"At Yahoo, we call it Progressive Layered Enhancement."

PLE! We have our catchy acronym :).

Good point about the security implications. That must be an integral part of any web application design methodology. For traditional kinds of desktop applications, that wasn't so much of a concern.

In my day job, we have a Java back end with a lot of user interaction implemented with Javascript in the browser. Data access server side stuff actually plays to a lot of Java's strengths, I think, and the more dynamic nature of Javascript is a good fit for DOM manipulation in the browser. I'm not sure I would want to pick one of them to run both places.