The security needs to be in the browser - as in the user needs to enforce the security, not the code - leaving it up to developers to specify what permissions things should have is a recipe for lazy developers getting us into a situation much like the one we're in now.
I agree! Improve the BROWSER security model. Javascript is an innocent bystander in the mess.
It's the browser that allows 20 scripts from different domains all come together in the same execution context each with full permission to do anything.
The decision to combine 20 <script> sources into the same execution context is the BROWSERS decision. NOT javascripts.
It's the BROWSER that doesn't have any concept of allowing <script> fine grained permissions within the execution context, or specifying you'd prefer if the browser put that script in a separate execution context.
