What principle states sites should be secure?
There is hardly even a nod to security, no defense in depth, and no cryptographic protections. There is widespread loading of untrusted unvetted code. The operating principle of the web seems to be, "it's okay to do this, everyone else is."
