I see what you mean regarding namespace collision, but if we always set a standard based on the lowest common denominator we'll end up being stuck with practice

I see what you mean regarding namespace collision, but if we always set a standard based on the lowest common denominator we'll end up being stuck with practices that were followed because there was no reason not to. As for the universal XSS, this can be solved at the browser and page level. First the gTLD as any other level should be explicitly declared in the script URL from the open page and second the browser blocks all the rest.