The web isn't a solution to this problem. Drive by attacks are real and easy to place via malicious ads.

The only real "fix" to this situation would be to make software vendors actually liable for the correct functionality of their product. Imagine no more warranty disclaimers or other bullshit in the licenses for "final" products (compiled binaries, executable JS in websites...). All other engineering professions are legally held to their respective standards. It's time we start raising that bar for software as well.

I'd like to see some software company execs soil their pants because they know that their products are lousy crap.