As a web browser has become a general purpose VM, it has capabilities far surpassing what is needed at least 50% the time, I'd go as high as 90% of the time personally. Which is great that we have a magical run anything anywhere VM, but it's a double edge sword of the performance, security and privacy issues that come along with it.

If there was a well defined subset of functionality that browsers presented as the default "web enclave" and then opening up all the bells and whistles further was an opt in choice, a large chunk of those issues would go away. But that requires a bunch of people to agree on what that subset should include and the horror of trying to keep it updated over time. And that's _everyone_, including users putting up with "opting in" rather than everything just working.

I'm not sure I can see a subset of features becoming the default approach, at least until there is some horrible self propagating browser worm that impacts a large percentage of the world (or maybe by the 2nd or 3rd time, we will have had enough).

What about buying a ticket and it failing at the last step because your browser determined that js was unneeded?