On: Google hits undo on limiting JavaScript capabilities in cross-origin iframes

[gregoriol]

The security issues with alert is not about getting access to the OS, but having a third-party (cross-origin iframe) display a message to the user, when the user doesn't know that the message is not from the site they are visiting.

[asddubs → gregoriol]

they say they want to get rid of first party alert as well though, and don't offer any sort of opt-out for trusted iframes

[feikname → asddubs]

They also could very well improve the cross-origin alerts to say "This message is from ANOTHER website embedded in this tab, please act carefully. (source: xxx.com)" instead of outright removing it.