[paulddraper]

XSS is usually really, really bad anyway.

CSP plus trusted scripts...you should be working hard to prevent XSS.

[earthboundkid]

Ideally, yes. In the current advertising market? No.

[paulddraper]

I don't know much about advertising.

Can't they be easily handled with an iframe?