Today, anyone trying to advise a web site
owner on security has to balance elements
within the site owner's control — fonts,
domain names, sources of content,
validation of user input, for example —
against extrinsic elements the site owner
can't touch. The latter include user
operating systems and software, the
security of remote sites supplying content
and homologue internationalised domain
names. Plus, there are all those tricky details
of interactions between tags, and
everywhere — in all software — bugs.