An excellent note published on The Spanner's blog called iframes are evil . The basic idea is this: since iframes are a big risk for Internet security, but excluding them is not possible - do something ala
<html security = "iframe">
for pages using these same iframes.
IMHO, a great idea, but you should do just the opposite. disableiframe :)