The DOM and 3rd party javascript - still insecure
pooloferrors.com