It's a good writeup about the post-xss world and what kind of attacks are still exist.