[IPython-dev] Some Thoughts on Notebook Security

[Carl Smith]

Just read back what I'd posted and needed to add: This would not
prevent XSRF attacks in general. You'd still need to check referrers
and so on. It would only prevent the Notebook being used to circumvent
those protections with XSS.

The main point is that we gain nothing by trying to cripple and
sanitise JavaScript in notebooks. I think??