Feeds

Stallman warns open-sourcers on Javascript-browser trap

Seductive charm of AJAX

The Power of One Brief: Top reasons to choose HP BladeSystem

Free-software activist Richard Stallman has warned the open-source community against falling into the trap of downloading Javascript code that's not "free".

Stallman said the spread of AJAX-based web services like Google Docs means you many be running Javascript code on your machine that's not free without realizing it. He pointed to Google Docs that downloads a half-megabyte Javascript program to your machine as an example.

"Even in the free software community most users are not aware of this issue; the browsers' silence tends to conceal it," Stallman has written.

The warning echoes a similar call by Stallman in 2004 to beware of inadvertently downloading Sun Microsystems’ Java, before Java was open-sourced.

Stallman, who formulated the Gnu General Public License (GPL) and founded the Free Software Foundation (FSF), has proposed a system whereby browsers would identify "non-trivial" Javascript code that's not free and then allow the browser to run a modified version of the code instead of the original.

For Stallman, the crux of the issue is what counts as "free". Echoing his GPL, Stallman would like to see Javascript code for web services distributed with its original source code, which can then be modified by the end user.

The problem for Stallman is that while free browsers - Internet Explorer, Firefox, Opera, and Chrome - warn the user about the presence of "non-trivial" Javascript code - such as a banner ad - and can disable it, they don't alert the user to the presence of hidden Javascript in web services.

Stallman has proposed a plan of action. First is to define what's meant as a "non-trivial" Javascript program, which he thinks should be something that: "Defines methods and either loads an external script or is loaded as one, or if it makes an AJAX request."

Then, the browsers themselves need to change to let users detect such code and specify which Javascript code they'd like to run - the original or a modified form. He also recommended wording of a license for applications that authors are willing to let users modify.

"We will be able to reject and even replace the non-free, non-trivial Javascript programs, just as we reject and replace non-free packages that are offered for installation in the usual way," Stallman said.

On a related note, Stallman has challenged Adobe Systems' Flash and Microsoft's Silverlight, and suggested that the open-source Moonlight implementation of Silverlight goes against his notion of free. Stallman called Flash an "extended variant" of Javascript, although further study is needed.

Stallman criticized Silverlight for distributing non-free codecs and - by implication - the Novell-backed Moonlight, which is also licensed to use those codecs. The media codecs are closed, and have been licensed by Microsoft over the years from the media industry to play audio and video on Windows. Microsoft has extended the codec patent licensing to Moonlight.

"A free replacement for Silverlight would hardly be of use in the free world without free replacement codecs," Stallman said. ®

Securing Web Applications Made Simple and Scalable

More from The Register

next story
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Captain Kirk sets phaser to SLAUGHTER after trying new Facebook app
William Shatner less-than-impressed by Zuck's celebrity-only app
Do YOU work at Microsoft? Um. Are you SURE about that?
Nokia and marketing types first to get the bullet, says report
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.