5 ms·

I doubt you're the only one - thats why I made the source code completely open: http://github.com/mjpizz/reclaimprivacy/blob/master/javascripts/privacyscanner.

by mjpizz 16y ago

I doubt you're the only one - thats why I made the source code completely open: http://github.com/mjpizz/reclaimprivacy/blob/master/javascripts/privacyscanner.js#L6242 http://github.com/mjpizz/reclaimprivacy/blob/master/javascri... The only compressed stuff is jQuery javascript, all other Javascript is uncompressed and commented. Hope that helps. [edit: updated line number]

thorax 16y ago
For the source code, I wouldn't include the compressed jQuery if possible. Speed isn't as important here as transparency and it's quite difficult to scan to tell whether there are any issues. I know you don't want to take up a lot of room with jQuery but it really will help increase my ability to recommend to others if all the code is easy to read. You might also want to put comments on slightly scary things like PARTNER_APPS to be sure people don't believe Yelp are YOUR partners or something crazy like that. Some of these things sound paranoid, but I'd like people to feel 100% comfortable using your bookmarklet. It worked great for me and identified some things I missed somewhere. Nice work.
- mjpizz 16y ago
  done. I left the compressed version deployed for now, but the source code is now 100% uncompressed and commented: http://github.com/mjpizz/reclaimprivacy/blob/master/javascripts/privacyscanner.js#L6242 http://github.com/mjpizz/reclaimprivacy/blob/master/javascri... thanks for the feedback, esp about the PARTNER_APPS constant (now called BLOCKABLE_APPS for clarity)
  - seasoup 16y ago
    Instead of copying and pasting jquery into your js, you could pull it from google's CDN, that way it would be cached for a lot of people and trustworthy. Well, trustworty-ish. :)
- sesqu 16y ago
  I would use a CDN for the jquery, maybe http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min... - that way, people don't have to make sure you haven't hidden the maliciousness in your version of jquery, which most people might not want to verify.
lambdasigma 16y ago
Yes, but the bookmarklet only contains one line of code, which fetches the remainder of the script from your server. So you could possibly replace it at any time with something evil... Sorry for being paranoid. I very much like your initiative, but people are going to ask questions about these sort of things.
- mjpizz 16y ago
  yea, I understand the concern, that is partially why I linked the source to my own github account (adds some accountability) and left everything uncompressed and commented. Unfortunately, it isn't possible to put the entire source into the bookmarklet itself due to browser length-limitations, so the remainder of the code will always need to be loaded separately.
- rmc 16y ago
  Shame there isn't a way (in HTML) to say "the src of this <script> is at http://... http://.... and it's SHA512 is a5872... or it's signed by GPG key 0x1276e...". That would solve that problem.
sosha 16y ago
How can I tell the code running on the server is same as the code you posted on Github?
- mjpizz 16y ago
  for any of the Javascript/HTML/CSS, you can just diff it with the GitHub code to be certain. Also, the backend Python code cannot do anything sketchy with your Facebook data since nothing is done using Facebook's API. And you have my word that I am doing my best to deploy to AppEngine after modifications are made in GitHub. I'm even considering putting up a postcommit hook when I have time.

by mjpizz 16y ago

thorax 16y ago

For the source code, I wouldn't include the compressed jQuery if possible. Speed isn't as important here as transparency and it's quite difficult to scan to tell whether there are any issues. I know you don't want to take up a lot of room with jQuery but it really will help increase my ability to recommend to others if all the code is easy to read. You might also want to put comments on slightly scary things like PARTNER_APPS to be sure people don't believe Yelp are YOUR partners or something crazy like that. Some of these things sound paranoid, but I'd like people to feel 100% comfortable using your bookmarklet. It worked great for me and identified some things I missed somewhere. Nice work.

mjpizz 16y ago
done. I left the compressed version deployed for now, but the source code is now 100% uncompressed and commented: http://github.com/mjpizz/reclaimprivacy/blob/master/javascripts/privacyscanner.js#L6242 http://github.com/mjpizz/reclaimprivacy/blob/master/javascri... thanks for the feedback, esp about the PARTNER_APPS constant (now called BLOCKABLE_APPS for clarity)
- seasoup 16y ago
  Instead of copying and pasting jquery into your js, you could pull it from google's CDN, that way it would be cached for a lot of people and trustworthy. Well, trustworty-ish. :)
sesqu 16y ago
I would use a CDN for the jquery, maybe http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min... - that way, people don't have to make sure you haven't hidden the maliciousness in your version of jquery, which most people might not want to verify.

lambdasigma 16y ago

Yes, but the bookmarklet only contains one line of code, which fetches the remainder of the script from your server. So you could possibly replace it at any time with something evil... Sorry for being paranoid. I very much like your initiative, but people are going to ask questions about these sort of things.

mjpizz 16y ago
yea, I understand the concern, that is partially why I linked the source to my own github account (adds some accountability) and left everything uncompressed and commented. Unfortunately, it isn't possible to put the entire source into the bookmarklet itself due to browser length-limitations, so the remainder of the code will always need to be loaded separately.
rmc 16y ago
Shame there isn't a way (in HTML) to say "the src of this <script> is at http://... http://.... and it's SHA512 is a5872... or it's signed by GPG key 0x1276e...". That would solve that problem.

sosha 16y ago

How can I tell the code running on the server is same as the code you posted on Github?

mjpizz 16y ago
for any of the Javascript/HTML/CSS, you can just diff it with the GitHub code to be certain. Also, the backend Python code cannot do anything sketchy with your Facebook data since nothing is done using Facebook's API. And you have my word that I am doing my best to deploy to AppEngine after modifications are made in GitHub. I'm even considering putting up a postcommit hook when I have time.