The difference, of course, is that Crockford should understand that things are a little more complicated than that, but the ideas that he thinks are good enough to announce to the world are no better than the ideas a 5-year old has before breakfast. “No more iframes! No more document.write!” he declares, blissfully unaware that his employer’s home page uses both. “Strict entity parsing!” he demands… in a page with unescaped ampersands. “UTF-8 is the One True Encoding!” he proclaims boldly… in a page that declares itself as ISO-8859-1. “No more javascript: URLs! In fact, let’s replace Javascript altogether! And I’ll be back to talk about CSS!” It just goes on and on, the awesomeness gradually swelling until it all folds back on itself like a Möbius strip of self-parody. It’s the Bolero of trolls. Everything he claims is secure isn’t, and everything he claims would increase security wouldn’t. Everything he wants to add to HTML would make it worse, and everything he wants to remove would also make it worse. Please, please tell me he’s shooting the moon to make the worst proposal ever. It just doesn’t make sense any other way, at least not from anyone older than 5.
The Bolero of trolls [dive into mark]
The Fixing HTML page itself.