@hamish Re: Offsite scripts GAH!
I think you bring up a good point.
Someone builds a web page for a site and then includes a bunch of JS modules that call outside the organization... like calls to FB, Google, etc ... or they see a neat widget and its easier / faster to just implement it with no thought to security.
That said. Many sites, including this one... call google,analytics and google tag services.
Why? Surely El Reg can do their own site analytics...
I have to ask why EL Reg does this along with every other major site.
And people wonder why Google will always have better analytics and indexing than their competition.
Now if only someone in Congress or the EU who deals with anti-trust lawsuits gets a clue ...
I'd post this anon, but FFS, this should be common sense. Yet no reporter ever writes about this. *cough* *cough* (FREE CLUE HERE EL REG!)