I agree generally, although Subresource Integrity[0] and Content Security Policy[1] somewhat solve the problem. Not that any of this will ever be deployed[2], because they&#x27;re two of the most invasive defence measures and fragile wrt updates.<p>[0] <a href="https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;SRI&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;SRI&#x2F;</a><p>[1] <a href="https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;content-security-policy-an-introduction&#x2F;" rel="nofollow">https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;content-security-policy-an-introduc...</a><p>[2] <a href="https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;how-widely-used-are-security-based-http-response-headers&#x2F;" rel="nofollow">https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;how-widely-used-are-security-based-...</a>