Kinda funny that he didn't mention the extension at all though.

<script type="text/javascript">alert("remember when scripting attacks worked?");</script>