<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="metricconverter"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.Stylwiadomocie-mail17
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=PL link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>The primary purpose of
HTML is presentation, not scripting. You can have a user agent that does
not support scripting at all, or that does not support scripting in your script
of choice, but other elements of your presentation should be rendered, whatever
that means, and make sense without scripting. I cannot agree with
sticking the tag “Future of HTML” onto scripting security research.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>Everything is executable
in JavaScript, e.g. the expression “<st1:metricconverter ProductID="0”"
w:st="on">0”</st1:metricconverter> returns 0 when you execute it,
therefore not executable means inaccessible. The duality of data and code
is a characteristic of high level languages and it is generally considered a
good thing because it makes reflection possible. I admit that reflection
is not widely used in JavaScript, and most of such cases actually are a misuse;
nevertheless, IMHO, removing the data-code duality would be a big step
backwards. Which, needless to say, could be welcome to an industry, like Tinselton,
that prefers prosecuting and restricting to protecting and innovating; the WWW
industry hopefully does not belong to this genre.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>The execution protection
flag makes sense in machine code where the duality cannot be readily seen,
especially in compiled code where the compiler has moved and transformed much
of the original code to better match the target architecture, which is
beneficial both to the programmer and to the end user; however, even in such an
environment it is used sparingly and often limited to core system services because
it is incompatible with trampolines and closures, at least the way they are
implemented by most compilers. It cannot be viewed as the universal
remedy and it should not be applied to interactive elements.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>The suggestion that
JavaScript code should be rendered is ridiculous; it reminds me of MacWeb,
R.I.P. But, as an afterthought, perhaps it could enforce a better coding
style to Web developers? Sort of “Do not execute it because it is
unpretty?” Just kidding…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>And if you disable inline
script code, the authors will be forced to use the data URL scheme instead,
which is cumbersome and buys you almost nothing, except that you can use the token
-- in the script. Is that what you want?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>The DOM tree does not
contain any code, so separating DOM code elements and attributes is void.
Please explain what you really want and give us an example scenario of how it
would work and how it would help, along the line “This document could be
used to steal your credit card number because…; my idea would prevent it
because… while everything else will work as expected because…”.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>Cheers,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>Chris<o:p></o:p></span></font></p>
</div>
</body>
</html>