Question

The ADsafe subset of Javascript prohibits the use of certain things that are not safe for guest code to have access to, such as eval, window, this, with, and so on.

For some reason, it also prohibits the Date object and Math.random:

Date and Math.random

Access to these sources of non-determinism is restricted in order to make it easier to determine how widgets behave.

I still don’t understand how using Date or Math.random will accomodate malevolence.

Can you come up with a code example where using either Date or Math.random is necessary to do something evil?

Answer 1

According to a slideshow posted by Douglas Crockford:

ADsafe does not allow access to Date or random

This is to allow human evaluation of ad content with confidence that
behavior will not change in the future. This is for ad quality and
contractual compliance, not for security.