Richard Stallman Warns About Non-Free Web Apps

An anonymous reader writes "Richard Stallman has published an article which warns about the 'Javascript trap' posed by non-free AJAX-based applications. The article calls for a mechanism which would enable browsers to identify freely-licensed Javascript applications and run modified version thereof. 'It is possible to release a Javascript program as free software,' Stallman writes. 'But even if the program's source is available, there is no easy way to run your modified version instead of the original ... The effect is comparable to tivoization, although not quite so hard to overcome.'"

Comments

OK, dumb question after reading the article

[MillionthMonkey]

Why do I care if I visit a web site and "non-free" JavaScript runs in my browser?

Re:OK, dumb question after reading the article

[paroneayea]

Why do you care if non-free python, C, or whatever apps run on your computer? Code is code, and websites aren't what they used to be. The web has become a platform for client/server applications. So if you do care about free software on the desktop, it's reasonable that you should care about free software in your browser.

Re:OK, dumb question after reading the article

[jkrise]

Programmability is an important aspect of free software. The javascript trap effectively converts web applications into proprietary client-server type applications, Google's apps included. Which reduces the scope for innovation, standards and progress. Hence Stallman's warning.

Re:OK, dumb question after reading the article

[Timothy Brownawell]

Why do you care if non-free python, C, or whatever apps run on your computer?

Because it's generally harder to upgrade/maintain (not in the standard apt repositories), I can't fix it myself, and whoever controls it can just randomly disappear or EOL it.

So if you do care about free software on the desktop, it's reasonable that you should care about free software in your browser.

Except that all of those thing either don't apply to web apps at all, or apply to all web apps. There's nothing to install, upgrade, or fix locally, and you're dependent on some service provider regardless of the status of the code.

Re:OK, dumb question after reading the article

[LaughingCoder]

He also wants an easy way for every piece of client-side code a web page uses to be easily replaceable with your own local version from your own local disk.

That sounds to me like a massive security hole just waiting to be exploited. People navigate to their brokerage page or their online banking page thinking they are running the brokerage/bank software, not knowing some malware made illicit and modified copies of the Java on their hard drive which is run instead. Scary stuff.

Re:OK, dumb question after reading the article

[lwsimon]

This, of course, can be done now. The first think you learn when dealing with webapp security is that you can never trust the client.

Nothing is stopping me now from loading my own Javascript (or Java, or anything else that runs in the browser) on a bank's webpage.

Re:OK, dumb question after reading the article

[mea37]

The technical implciations are a bit more involved than "modify how the browser loads code".

Right now, a web develoepr can rely on the fact that every visitor to his site is getting an up-to-date copy of the client software. We can have an interesting philosophical debate about whether they should rely on this assumption, or a much more practical one about how many do rely on it.

So I make non-backward-compatible changes to my website, and you run your cached/modified version of the client. Some features don't work. Your browser behaves in ways my server no longer expects. Depending on whether I forsaw this occurance, maybe the effect is harmless (except you're out of luck until you revert to a new download, and then start making your chnages again); or maybe if I was particularly clumsy or just have lousy luck, you corrupt some resource on the server.

We can mitigate the worst problems "merely" by re-educating every web developer everywhere; but realistically we're calling for a client-server handshake so that the server can let the modified client know that it's out of sync (and/or revert to a backward-compatible mode if possible).

Personally I don't see customization of web apps as a pressing need (prior to this article I've never thought about trying it, so clearly it isn't that important to my daily life). So to me, it isn't worth the trouble. YMMV.

Re:OK, dumb question after reading the article

[CySurflex]

The problem with that logic is that Stallman missed a huge point. If, from his example you're using Google Docs, even if the JavaScript is "freed" using his new standard with stylized comments and the @source directive - you are still accessing non-free server software (the Google web servers) that responds to the AJAX requests. Not only that, but your browser is also making a call to the Google Ad server, which also has non-free software. You might also argue that its being served by a modified version of MySQL thats non-free, and perhaps even the firewall and the proxy that its passing through is a custom version written by Google Engineers (likely.)

Re:OK, dumb question after reading the article

[Estanislao Mart�nez]

The problem with that logic is that Stallman missed a huge point. If, from his example you're using Google Docs, even if the JavaScript is "freed" using his new standard with stylized comments and the @source directive - you are still accessing non-free server software (the Google web servers) that responds to the AJAX requests. Not only that, but your browser is also making a call to the Google Ad server, which also has non-free software. You might also argue that its being served by a modified version of MySQL thats non-free, and perhaps even the firewall and the proxy that its passing through is a custom version written by Google Engineers (likely.)

There are two problems I can perceive with your argument, though:

1. It is still potentially very useful to you to be able to modify the software that runs on your computer, and to share these modifications with other people. This is one of the major points of the GPL.
2. You're describing here a system with three kinds of compoments: (a) client software, (b) server software, (c) server data. It's much harder to argue that (b) should be free software, especially if it's in-house Google software that we're talking about, not distributed outside the company. And (c) is not software at all, so the argument doesn't apply. Should the GPL have clauses that forbid, say, a GPL-licensed web browser from being able to connect to a web server running a non-free http server? What if it's a free http server connected to a non-free database? What if the http server and database are free software, but the people who operate the server don't allow you to download all of their data in bulk and serve it yourself?

You have to draw a line somewhere here, and drawing the line between (a) and (b) seems reasonable.

Re:OK, dumb question after reading the article

[Belial6]

Wow. Just wow.

First, if sending bad data back to your server can bork your web server, then either you are ok with that, or your web app is broken. Your scenario of sending bad data is already trivial to accomplish by malicious people, or those who think they know better than you. If the user can send data back to you server and bork it, you have NOT mad sure the data is clean on the server side so there is no chance of an exploit.

Second, my computer is MY computer. The web browser is NOT sandboxed to make a safe known environment on the client side for the web site developer. It in no way does that. It IS sandboxed to prevent clueless and malicious web developers from screwing up the rest of MY computer.

You are exactly why RMS is correct in his concerns.

Re:OK, dumb question after reading the article

[grumbel]

I disagree with putting the blame on Javascript, the whole problem starts already with HTML/CSS. Webpages these days are something that is generated, not something that is written, meaning what the user gets to see isn't the real data, but just some more or less usable rendering of it and thats pretty much where the trouble starts. The whole notion that its the browsers job to render a webpage in a style chosen by a user, has pretty much completly fade away, today you are basically left with the choice between pixel-perfect representation of what the webdesigner had in mind and absolutely no style at all, there is no in between, no clean separation between actual content and user interface. Even something simply as changing the font size will break close to 100% of all non-trivial webpages out there, on some its just a little glitch (like "Reply to this" button falling appart on Slashdot) while other get completly unusable because elements end up being hidden below others. This whole mess has to stop. I don't mean that webpages should go back to HTML2 or whatever, but simply that they should allow raw access to their content, I don't want a news article flooded with navigation bar and crap, I want the raw news article and nothing else. I doubt that this will happen on a large scale anytime soon, since it would make it to easy to filter away all advertisment, but then even webpages without any advertisment suffers from this very same problem.

copyright enforcement?

[Anonymous Coward]

Has "borrowing" some Javascript (or HTML for that matter) ever resulted in litigation? There's been sort of an understanding since the inception of the Web that people will borrow from each other, because they can, and that's more or less fine.

I like Stallman's idea, it just doesn't seem particularly urgent.

data

[Lord Ender]

The license for the javascript software you are running might be important, but the far more important factor, in my mind, is the IP rights and responsibilities attached to your data.

Who has access to your data? How can you verify that? Who is responsible for keeping it secure? Who is responsible for making backups? How can you verify that?

Stallman has finally lost it.

[Anonymous Coward]

According to this, a Javascript program that talks to a closed source AJAX backend is Not Free, even if the Javascript code itself is Free.

This is the craziest thing Stallman has come up with yet. Is a web browser that talks to a None Free web server Not Free? What about a program that uses SQL to talk to a database server that is Not Free?

Re:Stallman has finally lost it.

[illegalcortex]

While I frequently think RMS takes good philosophy and generates stupid conclusion, I actually think your example proves him right. Imagine MS SQL ships you SQL server with all the source code Query Analyzer and the DB access libraries open sourced and GPL. But they continue to distribute the SQL server engine as closed source and with the current license. Does that make SQL server free or not free?

Your browser example just doesn't work because the browser can access a whole host of other information and isn't built only for talking to that one server. Your other example program could be used to talk to any number of database servers instead of MSSQL. As long as it was a free, open source app and didn't use some incredibly henious MS-specific SQL, you could point it at another DB.

Now imagine something even more symbiotic than Query Analyzer and MSSQL. Something where there really is no practical use for the client except to talk to that server. For AJAX apps, it's more of a parallel to say the Javascript is just the top layer GUI on the behind-the-scenes application. That's what we're talking about here. The client is only half of the application, the server is the other half. An application can't be "half-free."

Re:Beware the hidden dollarsign?

[u38cg]

I think /. is more than aware what they mean. Just because you aren't forking out to use these web applications, doesn't mean that there isn't a cost. Software as a service costs real money to host, and you should be asking where the money is, and why.

Slippery slope to non-free

[dazedNconfuzed]

Because you are reliant on something which must be paid for (somehow) and/or you can't own. Stallman's view, nutty or not, is that you should be able to function ENTIRELY on free software - which a non-free JavaScript "app" by definition isn't. From his perspective, it's an insidious "slippery slope" undercutting of the free (speech AND beer) software paradigm: it's so easy to get caught in the "[shrug] so what? I didn't have to pay, and I don't have to keep a copy because I just go to the site to run it again" trap, risking reliance on something controlled by someone else.

Re:Slippery slope to non-free

[swillden]

Well, there's a simple response to Stallman: you're wrong.

If you want to use my service and my resources, then you don't get to dictate your terms to me.

Stallman is perfectly happy avoid using your service and resources. His issue is that he doesn't have an easy way to tell whether or not he *should* avoid you.

Hence his recommendation that Javascript that is Free Software be tagged with something that indicates the license, so that appropriately-configured browsers can avoid executing non-Free code.

On a more general note, why is it that everyone assumes that when Stallman explains how he thinks things should be, or the way he thinks people should act, that he's somehow "dictating" to them. He is extremely clear on the fact that he neither has nor wants the power to dictate, because that would be anti-freedom. Instead, he explains, exhorts and encourages, pushing the growth of Free Software and pointing out non-Free software that may go unnoticed.

Re:Slippery slope to non-free

[Azureflare]

I can't dictate the terms for your services nd your resources, that's true. However, your client side code is running in MY BROWSER consuming MY RESOURCES.

That is the point Stallman is making. I really think he should have provided more examples.

He doesn't care what you do on the server side. Just provide us with messages to the client (us) that enables us to provide whatever interface to the data that we want.

I thought I did.

[Samschnooks]

So if you do care about free software on the desktop, it's reasonable that you should care about free software in your browser.

I was having trouble with a F/OSS app several months ago and I thought "Great! It's F/OSS! I can just get the software source and have a gander and solve my own problems!"

So, I downloaded the code, unzipped it, spent a couple of days getting the development environment right, and brought up the editor. A few days go by, and I'm trudging through uncommented PHP code, digging into class after class calling other classes that called other classes that just set global constants or read environment variables, and so on and so on...

I deleted the code because instead of "solving my problem" I was getting lost and not accomplishing the activity that the software was supposed to accomplish.

I went and got a package that did what I wanted.

In short, I have no desire to look at source code. I don't give a rat's ass. I have better things to do than to dig through other people's mess - thank-you-very-much.

F/OSS only appeals to people who LIKE to trudge through others code to see how it works or make it "better". To me, software is an end to a means and I don't really give a rat's ass how it works as long as it's not doing shit behind may back that I don't want; which I can find out by other means than looking at source code.

Re:I thought I did.

[Austerity Empowers]

No one is asking you to. But what if you ran a business and the software vendor for some mission critical app decided he wasn't going to support your desired OS, or some trivially simple feature that a competing system has that makes a lot of financial sense to you? But your cost to switch over outweigh the cost of that feature. Your vendor was either going to hold you hostage for some obscene amount of money required to switch (but enough that he thinks you'd pay, since he knows your costs too), or let you stay on your existing platform which will bleed you dry slowly. What if your software vendor decided that you can run 8 documents at once, but to run each additional document at once would cost $100/document. Not because of any technical limitations, but simply because they want to charge you that way?

If you made a point to never use F/OSS you could simply pay someone else to fix the software, perhaps someone you already have on staff. You could have it your way. You wouldn't get stuck with idiotic licensing scams and other extortion.

This kind of thing happens all the time, at all levels of business. While he sounds like a raving lunatic at times, his zealotry can produce a better world. It works not only for people who like to code, but for those who'd rather pay others to do it for them. We really ought to be looking for ways to use open source as much as possible, in place of proprietary alternatives. He's pointing out ways to help you identify closed source apps you may not know exist.

As usual it sounds ridiculous and paranoid, but it does make sense. You may not wish to put your life on hold for lack of F/OSS alternatives, that's not a reasonable expectation, but it makes sense to favor F/OSS solutions and be looking for a way to remove proprietary as much as possible. The economics of the world won't really change much, people will still get paid to write software... but they won't be able to extort you for it either, or pimp it for decades because you have been locked-in.

Re:I thought I did.

[Tom]

Yes, most of the times I don't care for the source, either.

However, several times already I came across a piece of Free Software that did almost exactly what I needed, or that did what I needed but hadn't been updated for quite a while. I could take it and add the feature I wanted, or take it over and continue developing it, or simply fix a few bugs that prevented it from running/compiling in the current compiler/webserver/whatever environment.

Just because you don't use a freedom 99% of your time doesn't mean it isn't valuable. I very rarely make use of my freedom to assemble, and elections are only every few years - but still these are important freedoms to have.

Re:I thought I did.

[Ifni]

Thank you. That's right.

He wasn't defending you, by the way. He was pointing out how ludicrous your argument was. Basically, you were saying that since you, personally, will never use this freedom, it has no value for anyone, anywhere, ever, and therefore should not be defended. Not only is that shortsighted and egocentric, it is - well, actually, I think shortsighted and egocentric pretty much covers it.

I'm like you, I don't like digging through other people's messy code. However, I like having the option to so that I can see how something was done so that I can use it to learn new techniques so that when or if I decide to build my own program I have another valuable tool in my toolbox. Also, though I am sorry that the tool you decided to dissect was a mess, a lot of open source code is clean and well documented. That may not be the norm (I haven't looked through much), but from what I have seen, it has improved dramatically over time.

Lastly, even though you may not see the value in being able to view and change code, as you mentioned in the last paragraph of your article, there are those that do. Because of them, FOSS improves and gives you the ability to dump one FOSS app for another that meets your needs better because someone that was willing to improve someone else's code had similar needs to yours. It allows those that like to tinker the ability to make changes to any FOSS app that you use to make it better by adding features that you will use. The point is, if you simply write off the FOSS ideals as useless because you don't take advantage of them directly, then fail to defend them because of that belief, you are missing the bigger picture and risk losing a resource that whether you know it or not you do benefit from.

FOSS appeals to more than just the people who maintain and improve the code, it appeals to anyone that uses it. In fact, I'd even argue that it benefits those that choose to use non-free alternatives as it provides competition - and when competing with free, proprietary has to be that much better in order to succeed with a price tag (and though the extent of this success is debatable, there is certainly increased pressure to improve for many, or FUD/lock-in for some few).

Every time he speaks I just want to shoot him

[BitZtream]

Let me give you guys a hint. Its a good time to start distancing yourself from Stallman, he's definitely wondering off to the tree-hugging-nutjob-hippie commune.

He's lost grasp of the point of software. The point of software is not 'to run free software', its to get something done.

His entire life has turned into 'omg you must use free software or you are doing the wrong thing'. He has no logic for this other than 'its bad for you not to use free software' or 'its bad for you if you cant modify it even though you have no useful reason to do so!!!'

He goes so far in the article to try to confuse the meaning of 'free' versus 'open', implying they are essentially the same thing. They aren't, and never will be. He has gotten himself so deep into his own bullshit that it would appear that it is now impossible for him to understand that his 'way' isn't the only one. Once you've got yourself to the point where you think 'free' or OSS software is 'the only way' you are no better than those people who refuse to use OSS software, you're just a moronic twit at that point.

Stallman has reduced himself to a religious leader rather than a promoter of openness for the common good. He's simply gone too far.

So again, I encourage you to distance yourself from Stallman, he is not someone you should associate with any more than the Church of Scientology as they are both just spreading propaganda for their own personal gain at this point. Now that OSS has become even slightly accepted his usefulness as a supporter of OSS is diminished, so he's taking it to the next level and trying to say all non-free software is bad. Read that carefully, 'non-free'. Not open. In this article he in a round about way attacks 'open' standards that are not 'free' by his definition.

You need to watch out for the guy who screams 'freedom' while at the exact same time adding new restrictions to the very license he claims is all about 'freedom'. I'm not saying not to use GPL or GPLv3, if the fit your needs/goals, thats entirely fine and should be used if they fit. I license my software under many different licenses based on what I'm trying to accomplish. My applications are generally closed source, I have some libraries that I've released LGPL, and many that are BSD licensed. I have not used GPL proper as it doesn't really fit my Each has their place in MY agenda. I'm just saying that what he does is hypocritical to an extreme only shared by politicians and lawyers, and because of that he should be treated as such.

I am in no way saying you should abandon OSS or the quest for open standards. I just feel that what Stallman is doing is not the quest for openness, but more like gathering a cult to be lead off to a mass suicide.

Re:Every time he speaks I just want to shoot him

[Improv]

Given what he's already given us, I think you greatly understate the credit he's due. Without Stallman, we would have compilers, operating systems, editors, etc, but it's quite likely we would not enjoy the freedoms we have with them today. Right now, I can install Linux on any number of systems I have as well as systems at work, including all sorts of software, without any legal worries about licensing - Stallman did not write most of it, but he made it possible and drew people's attention to its desirability. It is because he constantly screams "freedom" and enough people listen (or are bound by the GPL's viral nature to listen) that we have a viable way to run computers without people who would significantly restrict our usage of this software getting in the way.

Stallman isn't perfect - he is known for being hard to work with, he let GCC stagnate for several years because of an inappropriate development model, and the "GNU/Linux" terminology thing wasn't necessary. However, taken as a whole he's a very important and positive figure.

What about the server side?

[patro]

So if you do care about free software on the desktop, it's reasonable that you should care about free software in your browser.

Okay, but Javascript is only one part of this problem. What about the code running on the server? I wonder if RMS visits any websites at all besides fsf.org

He can't be sure after all if other sites use only free software on the server side, so he can't visit them to avoid accidentally supporting non-free software.

Re:What about the server side?

[ShieldW0lf]

That's RMS' fault.

http://en.wikipedia.org/wiki/The_Boy_Who_Cried_Wolf

You're right, it is. If he hadn't taken action to solve the problem he was yelling about, people would have suffered enough to show some respect. He should have just gone into the forest to be a hermit and left you to get screwed so you would learn. Now you can just pretend there wasn't a problem that he didn't mitigate on your behalf and talk like an idiot, and most people won't realize or catch you at it.

Stallman's not wandering anywhere

[roystgnr]

He's been crazy for years. My first exposure to his loony ideas was in that old story of his, "The Right To Read". He wrote that when I'd just entered college and just started using this "GNU" stuff, and I remember being being stunned by his paranoia. Grade schools wasting time preaching about intellectual property? Software being outlawed for being able to edit RAM that someone else's program allocated? People who didn't have the root passwords for their own computers? And then there's the central point of the story, that eventually people would be stuck with books they couldn't lend or resell! That Stallman guy was clearly a nutjob.

Re:Stallman has to go

[lennier]

"Richard Stallman has done more damage to the open source movement than anyone else. He is pompous, arrogant, rude, inflexible, and intolerant of diversity of opinion."

But he's also *right*. History has proved this, time and again. He seems like a hardass because reality is unforgiving. Too bad. He's still right.

What does 'tolerance of diversity of opinion' have to do with anything? Maths doesn't tolerate 1+1 not equalling 2. There are some places you *can't* tolerate wrong answers. Computer science and law are two of them.

You can disagree with his conclusions as much as you like, but that doesn't invalidate them.