There is no differentiation between 'trusted' and 'untrusted', which I think was the point that the presentation was making.
trusted: I wrote it / looked over the source code
untrusted: I pasted some <script src=http://gonnaHackU.com/blah.js>; into my page.
Including <script> tags from external entities is always a potential security risk. And it's always better to do it serverside if at all possible.
Please, somebody think of the users!
There are obvious technical solutions to this, but people seem unwilling to acknowledge that they might even be necessary.
IE7 executes expression() when used in css (inline/style/external css file), but not when you set css from js. Also cannot make it execute url('javascript:
(Safari/Firefox/Opera/Chrome execute none of the above).
Many of the arguments are just arguments of why you don't include arbitrary untrusted javascript in your page. Many of the use cases of including external scripts in a page could be done exactly the same server-side, which would make them far more secure. But, it's extra work for websites to do that, so they often don't.
>> background-image: url('javascript:window.alert(1)')
Some browser seriously executes that js? I have not seen that work anywhere. (Just tested safari, firefox).
Perhaps a better answer would be to have browsers show you a small warning if the website is including js code from external sites, however, it's so common now that most websites would flag up. But it might cause people to rethink things a bit.
(Also as others say, the issues are not with the language javascript, but in the way it is used in browsers. Killing js wouldn't solve anything if you don't address the issues in the browsers).