[ajxs]

Unfortunately keeping modern software secure is a full-time job. Internet browsers are just one giant attack surface. This is especially complicated by the speed at which the implementation of new features is required to keep a general audience interested. Unfortunately, a user like my mother wouldn't care how ideologically well-meaning a browser was if she couldn't use it for watching online media. I recently went looking for a lightweight browser for an older linux box, and it was hard to find anything that didn't either bundle Chromium or just forego having Javascript at all. Keeping up with modern web standards is pretty much an impossible job for a team of hobby developers on the basis of features alone ( WebGL, WebAssembly, DRM etc ), let alone security.

[antisthenes]

> This is especially complicated by the speed at which the implementation of new features is required to keep a general audience interested.

That may have been true 10 years ago, but now the feature set is so rich, that any new ones are really solutions in search of a problem rather than an actual user need. The average customer is pretty much using what Google dictates to get to the internet (used to be MS)

Nothing would change if the current feature set were kept constant

(except lots of HN's would be out of a job and Google might struggle to find new ways to show their ads)

[JoshTriplett]

> any new ones are really solutions in search of a problem rather than an actual user need

Not at all. App platforms aren't standing still, and one of the goals of web browsers is to make them as capable as app platforms while retaining the safety of the web sandbox.

That includes things like VR/AR, WebAssembly and extensions to it, Progressive Web Apps (PWAs), adjusting pages to match the system theming, better video formats, better authentication (Web Authentication), and a hundred other things people actually want.

[ajxs]

I'm very sympathetic to your overall sentiment regarding utility of many of the new features. My point remains however, that even addressing the current feature set is monumental enough of a task. The Javascript standard has become complex enough to implement and maintain from a functionality point of view, let alone keeping it secure.