This essentially aimed at the developpers: Anyone who browsed with noscript, or used ghostery, knows the web is full of javascript. These are often downloaded from separate websites.(for no apparent reason, they can easily be hosted locally) This is a bad thing: * Accessing these gives the the http-referrer(presumably) so it indicates someone where you are browsing.(though other resources do this too) * Javascript is nowhere as secure as html in terms of potential weaknesses. * Javascript is -plainly- designed to have access to the web page, or the current url. * These are often accessed via http, it could be spoofed to return a different * The servers it came from can outright change it at any point, and the user has little control, even if the javascript source code unobfuscated, there is no time to do so as it is in the hands of the users immediately. For this reason i suggest implementing a library(package system) for these javascripts, of which the packages are signed, and the user controls when they are updated. It should be easy to use and add these libraries for developpers, preferably, additional people can attest they read the source code and approve of it. Well, to be honest, i cannot really suggest entirely how to do it, i just dont know enough. And it has to be entirely transparent to users, at least. Some kind system that detects that people have checked the source code, and/or a default time duration.(depending on the package) Of course this has to be coordinated with other browsers/standards creation. This sounds hard and it seems like you're already doing a really good job at it.(And at developping FF in general)