@lizzie @fiore @djsumdog @kerosene Sure, but at least the most malicious JavaScript is typically loaded from external domains rather than the site one, which makes it easy to block.

By chance, the way JS is implemented allows you to replace one piece at a time with Haketilo, while with WASM I believe you just get one fat binary that you'd need to replace all a once.