I think JavaScript should have to request access to use browser APIs, and you should be able to disable access to any of all of them. For example, I should be about to disable:
- network access (disables adding script tags, XMLHttpRequest, fetch) - 2d canvas access - 3d canvas access - WASM
And so on, just like mobile apps, but perhaps more granular. The app should also be able to put a note as to why it needs each specific feature.
99% of my web browsing shouldn’t need it. Every site I visit uses it, but almost all of them could be built just fine without it.
There are downsides to everything, but we cant dismiss that positives that came from it.
Yes, it’s great that the web is capable of stuff like Google Docs. But all those capabilities are actually liabilities when it’s a news site.