FSF Suggests That Google Free Gmail Javascript
Phoe6 writes "Apparently, FSF is calling it a 'JavaScript Trap' and wants 'useful websites' such as Gmail and others such as Twitter, Facebook to release their JavaScript code under Free Software License so that users can trust their service."
FSF wants Windows, Office, Photoshop, and everything else to be free. That's their job. People need to be able to make money on software, or large corporations won't invest in it. That's why FOSS-friendly companies like Sun are going under and being snapped up by profit-hungry pricks like Larry Ellison. Film at 11.
I was going to be all snarky about some blog post probably not being the voice of FSF, but then, http://www.gnu.org/people/speakers.html and he's on there.
So I guess I disagree with the FSF, and not just him!
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
You do realize that you can already debug it and step through because it's client side?
XML is a known as a key material required to create SMD: Software of Mass Destruction
The FSF wants all software released under a free software license. So it really isn't news that they want Javascript software released under a free software license.
The way they obfuscate and "minify" it, it might as well be in binary.
Good job having no idea what you are talking about there. Javascript runs on the browser, you get a copy every-time you visit google.
On top of which if you have source, you don't need to reverse engineer anything. Plus hiding access to source is not security, just obscurity.
Over all your entire comment was pretty much totally pointless and uninformed.
i'm all for the FSF, but in my opinion, this is a little over the top. this kind of complaint from the FSF just borders on whining.
Well, the source is already technically available, since they ship you non-compiled javascript code. FSF's has several problems with this. 1) Gmail has not granted the user the right to modify the Javascript code. 2) Even if (1) is conceded, the FSF is arguing that the obfuscated code transmitted to the client browser does not truly constitute source code. They would like a link to be placed in a comment in the obfuscated code to the original, un-obfuscated code. There is a broader problem, however; even if a website transmits GPL'd code in the clear, the user does not have any easy way to replace the transmitted code with their modified code. They would like browsers to support hot-swapping websites' scripts with modified copies.
Considering that Javascript runs on the client side, I don't see how someone couldn't already do that. On top of that, if someone can hack the server side by exploiting a flaw found in client side code, then that is EXACTLY the reason why the unobfuscated source code should be released. Server side could should not be susceptible to an exploit a client can induce by manipulating code or data packets.
What I don't understand is what the hell the FSF is asking for. JavaScript runs on the client side and the source code is already available.
Releasing the client-side code isn't a big deal (it's right there in the page source!) I'd be more interested in the server-side code.
They want the user to have the four freedoms over this code. They also want an unobfuscated copy. Right now you sure could copy the JS and modify it yourself, but you would be in violation of the license google has placed on it.
Nobody complained when WebKit, an open source product, had a vulnerability in it that allowed for remote code execution. Sure, it was eventually found, but having it open source didn't make it instantly safe. I don't see why we should force companies to publish all of their javascript. It is plenty open as plain text, no need for a free license. Open sourcing the code would encourage modification, which could easily lead to the attacks that we are all afraid of.
They would like browsers to support hot-swapping websites' scripts with modified copies.
Am I the only one that sees this as an enormous security vulnerability waiting to happen? We've already got flash ads and dodgy popunders trying to execute malicious scripts as it is... why give them yet another attack vector?
The FSF also calls for browsers to support loading modified (or saved) Javascript instead of what is given to you by the server. So, in your example, you would just make sure that your browser loads your copy of their 'clean' source code, rather than something they've patched and re-served.
You should be able too. You can always replace the code on your devices to be sure.
Most people might not care, but that does not mean anything. Most of those people would be ok without freedom of speech or freedom of thought either.
You are the only one, because you have no idea what you are talking about.
The FSF would like to see you be able to substitute sites scripts with your own modified copies only on your own browser. Oh no, you could run exploit code on yourself.
How about you register an account and come back in a few years when you have learned something.
Most Facebook users use a browser written in C++ -- they don't know that either, yet free software browsers and rendering engines remain in common usage.
Join the Free Software Foundation
Meaning they could actually get a second opinion. Seems like that would be great. I am no doctor, but I get access to the records so I can show them to another doctor. Getting a second opinion is a valuable thing.
Sorry, but this it stupid. The real brains that we'd need to trust is in the SERVER code. And all of Google's procedures. Knowing what the client is up might make some feel good, but this all very centralized.
-- Home is where you eat your heart out.
Wow, that is one really good troll.
They already give you a copy of this code numbnuts, the FSF just wants them to change the license on it. Confiscation is done against your will. the FSF does not have the force of law they just are asking.
The FSF is never demeaned when they try to have software come under a free software license, that is their goal at all times.
The popular Greasemonkey Firefox extension (Which I believe is built-in on Google Chrome) lets the end user modify the javascript/css running on the site to the user's desires. There's a huge database on UserScripts.org that lets you browse site-specific mods to Twitter, Facebook and yes, Gmail.
Another very popular extension is "Better GMail 2", which basically packages some greasemonkey scripts into a single extension.
Check out Unsealed: Whispers of Wisdom! http://unsealed.k3rnel.net It's an action-RPG about Open Sourcerers.
...enormous security vulnerability...
For whom? Who would be responsible for that vulnerability? Browsers? Web site designers? Users?
Certainly the browser should make it as easy as possible for users to execute (or prevent execution of) any arbitrary javascript. Anyone with Chrome or Firefox can already do this with relative ease. I don't think it would be very hard for browsers to provide this ability exclusively to users, though the Vista effect ("are you *sure* you want to...?") could be an unfortunate side-effect.
And a space unicorn! And free candy!
93rd rule of Slashdot: No matter how obvious my sarcasm is, my comment will be taken seriously by someone.
You may not know it, but the website you're reading RIGHT NOW is a festering hotbed of evil. EVIL. Evil code that will steal your information, kill your wife and children, and damage the transmission on your car.
The ONLY way around that is to use our new FSF GnuWebScript, which is Totally Open and Free. Not only is it a Force for Good, it whitens your teeth and makes your toes smell nicer. It will never do those evil and nasty things that the Javascript does, because it's not Javascript - it's GnuWebScript!
GnuWebScript is a free side-set* of ECMAscript, a tragically unfree industry standard. GnuWebScript implements everything in ECMAscript slightly differently using free, non-proprietary language extensions.
GnuWebScript - to be free you must chain yourself to it!
* side set is not a superset or a subset - it's a sideset.
That doesn't mean that the justification for releasing code under an open license is to "let users trust the service."
Releasing Facebook's code will not "let users trust the service" because most users, and I imagine the overwhelming majority of them, wouldn't know what they were looking at. It would not enable them to trust the service any more or less than before.
It would enable a few users, let's call them group G, to trust the service. The remainder of users, call them group L, would then have to trust Group G. This has the same trust problem as trusting Facebook in the first place, so nothing is accomplished.
Facebook's code is their property, and they have every right to keep it secret. If you do not trust Facebook, don't use it.
That someone at the FSF has been using Gmail and started feeling guilty about using "non-free" software and instead of switching to something else is trying to get Google to change?
Coder's Stone: The programming language quick ref for iPad
Should? Why?
..." or "It is the FSF's position that ..."
I understand it's RMS's and FSF's belief, but why must it be everyone's? What's clearly missing is the qualifier, "We believe that
FWIW, that's a rhetorical question. I know why he believes what he does. I also know that his is an extreme position that not many people share. That he wants some corporation to open up their code for others to use/share/modify is Not News ®. <yawn>
They would like browsers to support hot-swapping websites' scripts with modified copies.
Can't you do that with Greasemonkey? I wouldn't know as I've never tried it, but it's the sort of thing I'd expect you to be able to do with it from how people talk of it.
which is totally what she said
Why do you trust the second doctor any more than the first? Your trust problem is not solved at all in this analogy.
The problem with this logic is that cross-site-scripting, flash, hell, even your garden-variety "computer virus" all require you to run software "only on your own computer." Any hot-swapping technology has to be implemented with extreme care, and even then, you're still opening up a new attack vector. I seem to recall Greasemonkey, an open-source Firefox addon which allowed users to run external scripts within their browsers, having a history of vulnerabilities to this type of attack.
Opera does this. I've made use of it in the past to fix buggy javascript on a site.
I'd suspect Firefox does something similar.
I at least want the circuit diagrams and all images of the (E)EPROMs so I can fix the device when it breaks. It was like this in the past (circuit diagrams were in the manuals or in some magazines, at least in the USSR). I can find service manuals for some devices, but I want them included with the device and also have images of the chips that need to be programmed before they can be used.
Speaking of obfuscation, the article by the FSF drags Node.js and V8 into the discussion, even though they have nothing at all to do with the client-side javascript that the ostensible topic of the article.
Also, as the author mentions, it is possible via greasemonkey to do essentially what is wanted--modify the client-side javascript--so it seems like an ideological point rather than a practical one. The "obfuscation" of the javascript source is as much about reducing the bandwidth consumed by javascript as is it about hiding the source code from the People's Republic of GMail Users, so it would be silly to transmit the original source.
Of course, linking to the original source would help people write better GreaseMonkey scripts. Since I live in Michigan, which is being turned into a banana republic by its governor, you will pardon me if I throw up a little when you conflate freedom and convenience.
Psst, here's a copy of Facebook's secret code -- http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/Ub2OCc5xWCb.js
Join the Free Software Foundation
Yeah but the javascript you get is compressed with all white space taken out and variables are renamed to be as short as possible, which makes it next to impossible to debug.
With the Firebug plug-in you can change the JS (and HTML and CSS too for that matter) in the debugger and see instant results. But I don't know if it allows you to swap a complete script. I guess you accomplish that by changing a link to a script in an HTML file to point to your own. I've only ever used it to debug my own scripts or someone's I had to take ownership of.
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
Because the odds that all doctors are evil is lower than the odds that one doctor is evil. Trust is not an all or nothing thing.
Nothing a glorified find-and-replace can't help with. This'll help you get started:
http://unwrongest.com/how-to-decompress-javascript/
"When information is power, privacy is freedom" - Jah-Wren Ryel
Greetings from 2163! Patents were sooo last century...can't imagine how you got any collaboration done with that crappy system. Patent law encouraging innovation...hah! (spoilers) World War IV pretty much put an end to that silly "intellectual property" idea. But for you "free software" geeks, I suggest you go into hiding before the Sharer's Inquisition a few years after WW III.
Wouldn't FSF's effort be better placed making a tool that intelligently adds whitespace and allows the user to quickly and easily change variable and function names? It would still be above the typical user's level but all it would take is one white hatter de-obfuscate the code and post it somewhere. Seriously, gmail's java script isn't that big, you could probably do it with notepad and find-replace by hand in a couple hours.
Can't you do this with greasemonkey (and presumably other tools) already?
Exactly, we have the code. Why does it need to be open sourced?
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
The thing is, JavaScript is inherently source visible. Since it is a script, and it runs on the client system, you can always see the source. For trusting an app, you don't need the source to be open, as in free to redistribute. You just need it available. The US Government trusts MS software because they have the source (many people have the source to Windows, governments, universities, etc). You can audit it, compile it yourself (or interpret it yourself which is automatic in JS) and so on.
Thus there is no trust reason AT ALL for Google to open source their stuff. You can argue other reasons, but not trust. That the FSF is using that means they are just building a straw man, perhaps because they don't feel a real argument would stand up.
Isn't that somewhat moot? Unless they have restored offline support in the last few weeks, Google could take away the service at any time just by shutting down their servers, and it wouldn't matter at all if you had the client-side code cached locally because it won't function without the server.
Further, the code changes frequently. This would make it pretty fragile for even sophisticated users to maintain a patched version of code for sites like Gmail.
Who do they think they are going to help with this, and under what conditions would their request help? Because it seems like a stretch to me.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Does anyone listen to what this Botanophobe says anymore? Seriously?
The source is obfuscated and also compressed.
Tiger Blooded Bi-Winning Machine
Yeah well at some point you ask a third and then a fourth and before you know it you have an overwhelming majority of experts agreeing on something. That makes you feel a whole lot better then just hearing it from one. And, you know, people might trust a doctor who also happens to be a family member or close friend more then a hospitable.
OK, enough beating on this analogy. The point is that even if I don't have the knowledge to examine the code and deem it safe I'll feel a lot better if my friend who works for NASA and my 15 year old nephew who never ran into a computer problem of mine he couldn't solve told me FB's code is safe as opposed to me hearing it from FB. Yes I have to trust my friend and nephew but, for me, the user anyway, that trust is easier to give to them then to a for profit entity who has more interest in keeping me as a customer over keeping me safe on the web.
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
Swapping their script for your own version would be a nightmare. What happens when Google updates the official script, or a related one, and your script no longer functions because of incompatible code. What happens when even simple HTML is changed, causing your script to stop working. It would be equivalent to getting data off a website via screen-scraping. Every time the site changed some minor thing, your scripts would become useless.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Well I see your point but I disagree. It's not confiscation because Google would still own the copyright and this would be their choice to open source it.
I think the FSF approach is this - imagine a world where instead of hiding information and ideas, which is what source code is, we share those ideas and move forward so much faster. It's not in the name of security you see, it's in the name of freedom and moving humanity forward that much faster. You don't have to agree with it. It's idealistic, but some of us are.
Tiger Blooded Bi-Winning Machine
Because users aren't able to legally modify, study and distribute it? Plus, it's not in a suitable form for modification.
Join the Free Software Foundation
I apologize for not making a distinction between self-hosted web-based blogging service and a blogging tool for interaction with remote services, but with integration of the local desktop environment.
If I release software and I say "You can do whatever you want with this software. You can modify it and redistribute it as you wish. It costs $50 per copy." Well all that has to happen in one person buys one copy and then redistributes it for free. That is allowed, I said they could redistribute it. People won't pay for my copy, since they can get the same thing for free legally.
That is why you find that when companies make money using free software, it is a service model or the like. You can't just charge for the software because people can just redistribute it legally. Fine, some things work in a service model, but not everything.
I think the real issue with the Javascript being 'opaque' on GMail and other Google sites is that the javascript is not the original code the software is written in. The original code is written in Java and 'compiled' into Javascript with GWT. In order to be truly useful and readable, Google would need to release the Java source code. The javascript that is delivered to your browser will even differ depending on what browser you're using.
Open software does nothing to increase or decrease ones ability to hacks. Only software design determines that.
The Kruger Dunning explains most post on
They also want an unobfuscated copy.
If obfuscation is forbidden by the GPL, there's about a gabillion Perl scripts out in the wild that are in violation.
The link you posted to states that it only does indentations and does not (obviously) replace the shortened variable names with anything meaningful. Again, reading code with meaningless function, class, and variable names is next to impossible even with proper formatting.
Can we finally just admit that the FSF is irrelevant and move forward?
FSF -- Free as in Not
With Opera I can right-click on a page say "edit site preferences" go to the scripting tab, and set a javascript folder. It will then load the javascript in that folder followed by the scripting on the page. However, in the javascript in the specified folder that you load, you can use opera-specific extensions to modify/overwrite the subsequently loaded javascript from the site. I'm probably doing a horrible job of explaining as I don't really do web-development stuff. So...
http://www.opera.com/docs/userjs/
I don't quite see the point. Sure it would be nice to have the Javascript under a Free Software license, but that would be very far down my list of priorities, as with Javascript and the Web in general there is one very fundamental difference to regular software: You neither own that stuff nor control it, they do and that is the problem that needs attacking. It doesn't make a difference if they stick a GPL header on top of their code or not, I as I would still be forced to use whatever version they ship me, keeping around an older copy with features they might have changed/removed/whatever doesn't help me when the API to their servers has changes, that old GPL copy might either break or become unusable. The real solution would be to provide standard data driven APIs for webservices, so that I wouldn't depend on their Javascript and HTML code, but could roll my own.
The whole problem with the Web today is that I don't have direct access to my data, but instead can only access it via a whole swoop of HTML and Javascript stuff, that makes it frequently hard or even impossible to actually do certain operation. A very basic example would be backup. Yeah, I can download mail from GMail via POP or IMAP and that will give me some of my mails, but what about chat logs, mail I send, tags, contacts, etc. and a bunch of other meta data that isn't just the mail? Can I backup all that? And even more importantly: Can I actually restore it? If GMail decides to delete my account tomorrow, can I open a new one and restore my backup into the new account? Can I do that when I change mail providers? Will meta data survive the transfer? That is the problem that needs fixing, as almost all webpages suffer from it, even the glorious 100% Free Software ones generally don't give you full import and export capabilities of your data and even when they do the interfaces are often limited and cumbersome.
Yeah, try parsing the Javascript Google shoves down, then reconsider the issue. While I'm sure one could de-obfuscate it, that they obfuscate it to begin with is a problem. "Do No Evil" my ass. Secrets imply deception.
No one is taking about using force and you know it. Everyone has the right to use their free speech to try convince people to do what they want.
How dare they try to reduce the size of the pages the serve!
I wonder if GPLv4 will have clauses stating which indentation style is allowable.
-1 troll.
or
-5 too fucking stupid.
The Kruger Dunning explains most post on
give me a fleepin' break
Google could release a clean javascript source and add a nasty patch to their server.
It should be trivial to take your clean javascript source, minify it, and compare that to the minified JS they're serving you to verify they're the same, and alert you if they're not. However, being a web service, you have to understand that the served JS is going to change from time to time as they fix bugs and make upgrades, so when you're alerted that they're not the same, it should be easy to see if a new clean source was released, explaining the discrepancy.
And the number of users who will bother with that can be counted on one hand.
Ok I haven't read through all the comments here so someone may have already said this.
JavaScript is client-side. That means it has to be downloaded by your browser, so the code has to be world-readable. It's not very difficult to just go download a copy of the JS code yourself. And some browsers (chrome native and firefox via firebug) allow you to view the javascript on any page without even having to separately download it yourself. This is basically like saying "we want all your HTML code to be available for anyone to see!"
It already is "open source", you just have to look for it a bit.
All the world's a CPU, and all the men and women merely AI agents
I know the FSF's mission is an ideal or a puritanical vision, but there are real important and pragmatic issues they address. I really have to agree with this idea of a "Javascript Trap". We've gotten very comfortable with free and open web services that it's easy to forget, the code that handles your sensitive data isn't open to review.
It's simple really, in the spirit of free and open software, code hiding in any form should ALWAYS be a red flag. There just shouldn't be a point where people say "...and, for the rest of the application, trust us, it just works somehow."
If Google wished to do something untrustworthy with Gmail, Java is the least of your worries.
The US government have made it clear that we have no inalienable rights; any we do not defend vigorously will be taken.
Freedom is great isn't it, people are free to write code then choose what they do with it and how it is licensed.
Seriously, if you don't like not being able to see, audit, or use Facebook's code, don't use Facebook.
And while your at it, stop loaning RMS your phones! If he doesn't want to pay the money, or own a device with unacceptable software on it, let him do without.
And people who don't wish to agree with a license are also free to do without.
If someone is passing you on the right, you are an asshole for driving in the wrong lane.
That's ONE.
Yup. And you could also add, IBM, HP and countless of others smaller companies.
FL/OSS *is* economically viable.
Bottom line is it's hard to make a lot of money in open source. Great for consumers, bad for investors.
Given the data, it's not impossible to make money in opensource.
It's bad for rent-seeking companies, it's good for everyone else.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
What, you don't write all your code that way?
And if the code was released under a different license, suddenly it wouldn't be like that?
"I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
The issue is that without the essential freedoms to study
study is already possible. the javascript code is already in your browser.
So even if it's not Free/Libre, GMail is already gratis and open, at-least.
The only limitation would be obfuscation and luckily GMail isn't doing that.
modify
As the source code is available, you're free to modify it.
In fact there are already lots of possiblity to do this.
User scripting extensions, for example, like GreaseMonkey and UserScripts let you improve websites.
In fact, I use a couple of such to "patch" some functionnality of Facebook in FireFox.
Lots of other possibility exists to modify functionnality at the client level.
And there are countless of precedent, mainly in the realm of video games and game-genie cheating device, which confirms that this is not creating an unlicensed deivated work, it's just the consumer doing whatever he wants with code which was legally distributed to him/her.
distribute
although the original GMail code isn't GPLed and thus user can't distribute patched copies, the patches *themselves* can be distributed under whatever license the patch author choose.
several software project have started that way (Apache has started as a serie of patch of httpd, LAME as a serie of patch to the MP3 reference code, OpenDivX/Xvid as a sries of patch to the MPEG 4 reference code, etc...) and became autonomous FL/OSS only once so much was patched that nothing is left from the non-free/libre software.
It would have been problematic if users didn't get access to the code (like the server side of the code).
But with the current solution, users can get the benefit of open source, and even with faster distribution. (Currently once a nice patch is created, it can be uploaded to some user scripting site or whatever - it doesn't need to go through the whole Google validation procedure and wait until Google decides to incorporate it into its next version).
Now the FSF is perhaps seeking to create a precedent whith which they could pressure other to follow the freedom trend, including website for which this isn't possible due to javascript obfuscation.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Except that, based on the pro-FSF posts in this story, they want google to give up a significant portion of their copyright so that others can modify and distribute it. In exchange, they will give google nothing. They are trying to pressure google to give up their freedom to release the software they wrote in the way they choose.
Well not directly, but the only NAIP approved Linux distro is.... RedHat, the exception is OpenSUSE.
So... if you want to run Linux on a classified system... Redhat is basically it.
Similar to the virtual monopoly Sun used to enjoy wrt to US government computing.
I am very small, utmostly microscopic.
It is a huge deal. It is right there in the page source, and you do not have the right to do a thing with it according to the current license on that code.
And that part of the license isn't enforceable.
There are precedents from the realm of video games & cheating software and devices, confirming that an end user *can* modify a copy of software which was legally distributed to him/her.
Copyright law only kicks in when distribution is taking place (when buying software in a shop, or downloading the software from the net).
Not when using said software.
What wouldn't be possible is to modify a non copy-lefted javascript, and publish the modified version on your website. (Because that would be distributing, and according to copyright law, would require you to have a license to do it).
On the other hand you can make a patch out of your modifications, put *the patch itself* under GPL, and distribute that one freely on the web (say, as an user script). Other user could use the patch to gain the same functionnality or fix the same bugs.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
No one can legally place it on their site and write their own version AFAIK.
So you won't be able to re-use the code *BUT* you can patch it and release the *patches themselves* under LGPL if you want and publish them.
So no way to reuse Gmail on your site, but plenty of opportunity to add features or fix bugs.
There are lots of software which started their life as such patch sets.
Apache started as patches against httpd, LAME and OpenDivX/Xvid started against MP3 and MPEG-4 reference code, etc.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Really, fucking read it already. And stop posting nonsense like "but javascript is already opensource" and "FSF are lunatics".
Yes, your browser does download JS. And yes, you can view it. But you cannot legitimately re-use it. What FSF suggests is that some major web sites would release their JS code under free license, thus allowing code modifications and re-usage. What worries them is that a lot of Greasemonkey scripts for gmail are published under free licenses, but the original javascript remains copyrighted.
I imagine all the FSF people would do it; they'd probably write up a Firefox extension for it even, to make it fully automatic.
Besides, if all your principles are based on popularity, then you must be a rather sad and spineless person.
I don't see what's wrong with distributing a copy of OpenOffice.org/LibreOffice binary+source for a fee. One way to add value and make it worth the $50+shipping is to include non-free clip art. (The data that a GPL program uses doesn't become GPL.)
What trap? Like you can't check email with noscript?
Useless if you're lucky, what if your version of the script now wipes out all your data because it interacts badly with the new apis put in place?
If you care about privacy, force them to disclose urchin javascript and server side code.
"OMG! My FREE browser can abuse me by quietly running NON-FREE PROPRIETARY SOFTWARE without telling me! It's a TRAP! I need everyone who writes JavaScript to tell me in no uncertain terms whether they are FREE and kosher for me to use, or PROPRIETARY and should be blocked by my FREE browser so that no taint of proprietary evilness defiles me!"
It is hardly about secrets or trying to hide stuff. Its more so that google and other sites are using a parser that removes spaces and shortens the lengths of all the variables so that there are less characters to send across the network. When you're handling billions of page views a day, those characters definitely add up. So rethink your position on that. They aren't trying to hide stuff. Thats just a side effect of them trying to reduce their bandwidth costs.
By its very nature all javascript source code is visible. It's probably been minified but you can still trace through and see exactly what it's doing.
Most browsers will lock down cross domain requests.
The assumption in this philosophy is that all the URLs below a particular domain are all owned by the same party.
If geocities.com/~userfoo/*html sources geocities.com/~userbar/*js, should the js files be trusted?
The other side of the assumption, that each party is limited to one domain, causes inefficiency: if I own foo.com and bar.com and I want foo.com/baz.html to source qux.js, I can't have that be bar.com/qux.js --- it must be foo.com/**/qux.js. But if bar.com/*html wants qux.js, I must put qux.js on bar.com also. (I guess virtual hosting and sym/hardlinking comes to the rescue here, and I can stop whining about my tiny, tiny js files being stored twice OH TEH NOESES...)
there are more than a few people that manage to crack applications or even reverse engineer video encryption algorithms or DRM algorithms by stepping through much worse code either through a simple debugger or a possibly more advanced debugger such as IDA Pro which makes C style snippets.
Fact is, it's not about the code being written IN javascript. It's about the code being written in Java and then compiled to javascript. The compressed javascript in question is not typically even javascript to begin with and nor is it compressed, but instead is simply the result of compiling java to javascript.
How about the real pros who can take a microscope photograph of a microchip and reverse engineer the the resulting 3d image of lines and boxes into an encryption algorithm?
You're making the comment "is next to impossible even with" applies to you and many others, but there are those among us who can approach the problem differently. For example, instead of starting from the beginning and tracing forward, start with a point of context. I'll speculate at this point having never really cared about gmail other than reading my mail, but I'd imagine there's some algorithm in use which provides the gmail servers with a query for messages. These queries are more than likely meaningful. So, if you're looking up your friend Jim Bob, locate where the post to the server happens and find the reference to Jim Bob. It probably has the field name for which it applies connected to it such as "SearchText='Jim Bob'". At this point, you can be pretty sure the function which transmited that is a transmission function. It should be possible to decipher variable names in that function and work backward from there.
Reverse engineering is typically starting with what you know and working backward, annotating as you go along. Use a damn good editor with a "change symbol name" feature and each time you identify a new symbol change it.
The code in question probably has an extremely high level of complexity as I'm quite sure it's machine generated from another language. If it's hand coded and compressed, it might be equally bad.
But Impossible, certainly not by any means. Just time consuming.