Feeds

Stallman warns open-sourcers on Javascript-browser trap

Seductive charm of AJAX

Securing Web Applications Made Simple and Scalable

Free-software activist Richard Stallman has warned the open-source community against falling into the trap of downloading Javascript code that's not "free".

Stallman said the spread of AJAX-based web services like Google Docs means you many be running Javascript code on your machine that's not free without realizing it. He pointed to Google Docs that downloads a half-megabyte Javascript program to your machine as an example.

"Even in the free software community most users are not aware of this issue; the browsers' silence tends to conceal it," Stallman has written.

The warning echoes a similar call by Stallman in 2004 to beware of inadvertently downloading Sun Microsystems’ Java, before Java was open-sourced.

Stallman, who formulated the Gnu General Public License (GPL) and founded the Free Software Foundation (FSF), has proposed a system whereby browsers would identify "non-trivial" Javascript code that's not free and then allow the browser to run a modified version of the code instead of the original.

For Stallman, the crux of the issue is what counts as "free". Echoing his GPL, Stallman would like to see Javascript code for web services distributed with its original source code, which can then be modified by the end user.

The problem for Stallman is that while free browsers - Internet Explorer, Firefox, Opera, and Chrome - warn the user about the presence of "non-trivial" Javascript code - such as a banner ad - and can disable it, they don't alert the user to the presence of hidden Javascript in web services.

Stallman has proposed a plan of action. First is to define what's meant as a "non-trivial" Javascript program, which he thinks should be something that: "Defines methods and either loads an external script or is loaded as one, or if it makes an AJAX request."

Then, the browsers themselves need to change to let users detect such code and specify which Javascript code they'd like to run - the original or a modified form. He also recommended wording of a license for applications that authors are willing to let users modify.

"We will be able to reject and even replace the non-free, non-trivial Javascript programs, just as we reject and replace non-free packages that are offered for installation in the usual way," Stallman said.

On a related note, Stallman has challenged Adobe Systems' Flash and Microsoft's Silverlight, and suggested that the open-source Moonlight implementation of Silverlight goes against his notion of free. Stallman called Flash an "extended variant" of Javascript, although further study is needed.

Stallman criticized Silverlight for distributing non-free codecs and - by implication - the Novell-backed Moonlight, which is also licensed to use those codecs. The media codecs are closed, and have been licensed by Microsoft over the years from the media industry to play audio and video on Windows. Microsoft has extended the codec patent licensing to Moonlight.

"A free replacement for Silverlight would hardly be of use in the free world without free replacement codecs," Stallman said. ®

Bridging the IT gap between rising business demands and ageing tools

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.