For over ten years attacks have been possible through the loopholes offered by the browser. A text that is benign in one content might be dangerous in another, third-party scripts can be embedded into URLs.

 Web developers are blamed for this "But it's not their fault it's the system," says Crockford. What went wrong? JavaScript's Global Object is the root cause of Cross-Site Scripting (XSS) attacks, Crockford explains.

The Document Object Model (DOM) is the next problem. And the misuse of cookies as tokens of authority is a third.

"If the Web's been screwed up right from the beginning, why should we be worried about it now?" Crockford asks rhetorically.

One reasons is mashups, which Crockford calls "the most interesting innovation in software development for 20 years."

He then proposed a 3-prong strategy to fix the Web.

1. safe JavaScript subsets

2. small browser improvements

3. massive browser improvements

We need to replace JavaScript, Crockford insists.