If browser vendors really cared, they would disable javascript on non-https sites.