The way we got here is interesting. In 1995, if you'd wanted to implement one of today's websites, you might have written a Tcl/Tk script that users could down

The way we got here is interesting. In 1995, if you'd wanted to implement one of today's websites, you might have written a Tcl/Tk script that users could download and run. Tk solved pretty well all the problems people are talking about here in the 90s; it even had a safe mode for running untrusted scripts. But users in the 90s would have regarded as crazy any suggestion that they download and run random Tcl scripts from every site they visited! Lots of them turned off the early versions of Javascript, which couldn't do much apart from formatting tweaks. Is the killer feature of CSS and Javascript simply that they undermined the frog's security assumptions so gradually that it stayed in the pot until it boiled?