I tried once, but the whitelisting got too tedious; almost every website I interact with needs scripting. I've also never been hit with an XSS attack; similarly I haven't gotten a virus since a boot sector on a floppy 15 years ago. I haven't found the risks to be high.