Yes, I was talking about the risk from the perspective of the including page. From the perspective of the risk to remote it makes even less sense from the 90ies point of view. Data isn't supposed to be in javascript anyway, it should be in XML. It's again on you (the remote) if you expose your secrets in the javascript that is dynamically generated per user.

With a hindsight from this year -- of course you have a point.

Ahh, the data-in-XML argument is indeed very convincing from a historic perspective.

XHR is called xmlthttprequest for a reason, but that was added in 2000ies I think. SOAP was late 90ies, but I don't think you can call it from browser. There was no reason to have data in javascript before DOM and XHR which were late additions. All the stuff was in the page itself rendered by server and you don't get that across the domain boundary.

> 2000ies

Now this is interesting. I've seen a lot of "40ties", "90ies", etc around, and I'm not sure why people do that. But once you've done it, it's clear how to read the text. Most of the non-numeric suffix is redundant; people mean "forties", not "forty-ties".

But "2000ies" has no potential redundancy and no plausible pronunciation. It's spelled as if you're supposed to pronounce it "two thousandies", but there's no such thing as a thousandy.

I enjoyed your analysis.

I think people should really just be putting 's on the end, then it works for all:

40's, 50's, 2000's.

The apostrophe is unecesary, but IMO without it it looks like the 's' is a standard unit of measurement:

40s, 50s, 2000s

twothousandies and twenty-zeroes makes sense

The point being, presumably, the page author explicitly chose to include a cross-domain script

The script author however didn't. CORS is more about the remote giving consent to exfiltrate the data than it is about preventing injecting the data into it. You can always reject the data coming in