That's quite interesting.

I think people will probably hear that and think poorly of today's more permissive JS, but it's worth mentioning that there wasn't much of a browser security model at that time. Browsers/pages weren't sandboxed, and there was no concept of "Allow site to do X?" like we have now.

This lead to some iffy things with even early JS, such as allowing sites to set the user's homepage just by clicking a link.