My concern was that he made the security/privacy worse than it needed to be, for other people, by including Google Analytics on the page.
He has now stated that he's seen that the room name is in fact being leaked to Google Analytics, and so has removed it. But even if he hadn't seen this, you still shouldn't include any third party hosted scripts on pages like these because you've no idea if/when they'll change in a manner which compromises security/privacy in future. No malicious intent required.
Of course we can circumvent that. Make a plugin to alert the user whenever the JS changes.
Open source already does this for binaries. Why not JS?
This assumes it's even possible to get a consistent hash of all javascript executing on a page, though.
The day-to-day UX experience of browsing the web is only minimally affected and significantly safer.
Better than adblock.
If your concern is the host operator, well obv can't circumvent that. Unless you use OSS chrome plugins and client code verifications (ala CryptoCat). But that's also an imperfect solution (cue tptacek).
[1] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...