I do infosec for a living. I can say with 100% certainty that the good guys are in a constant state of playing catch-up with the bad guys. The only thing we can hope for is to minimize the amount of time that serious vulnerabilities remain exposed, in hopes that it's fixed before someone creates yet another point-and-crack tool for the skiddies.
The problem is that modern web apps are riddled with places that need enough dynamicism that blunt filtering won't work.
http://people.mozilla.org/~bsterne/content-security-policy/d...
My real concern is, despite the fact that developers have the ability to set policies about what regions on the page can contain dynamic content, "policy" is generally too brittle to describe what people need to put on pages in real-world apps.
