Browsing and javascript

> first, it is executed in your webbrowser, which puts it in a sandbox. That
> means that the webbrowser limits what javascript can actually do, and if your
> webbrowser is free software, everybody can check if it is really doing a
> proper job.

Security is not the same as user freedom. They are both important, but
treating them as though they are the same will lead to incorrect
conclusions.

> Second, most javascript code that you find on smaller websites is visible in
> your console, that means everybody can read what it's doing and in principle,
> every user can find harmful features and inform others about it.

That's not source code. Source code is the preferred form for modifying
the program, the same unmodified code that the author uses when they
write or edit the program. Most JavaScript is minified and looks far
different from what the author has, and can require reverse engineering
skills to read.

If that's source code, then a ready-to-run binary, assembled from
Assembly language, qualifies as source code, even though binaries lack
comments and variable names.

> However, it's true that bigger websites which rely more on javascript mostly
> minify and uglify their code, so you get a compressed and non-human-readable
> version.

When you process source code, it's no longer source code.

> My personal opinion is that the fuss about non-free javascript is way, way
> too big and exaggerated.

It literally gave my machine a kernel panic. You think that's not a big
deal?

JavaScript also prevents users from doing basic tings on their
computers, like highlighting text with their cursor while reading an
article. A message popped up and told me "You can't do that!"

We're not even talking about copying the text. We're just talking about
selecting it with the cursor! And if you turn JavaScript off, the whole
article is generated/pulled in with JavaScript and is not present in the
page source at all, so you can't read any of it.

That's not a world I want to live in, with DRM on simple web articles.

> Besides, javascript applications are most of the time deeply connected with
> the layout of the webpage and the server as a backend api.

So? That JavaScript is a client to their server software, and it should
be free software if it's going to run on my computer.

> Writing a modified version of the
> javaschttps://www.youtube.com/watch?v=igDGkpTHuhkript of a website and
> sharing it with your friends? Maybe but difficult and mostly unneccesary.

It is very necessary. People modify JavaScript all the time to improve
user's lives. Look at Reddit Enhancement Suite.

> Writing a modified version of the javascript code of a website and realising
> a modified version?
> In most cases, that makes no sense since the website might change any day,
> making your code useless.

What do you think youtube-dl does all the time? And yet people still
benefit greatly from their work. Do you think youtube-dl should be shut
down?

> Again, big single-page-webapps which are running soley on the client are a
> different story.

Those are even worse. Those especially should be free software or
avoided at all costs. Google Drive is the new Microsoft Office.

--
Caleb Herbert
OpenPGP public key: http://bluehome.net/csh/pubkey

A minor correction also: The practice of distributing any JavaScript
requires a license notice as described by the license text.

For example, in the case of Modified BSD License (3-clause BSD), "MIT
License" (Expat License or sometimes X11 License), the license text
itself says one has to use the full license text as its notice.

I have made a quick comparison on the length of the license notices (not
the topmost part, which is the copyright notice) and so far the latest
versions of {AGP,GP,FD}L are better both in terms of license notice and
in terms of end-user protection.

2017-11-24T15:19:09-0600 Caleb Herbert wrote:
>
> JavaScript is how a lot of people lose protection on Tor.
>
> Personally, JavaScript programs have put me in the following situations:
>
> * unable to highlight text in article with cursor
> * unable to copy text in article with Ctrl+C
> * pop-ups
> * fan acceleration
> * kernel panic (I'm looking at you, Twitch!)
>
>
> I do most the time.
>
>
> Even if I can assume a JavaScript program is not malicious, I still
> refuse to run it because it is proprietary software. My only exceptions
> are free JavaScript, job applications, and Reddit.
>
> Also, if I just installed a new system and haven't bothered setting up
> AVideo (youtube-dl without DRM or background JS execution) I will
> temporarily use YouTube's proprietary embedded player if I'm certain the
> video won't be blocked by DRM when I go to download it with AVideo.
>
> More info about AVideo: https://notabug.org/GPast/avideo
>
>
> LibreJS is pretty neat. It tries to automatically detect if the scripts
> embedded in a page are under a free license.
>
> Unfortunately, this only works on a tiny amount of sites, and even GNU
> projects like GNU Taler have issues getting their site to pass LibreJS.
>
> However, the practices required by LibreJS aren't just stupid
> requirements of LibreJS. They're actually probably the only way you
> could legally distribute embedded JavaScript if it is under the GNU
> General Public License.
>
> In addition, it's really the only polite thing to do. Everything else
> on a website has copyright information at the bottom of the page, so why
> do people just neglect the copyright information on embedded scripts?
> It's only logical that there is a page on the site disclosing ALL
> copyright info to readers, incl. copyright on scripts.
>
> People may hate LibreJS because it does not work at all and probably
> never will, but everyone should be telling site owners to be transparent
> about the copyright information of the programs embedded in their pages.
> Composing an email to ask about copyright is a lot more work than just
> going to the bottom of the page to see copyright notices.
>
>
> Yes. It prevents crashing from heavy web apps, and it limits what
> Facebook and other malicious sites can do when you type stuff in their
> forms. (They can't use JS to log keystrokes you never publish.)
>

--
- https://libreplanet.org/wiki/User:Adfeno
- Palestrante e consultor sobre /software/ livre (não confundir com
gratis).
- "WhatsApp"? Ele não é livre. Por favor, veja formas de se comunicar
instantaneamente comigo no endereço abaixo.
- Contato: https://libreplanet.org/wiki/User:Adfeno#vCard
- Arquivos comuns aceitos (apenas sem DRM): Corel Draw, Microsoft
Office, MP3, MP4, WMA, WMV.
- Arquivos comuns aceitos e enviados: CSV, GNU Dia, GNU Emacs Org, GNU
GIMP, Inkscape SVG, JPG, LibreOffice (padrão ODF), OGG, OPUS, PDF
(apenas sem DRM), PNG, TXT, WEBM.

> > They're actually probably the only way you
> > could legally distribute embedded JavaScript if it is under > the GNU
> > General Public License.
>
> Onpon4 makes some good points on this here:
> https://onpon4.github.io/other/kill-js/

I agree with much of her article, but I think LibreJS still has a place.

Basically, people need to start working on extensions to operate
websites with the extension's JavaScript and not the site's JS, and
LibreJS can be used in emergencies when an extension hasn't been found.
The system's package manager (Guix) can manage extensions in the back
end.

The LibreJS standard, as I mentioned before, is mostly important to
HUMANS: so regular people can look at the copyright info and go "oh, ok,
looks good. I'll run those."

--
Caleb Herbert
OpenPGP public key: http://bluehome.net/csh/pubkey