an add-on, no one will bother, because it requires first knowing what "javascript" is. Javascript security needs to be baked in, and it needs to be better than what we've got.