Hi, I have been observing the ongoing struggle for the past while about web security and how to keep malware off user systems and to enhance user privacy. After seeing Mozilla implement 'Click to play' (which still is in infancy, but needs a lot of changes including potentially being able to set your own plugin update check server for enterprise environments) I concerns about this 'Plugins are dangerous' perspective: While out-dated plugins are indeed often a security threat, there is no denying this, I believe there is far too much focus on plugin security and not enough 'get back to basics' security — that being within the Firefox suite itself. Consider: With "Apps" becoming increasingly prevalent with Javascript becoming more and more powerful to permit these apps to operate much like their desktop counterparts, what is Mozilla doing to improve and refine control over the Javascript engine? With most browsers, javascript engines have access to various system variables that can be transmitted via callbacks, lists of fonts installed, OS in use, and so forth. A user can't effectively disable or remove these variables from the javascript environment without running an advanced setup. A data miner can easily bypass the user's preference on cookie opt-out and still use these variables to create a personally identifying ID of a user. For all you know some javascript callback could be transmitting information about your mouse movements, how you scroll the page and so forth silently without knowing. The often touted solution to these kinds of scenarios is "Disable javascript". That is often a non-solution considering most websites require some form of it these days. It's a suggestion akin to on a computer operating system: "Disable all C-compiled programs" to solve malware problems. It does the job but renders the system unusable. The actual solution is to cracking open the black-box javascript engine (Yes, you can see the source code of the JS engine, but it's not effectively touchable while in execution) to provide more accountability and to block aspects of javascript on sites at will. Many web developers will protest this "I want to control my users' experience to provide them what I want them to see", but ultimately it needs to be done in the name of security and bringing control back to where it should belong: the user.