who's that guy?

>But, most sites don't protect against CJ at all.

This is definitely truth. Sad truth.

>Of the sites that do, as many use XFO (the HTTP Header that denies reframing) as use JS framebusters.

do you have statistics or something? Because I am not sure about this. IMHO, for now, framebreakers are more popular. XFO is still for well educated developers, framebreakers are old-school.

> But that's a red herring in this case; what browser supports H5 Sandboxes but not XFO?

I believe all do support.

> rendering them on a page without losing control of Javascript

can you elaborate this please? Because most people say 'something bad with JS'. SOmething what? What exactly bad is going to happen, besides prompt(1)?

> CJ is an inherently less scary problem than XSS

obviously, but XSS is unrelated threat here (or i missed something)

> Oughtn't we just encourage everyone to set XFO, instead?

I agree with you. NOW there is no way back, but 3 years ago people should have been more careful about security compatibility, IMO