Part of the problem, I think, is that Javascript programs aren't run the same way other programs are. They are silently downloaded and executed seamlessly, which means there isn't a conscious choice by users to run them. Many users don't even know it's there.

The only acceptable solution is for web browsers to not execute Javascript this way. The browsers need to ask users for every Javascript file, offering to show the source first, and then "install" each script that is accepted locally. This should be by individual script, not by domain like NoScript. If the script changes, the browser should ask again about it, not silently assume that the user accepts it just because a previous version of the same script was accepted.

Reply via email to