Douglas Crockford: reset HTML5, cut the whizzbang, and tackle XSS first.

he's right on the nail. Security should always be first.

We shouldn't pile garbage on top of garbage. Or sweep security holes under the rug. they will come back and bite.

False dichotomy. There's no reason different people can't tackle both at the same time.

+1