Your definition of common sense is not really common. Flash, for example, was one of the very early use cases of an ActiveX control. This unsafe technology was supported by Internet Explorer until the end. The IE11 engine is still an installable part of Windows 11. Netscape Navigator plug-ins also were binary code modules. NPAPI was supported by Google Chrome until 2015.

There were warnings from the beginning (both with ActiveX and NPAPI), but for most engineers, getting things done took precedence over trust issues. Youtube, for example, would not have been possible until much later without Flash.

In Windows-land and seldom elsewhere, it was more like "don't run random executables and don't open attachments and ask a sysadmin about the site/flash page/applet you're about to visit". I dare you to ask your grandma what is a .vbs file, without googling...

> At one time people still had the common sense not to run code they wasn't vetted and that they trusted.

At one time? When? People have been executing arbitrary and malicious code since the moment they could share it between two computers.

It was not really common sense. Most people ran all sorts of random codes. If they didn’t, it was because they didn’t know how to get online to find all the good viruses.

But, it was easier to avoid this common error before every site depended on it.

We no longer live in the era where the only people who use hardware that runs executables are philosopher kings with the capability of vetting them by looking at the code.

When was that time? Was it before open source was invented? Or was it when viruses were running rampantly?

We both know that, but then came the users that opened CoolPic.jpeg.exe and installed wallpaper packages from .ru domains.

I honestly can't see a much better compromise than JS to include the common users.

You run random executables via RPC when you use the web anyway, and that code runs on the server.

The problem with JS in browser has been security, specifically cross origin not that JS is code