my argument is that there should be no need for the average user to install noscript to prevent injection from third party &quot;secure&quot; domains. the default should be to deny loading them in the first place.<p>there should be a &quot;yesscript&quot; for those who want to assume the risk.