XSS: scripting. That's your problem. There's your issue. Treat the WWW like pages. Quit doing all that scripting. I don't want to run someone else's programs by merely visiting a page. It's in violation of what #www originally was for.