I've been quite disappointed by the preamble of their paper  which calls IE8's XSS filter a new type of defense and a somewhat novel approach (before bashing it)  when we all know that NoScript came first