Feeds

Stallman warns open-sourcers on Javascript-browser trap

Seductive charm of AJAX

Choosing a cloud hosting partner with confidence

Free-software activist Richard Stallman has warned the open-source community against falling into the trap of downloading Javascript code that's not "free".

Stallman said the spread of AJAX-based web services like Google Docs means you many be running Javascript code on your machine that's not free without realizing it. He pointed to Google Docs that downloads a half-megabyte Javascript program to your machine as an example.

"Even in the free software community most users are not aware of this issue; the browsers' silence tends to conceal it," Stallman has written.

The warning echoes a similar call by Stallman in 2004 to beware of inadvertently downloading Sun Microsystems’ Java, before Java was open-sourced.

Stallman, who formulated the Gnu General Public License (GPL) and founded the Free Software Foundation (FSF), has proposed a system whereby browsers would identify "non-trivial" Javascript code that's not free and then allow the browser to run a modified version of the code instead of the original.

For Stallman, the crux of the issue is what counts as "free". Echoing his GPL, Stallman would like to see Javascript code for web services distributed with its original source code, which can then be modified by the end user.

The problem for Stallman is that while free browsers - Internet Explorer, Firefox, Opera, and Chrome - warn the user about the presence of "non-trivial" Javascript code - such as a banner ad - and can disable it, they don't alert the user to the presence of hidden Javascript in web services.

Stallman has proposed a plan of action. First is to define what's meant as a "non-trivial" Javascript program, which he thinks should be something that: "Defines methods and either loads an external script or is loaded as one, or if it makes an AJAX request."

Then, the browsers themselves need to change to let users detect such code and specify which Javascript code they'd like to run - the original or a modified form. He also recommended wording of a license for applications that authors are willing to let users modify.

"We will be able to reject and even replace the non-free, non-trivial Javascript programs, just as we reject and replace non-free packages that are offered for installation in the usual way," Stallman said.

On a related note, Stallman has challenged Adobe Systems' Flash and Microsoft's Silverlight, and suggested that the open-source Moonlight implementation of Silverlight goes against his notion of free. Stallman called Flash an "extended variant" of Javascript, although further study is needed.

Stallman criticized Silverlight for distributing non-free codecs and - by implication - the Novell-backed Moonlight, which is also licensed to use those codecs. The media codecs are closed, and have been licensed by Microsoft over the years from the media industry to play audio and video on Windows. Microsoft has extended the codec patent licensing to Moonlight.

"A free replacement for Silverlight would hardly be of use in the free world without free replacement codecs," Stallman said. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
HTML5 vs native: Harry Coder and the mudblood mobile app princes
Developers just want their ideas to generate money
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.