Which is a mistake, and this shows why. Javascript should be default-off everywhere, and then if there's a Tor site you trust (oxymoron if I've ever heard one)

Which is a mistake, and this shows why. Javascript should be default-off everywhere, and then if there's a Tor site you trust (oxymoron if I've ever heard one) then you enable Javascript.