5 ms·

GNU LibreJS: blocks JavaScript traps

88 points by AbuAssar 2y ago

lionkor 2y ago
This blocks JavaScript that isn't explicitly licensed exactly the way they want, right? In terms of the format of the license, the @licstart and @licend comments (with no comment afterwards), etc.? That's what this does?
- janosdebugs 2y ago
  It also doesn't block well-known libraries. Using this addon sounds like a really good way to have a bad time on the Internet. By the logic of this, why bot block websites which have non-free content or other supporting files? The whole premise of a website is that the owner gives you a licese of some kind to view it. Blocking only a technical part of it makes no logical sense. It's not like you are going to take the JS code under a free license that is likely dependent on the HTML structure under a non-free license and do stuff with it.
  - gtsop 2y ago
    Your argument about non-free content does not apply to the gnu purposes with this plugin. Free Software is concerned with the problem of "what does my computer compute, what does it do, can i modify it". The content (images, text, video, html structure) on any website is not software
    - janosdebugs 2y ago
      You can do a lot of dark magic with CSS or SVG too. Specifically, CSS has calc too. Website haven't just been documents for a long long time and basically nobody is going to bother keeping any computation in the JS space only.
    - ranger_danger 2y ago
      > The content (images, text, video, html structure) on any website is not software What about things like htmx that put logic directly into html attributes?
  - danlitt 2y ago
    [flagged]
- wannacboatmovie 2y ago
  [flagged]
  - malicka 2y ago
    It’s not mental illness, it’s the logical extension of principle. If you think non-free software is unjustifiable and should be avoided, you’re probably going to try to avoid using it (or, at least, promoting it). There are three exceptions people sometimes make in their avoidance: Using non-free drivers, using non-free software for work/school, and using non-free software in the browser. It’s rational that someone would want to limit these exceptions as best they can, and LibreJS is useful for that. I use LibreJS not to help me completely avoid non-free JS, but to make me more concious of my software use. If a site has non-free code and LibreJS pings me about it, I’ll consider if there’s a better site I should be supporting instead.
    - KronisLV 2y ago
      > If a site has non-free code and LibreJS pings me about it, I’ll consider if there’s a better site I should be supporting instead. I wonder how viable this is in the age of the network effect, where most people and content can be found on like 10 big sites. If I need an answer for something but it's on StackOverflow, YouTube, Reddit or even a Discord server, then that's just where I'll go, principles be damned. For many it's probably the same way with X vs Mastodon, the latter of which does feel more wholesome but can get lonely, or at the very least limits your reach. Same with social media or professional sites like LinkedIn. Same with using one of the more popular browsers, OSes, drivers or a lot of other proprietary software. Not to dismiss anyone who cares deeply about free software, but honestly I wonder what % of people are actually committed to those ideals and how many are just cruising through life with whatever is the most popular option with least troubles for everything.
      - hhreefgguu 2y ago
        > principles be damned This is a very common occurrence: convenience or perceived necessity trumping principles. > I wonder what % of people are actually committed Almost 0%, if by “actually committed” you mean consistently applying these principles in practice, in the face of inconvenience. I nevertheless believe that having principles, however vague and sometimes inconsistently applied, is a good thing, in that it structures thought and informs action. It gives a way to discuss how things “should” be.
- LukeShu 2y ago
  In addition to the documented+recommended format, it also supports a few others. But yeah, it's pretty picky about how the license statement is formatted.
- enriquto 2y ago
  > This blocks JavaScript that isn't explicitly licensed exactly the way they want, right? The way you want. Nobody forces you to run this plugin. You can run this plugin, or not, or even change the plugin source code to better fit your needs (something that you cannot do with the javascript programs this add-on is designed to protect you from).
tedunangst 2y ago
Does it also block nontrivial css? That can be Turing complete.
jart 2y ago
Wow it's really cool that Stallman and others created a definition of Free Software for the modern web. Sadly it seems this is old news. There hasn't been any commits to this project's git in the last two years. There's also no date on the article, so I can't easily tell how old this is. https://www.gnu.org/software/librejs/ https://www.gnu.org/software/librejs/ I wish there was more respect for the devotion and principles that go into making something like this. You'd think at least the hacker community would understand, of all people.
- gtsop 2y ago
  > There hasn't been any commits to this project's git in the last two years I am honestly not sure were you got the 2 year commit gap, the latest commit is 3 months ago on master https://git.savannah.gnu.org/cgit/librejs.git https://git.savannah.gnu.org/cgit/librejs.git > There's also no date on the article, so I can't easily tell how old this is The article is many many years old, archive.org has a snapshot of it from 2012
  - eesmith 2y ago
    Another way to verify activity within the last couple of years is to see that the last release at https://ftp.gnu.org/gnu/librejs/?C=M;O=D https://ftp.gnu.org/gnu/librejs/?C=M;O=D is from last fall. OTOH, there hasn't been a test release since 2016, so keeping that section does contribute to the idea that it's no longer active. It's clear the page is pretty old, with both "http" and "ftp" download links. FWIW, the http link redirects to https, and (warming the heart of this old Unix developer) the ftp link still works.
    - yellowsir 2y ago
      that explains why there is no buidtool.
  - chrismorgan 2y ago
    > I am honestly not sure were you got the 2 year commit gap Probably from https://pagure.io/librejs/commits/master https://pagure.io/librejs/commits/master which is also mentioned on the page and supposed to be a mirror.
medo-bear 2y ago
This seems to work very well. So far no UI issues with browsing my top 20 websites. Observed benefits: prevents adds, some toxic material, and even bypasses some paywalled news sites I visit.
- ygra 2y ago
  Wouldn't you get the same benefits by turning off JavaScript altogether? I'd expect there to be very little trivial JS (by that extension's definition) on the vast majority of sites that use JS.
  - medo-bear 2y ago
    for me this works better than blanket turning off js and there seems to be alot of trivial js on cnn, reuters, and bbc wesbites. you can investigate the js which the addon regards as trivial
- efilife 2y ago
  FYI: it'a called ADs from the word ADvertisement, only one D here
robocat 2y ago
Client-side JavaScript is always distributed[1] source[2] code - because your web page is distributing it to the user's browser. So AFAIK you shouldn't use GPL nor LGPL code in your pages unless all your client-side JavaScript in the page is appropriately licenced. Minified or obfuscated is still source code (you must provide original source as per license). Client-side LGPL JavaScript is neither statically linked nor dynamically linked but potentially could be a "mere aggregation" i.e. it is hard to use LGPL legally. Perhaps you could meet the legal definition of calling a library by using web assembly or web workers (see your IP lawyer!). Unfortunately the FSF appear to be intentionally vague when documenting this issue. For more details see: https://greendrake.info/publications/js-gpl https://greendrake.info/publications/js-gpl https://opensource.stackexchange.com/questions/4360/what-are-the-implications-of-licensing-a-javascript-library-under-gpl#4500 https://opensource.stackexchange.com/questions/4360/what-are... (be careful reading it because part of that answer is about what circumstances client-side GPL mean that the server-side should be GPLed). This issue can affect the HTML and CSS too: It is possible to write Javascript code which is strongly bound to a particular HTML document. The Javascript code in this case would have hard-coded references to parts of the HTML document and would rely on that document's particular structure to work. This would be a strong indication that the Javascript and the document should be considered a single work. Edit: [1] Well conveyed: https://www.gnu.org/licenses/gpl-faq.html#ConveyVsDistribute https://www.gnu.org/licenses/gpl-faq.html#ConveyVsDistribute Edit: [2] or object code (transpiled/minified) but distributing/conveying object code usually requires you to provde source.
- gtsop 2y ago
  All code ran by users is distributed source code. Not sure what is the distinction you are mentioning > Unfortunately the FSF appear to be intentionally vague when documenting this issue. This is only unfortunate when you don't allign with their purpose, in which case there is no reason to talk of using GPL at all. For people who allign with these purposes, this "vagueness" is fortunate
  - d1sxeyes 2y ago
    That's not true for code which gets pre-compiled. For interpreted (or JIT-compiled) code, then yes, by definition, the source needs to be distributed to end users in order to be executed. For compiled code, only the resultant binary needs to be shared after compiling the source.
ecmascript 2y ago
This is like the meme with a guy riding a bike sticking it in the front wheel, getting hurt and in this case blaming javascript. I don't get the hate against javascript tbh. With this, web components won't work I assume unless the license is known before hand? Or is that considered trivial? What about wasm? Does it block that? Javascript is at least better than wasm since you can inspect javascript. So people that hate javascript should really hate wasm.
- nolist_policy 2y ago
  They do not hate javascript/wasm software per se but non-free software.
  - ecmascript 2y ago
    So how do you determine if a wasm blob is non-free?
    - Y_Y 2y ago
      If it's free them it should say so, under what license, and provide you the original source before compilation or whatever.
      - gbalduzzi 2y ago
        So every webpage should send the whole source code at each page render? That's not very efficient. Also, how can the plugin know if the provided source code is correct without compiling it and comparing the outputs?
        Y_Y 2y ago
        A moment's thought will hopefully provide you with the answer to both those questions
        maxlybbert 2y ago
        You clearly aren’t familiar with GNU or the Free Software Foundation. There’s nothing wrong with that: everybody starts out without being familiar with anything. In a nutshell, Richard Stallman worked in MIT’s AI lab in the 1970s. The lab had a certain ethos that he loved ( https://www.gnu.org/gnu/rms-lisp.html https://www.gnu.org/gnu/rms-lisp.html , https://www.gnu.org/philosophy/stallman-kth.en.html https://www.gnu.org/philosophy/stallman-kth.en.html ), but when it became common for software to be sold without the source code, he actually decided to start a foundation to recreate that lab ethos ( https://www.gnu.org/gnu/manifesto.en.html https://www.gnu.org/gnu/manifesto.en.html ). A lot of programmers agree with his view that refusing to give users source code, and legal permission to use that source code without restriction, is a terrible afront to freedom. However, people have spent decades telling Stallman that if they adopted his principles, they couldn’t use their computers in the modern world. Every so often, he makes a declaration about various distinctions (it’s okay to use a computer even though the firmware isn’t free; it’s okay to read documents on the web, but any JavaScript should be treated as a program and you should insist on an acceptable license; he, personally doesn’t own a cell phone, but sees no problem with using somebody else’s non-free phone in a case-by-case basis; etc.). This is simply an extension to enforce one of his rules. Some programmers will feel bad about themselves if they don’t live up to Stallman’s expectations.
ZoomerCretin 2y ago
If it's trivial but nonfree, it still runs. What is meant by non-trivial, and how do you programmatically determine that a script is non-trivial? Like this: https://git.savannah.gnu.org/cgit/librejs.git/tree/common/checks.js#n144 https://git.savannah.gnu.org/cgit/librejs.git/tree/common/ch... * If an identifier on the banned list exists, it is non-trivial. The list is here: https://git.savannah.gnu.org/cgit/librejs.git/tree/common/fname_data.json https://git.savannah.gnu.org/cgit/librejs.git/tree/common/fn... * If an identifier is ever followed by the square bracket indexing operator, it's non-trivial. (Looking at Stallman's requirement, it looks like this should only apply to accessing properties on an object, but the authors don't seem to have found a way to differentiate using [] on an object's identifier and [] on an array's identifier) * If there are more than three loops, it's non-trivial. * If it uses fetch(), chrome, browser, XMLHttpRequest, or eval(), it's non-trivial. Oddly, referencing "document" is commented out, even though Stallman explicitly said any DOM modification makes a script non-trivial. I wonder what broke (outside of what they expected to break).
- ryan-c 2y ago
  I expect this bullshit still works: https://rya.nc/files/librejs-poc.html https://rya.nc/files/librejs-poc.html <script id="harmlessNullScript" type="text/javascript"></script> <skript id="derp" style="display:none;"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // WARNING: Code here needs to avoid the "less than" symbol. (function(){ // LibreJS modifies the text of script tags onced they've been // checked, which offers a very convienant way to detect it. if (harmlessNullScript.textContent.indexOf("LibreJS: ") > 0) { eval("alert('LibreJS detected, but non-free eval works');"); } })(); </skript> <script type="text/javascript"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // An eval that works in the WebExtension port of LibreJS. // Untested on the original XPI version. Function(derp.textContent)(); </script> In any event, there are a lot of ways to eval code...
- xigoi 2y ago
  Does this mean that any JSFuck code would be considered trivial, even though JSFuck can do anything JavaScript can?
VelesDude 2y ago
This is one of those things that I agree with the ideas behind it. Free Libre software and all of that BUT in trying to deal with this via a web addon considering the scale of, the internet, It feels like there is no way this could ever achieve its goals. I mean how much JS out there doesn't even have a license explicitly defined on run time? And when you run it that is exactly what happens. It assumes the worst and the vast majority of things do not work. All it really does is slow your browser down to an absolute crawl as it tries to do its thing. I just ended up with Noscript and making a few exceptions where needed. It is a much better middle ground than this.
- RicoElectrico 2y ago
  The point of Stallmanites is to chase the rabbit, not catch it.
  - VelesDude 2y ago
    I would consider myself a Stallmanite, I guess. I use a fully 100% Libre software stack/OS/Firmware where possible - but Libre JS was just a little too unusable too me. When you are running a 2.4Ghz Core 2 Duo - it runs SLOW!
  - rakoo 2y ago
    And how do we propose we catch the rabbit without chasing it then
justinclift 2y ago
Trying this out, it seemed ok right up until trying iDRAC7 on my homelab servers. :( Even after whitelisting the domain for the iDRAC interface on the servers, just having it installed is completely breaking the remote console (something I need to use multiple times a day). Damn, I wanted this to be ok too.
efilife 2y ago
There's a better solution: uMatrix. You get complete control about what you run

88 points by AbuAssar 2y ago

This blocks JavaScript that isn't explicitly licensed exactly the way they want, right? In terms of the format of the license, the @licstart and @licend comments (with no comment afterwards), etc.? That's what this does?

janosdebugs 2y ago
It also doesn't block well-known libraries. Using this addon sounds like a really good way to have a bad time on the Internet. By the logic of this, why bot block websites which have non-free content or other supporting files? The whole premise of a website is that the owner gives you a licese of some kind to view it. Blocking only a technical part of it makes no logical sense. It's not like you are going to take the JS code under a free license that is likely dependent on the HTML structure under a non-free license and do stuff with it.
- gtsop 2y ago
  Your argument about non-free content does not apply to the gnu purposes with this plugin. Free Software is concerned with the problem of "what does my computer compute, what does it do, can i modify it". The content (images, text, video, html structure) on any website is not software
  - janosdebugs 2y ago
    You can do a lot of dark magic with CSS or SVG too. Specifically, CSS has calc too. Website haven't just been documents for a long long time and basically nobody is going to bother keeping any computation in the JS space only.
  - ranger_danger 2y ago
    > The content (images, text, video, html structure) on any website is not software What about things like htmx that put logic directly into html attributes?
- danlitt 2y ago
  [flagged]
wannacboatmovie 2y ago
[flagged]
- malicka 2y ago
  It’s not mental illness, it’s the logical extension of principle. If you think non-free software is unjustifiable and should be avoided, you’re probably going to try to avoid using it (or, at least, promoting it). There are three exceptions people sometimes make in their avoidance: Using non-free drivers, using non-free software for work/school, and using non-free software in the browser. It’s rational that someone would want to limit these exceptions as best they can, and LibreJS is useful for that. I use LibreJS not to help me completely avoid non-free JS, but to make me more concious of my software use. If a site has non-free code and LibreJS pings me about it, I’ll consider if there’s a better site I should be supporting instead.
  - KronisLV 2y ago
    > If a site has non-free code and LibreJS pings me about it, I’ll consider if there’s a better site I should be supporting instead. I wonder how viable this is in the age of the network effect, where most people and content can be found on like 10 big sites. If I need an answer for something but it's on StackOverflow, YouTube, Reddit or even a Discord server, then that's just where I'll go, principles be damned. For many it's probably the same way with X vs Mastodon, the latter of which does feel more wholesome but can get lonely, or at the very least limits your reach. Same with social media or professional sites like LinkedIn. Same with using one of the more popular browsers, OSes, drivers or a lot of other proprietary software. Not to dismiss anyone who cares deeply about free software, but honestly I wonder what % of people are actually committed to those ideals and how many are just cruising through life with whatever is the most popular option with least troubles for everything.
    - hhreefgguu 2y ago
      > principles be damned This is a very common occurrence: convenience or perceived necessity trumping principles. > I wonder what % of people are actually committed Almost 0%, if by “actually committed” you mean consistently applying these principles in practice, in the face of inconvenience. I nevertheless believe that having principles, however vague and sometimes inconsistently applied, is a good thing, in that it structures thought and informs action. It gives a way to discuss how things “should” be.
LukeShu 2y ago
In addition to the documented+recommended format, it also supports a few others. But yeah, it's pretty picky about how the license statement is formatted.
enriquto 2y ago
> This blocks JavaScript that isn't explicitly licensed exactly the way they want, right? The way you want. Nobody forces you to run this plugin. You can run this plugin, or not, or even change the plugin source code to better fit your needs (something that you cannot do with the javascript programs this add-on is designed to protect you from).

tedunangst 2y ago

Does it also block nontrivial css? That can be Turing complete.

jart 2y ago

Wow it's really cool that Stallman and others created a definition of Free Software for the modern web. Sadly it seems this is old news. There hasn't been any commits to this project's git in the last two years. There's also no date on the article, so I can't easily tell how old this is. https://www.gnu.org/software/librejs/ https://www.gnu.org/software/librejs/ I wish there was more respect for the devotion and principles that go into making something like this. You'd think at least the hacker community would understand, of all people.

gtsop 2y ago
> There hasn't been any commits to this project's git in the last two years I am honestly not sure were you got the 2 year commit gap, the latest commit is 3 months ago on master https://git.savannah.gnu.org/cgit/librejs.git https://git.savannah.gnu.org/cgit/librejs.git > There's also no date on the article, so I can't easily tell how old this is The article is many many years old, archive.org has a snapshot of it from 2012
- eesmith 2y ago
  Another way to verify activity within the last couple of years is to see that the last release at https://ftp.gnu.org/gnu/librejs/?C=M;O=D https://ftp.gnu.org/gnu/librejs/?C=M;O=D is from last fall. OTOH, there hasn't been a test release since 2016, so keeping that section does contribute to the idea that it's no longer active. It's clear the page is pretty old, with both "http" and "ftp" download links. FWIW, the http link redirects to https, and (warming the heart of this old Unix developer) the ftp link still works.
  - yellowsir 2y ago
    that explains why there is no buidtool.
- chrismorgan 2y ago
  > I am honestly not sure were you got the 2 year commit gap Probably from https://pagure.io/librejs/commits/master https://pagure.io/librejs/commits/master which is also mentioned on the page and supposed to be a mirror.

medo-bear 2y ago

This seems to work very well. So far no UI issues with browsing my top 20 websites. Observed benefits: prevents adds, some toxic material, and even bypasses some paywalled news sites I visit.

ygra 2y ago
Wouldn't you get the same benefits by turning off JavaScript altogether? I'd expect there to be very little trivial JS (by that extension's definition) on the vast majority of sites that use JS.
- medo-bear 2y ago
  for me this works better than blanket turning off js and there seems to be alot of trivial js on cnn, reuters, and bbc wesbites. you can investigate the js which the addon regards as trivial
efilife 2y ago
FYI: it'a called ADs from the word ADvertisement, only one D here

robocat 2y ago

Client-side JavaScript is always distributed[1] source[2] code - because your web page is distributing it to the user's browser. So AFAIK you shouldn't use GPL nor LGPL code in your pages unless all your client-side JavaScript in the page is appropriately licenced. Minified or obfuscated is still source code (you must provide original source as per license). Client-side LGPL JavaScript is neither statically linked nor dynamically linked but potentially could be a "mere aggregation" i.e. it is hard to use LGPL legally. Perhaps you could meet the legal definition of calling a library by using web assembly or web workers (see your IP lawyer!). Unfortunately the FSF appear to be intentionally vague when documenting this issue. For more details see: https://greendrake.info/publications/js-gpl https://greendrake.info/publications/js-gpl https://opensource.stackexchange.com/questions/4360/what-are-the-implications-of-licensing-a-javascript-library-under-gpl#4500 https://opensource.stackexchange.com/questions/4360/what-are... (be careful reading it because part of that answer is about what circumstances client-side GPL mean that the server-side should be GPLed). This issue can affect the HTML and CSS too: It is possible to write Javascript code which is strongly bound to a particular HTML document. The Javascript code in this case would have hard-coded references to parts of the HTML document and would rely on that document's particular structure to work. This would be a strong indication that the Javascript and the document should be considered a single work. Edit: [1] Well conveyed: https://www.gnu.org/licenses/gpl-faq.html#ConveyVsDistribute https://www.gnu.org/licenses/gpl-faq.html#ConveyVsDistribute Edit: [2] or object code (transpiled/minified) but distributing/conveying object code usually requires you to provde source.

gtsop 2y ago
All code ran by users is distributed source code. Not sure what is the distinction you are mentioning > Unfortunately the FSF appear to be intentionally vague when documenting this issue. This is only unfortunate when you don't allign with their purpose, in which case there is no reason to talk of using GPL at all. For people who allign with these purposes, this "vagueness" is fortunate
- d1sxeyes 2y ago
  That's not true for code which gets pre-compiled. For interpreted (or JIT-compiled) code, then yes, by definition, the source needs to be distributed to end users in order to be executed. For compiled code, only the resultant binary needs to be shared after compiling the source.

ecmascript 2y ago

This is like the meme with a guy riding a bike sticking it in the front wheel, getting hurt and in this case blaming javascript. I don't get the hate against javascript tbh. With this, web components won't work I assume unless the license is known before hand? Or is that considered trivial? What about wasm? Does it block that? Javascript is at least better than wasm since you can inspect javascript. So people that hate javascript should really hate wasm.

nolist_policy 2y ago
They do not hate javascript/wasm software per se but non-free software.
- ecmascript 2y ago
  So how do you determine if a wasm blob is non-free?
  - Y_Y 2y ago
    If it's free them it should say so, under what license, and provide you the original source before compilation or whatever.
    - gbalduzzi 2y ago
      So every webpage should send the whole source code at each page render? That's not very efficient. Also, how can the plugin know if the provided source code is correct without compiling it and comparing the outputs?
      - Y_Y 2y ago
        A moment's thought will hopefully provide you with the answer to both those questions
      - maxlybbert 2y ago
        You clearly aren’t familiar with GNU or the Free Software Foundation. There’s nothing wrong with that: everybody starts out without being familiar with anything. In a nutshell, Richard Stallman worked in MIT’s AI lab in the 1970s. The lab had a certain ethos that he loved ( https://www.gnu.org/gnu/rms-lisp.html https://www.gnu.org/gnu/rms-lisp.html , https://www.gnu.org/philosophy/stallman-kth.en.html https://www.gnu.org/philosophy/stallman-kth.en.html ), but when it became common for software to be sold without the source code, he actually decided to start a foundation to recreate that lab ethos ( https://www.gnu.org/gnu/manifesto.en.html https://www.gnu.org/gnu/manifesto.en.html ). A lot of programmers agree with his view that refusing to give users source code, and legal permission to use that source code without restriction, is a terrible afront to freedom. However, people have spent decades telling Stallman that if they adopted his principles, they couldn’t use their computers in the modern world. Every so often, he makes a declaration about various distinctions (it’s okay to use a computer even though the firmware isn’t free; it’s okay to read documents on the web, but any JavaScript should be treated as a program and you should insist on an acceptable license; he, personally doesn’t own a cell phone, but sees no problem with using somebody else’s non-free phone in a case-by-case basis; etc.). This is simply an extension to enforce one of his rules. Some programmers will feel bad about themselves if they don’t live up to Stallman’s expectations.

ZoomerCretin 2y ago

If it's trivial but nonfree, it still runs. What is meant by non-trivial, and how do you programmatically determine that a script is non-trivial? Like this: https://git.savannah.gnu.org/cgit/librejs.git/tree/common/checks.js#n144 https://git.savannah.gnu.org/cgit/librejs.git/tree/common/ch... * If an identifier on the banned list exists, it is non-trivial. The list is here: https://git.savannah.gnu.org/cgit/librejs.git/tree/common/fname_data.json https://git.savannah.gnu.org/cgit/librejs.git/tree/common/fn... * If an identifier is ever followed by the square bracket indexing operator, it's non-trivial. (Looking at Stallman's requirement, it looks like this should only apply to accessing properties on an object, but the authors don't seem to have found a way to differentiate using [] on an object's identifier and [] on an array's identifier) * If there are more than three loops, it's non-trivial. * If it uses fetch(), chrome, browser, XMLHttpRequest, or eval(), it's non-trivial. Oddly, referencing "document" is commented out, even though Stallman explicitly said any DOM modification makes a script non-trivial. I wonder what broke (outside of what they expected to break).

ryan-c 2y ago
I expect this bullshit still works: https://rya.nc/files/librejs-poc.html https://rya.nc/files/librejs-poc.html <script id="harmlessNullScript" type="text/javascript"></script> <skript id="derp" style="display:none;"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // WARNING: Code here needs to avoid the "less than" symbol. (function(){ // LibreJS modifies the text of script tags onced they've been // checked, which offers a very convienant way to detect it. if (harmlessNullScript.textContent.indexOf("LibreJS: ") > 0) { eval("alert('LibreJS detected, but non-free eval works');"); } })(); </skript> <script type="text/javascript"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // An eval that works in the WebExtension port of LibreJS. // Untested on the original XPI version. Function(derp.textContent)(); </script> In any event, there are a lot of ways to eval code...
xigoi 2y ago
Does this mean that any JSFuck code would be considered trivial, even though JSFuck can do anything JavaScript can?

VelesDude 2y ago

This is one of those things that I agree with the ideas behind it. Free Libre software and all of that BUT in trying to deal with this via a web addon considering the scale of, the internet, It feels like there is no way this could ever achieve its goals. I mean how much JS out there doesn't even have a license explicitly defined on run time? And when you run it that is exactly what happens. It assumes the worst and the vast majority of things do not work. All it really does is slow your browser down to an absolute crawl as it tries to do its thing. I just ended up with Noscript and making a few exceptions where needed. It is a much better middle ground than this.

RicoElectrico 2y ago
The point of Stallmanites is to chase the rabbit, not catch it.
- VelesDude 2y ago
  I would consider myself a Stallmanite, I guess. I use a fully 100% Libre software stack/OS/Firmware where possible - but Libre JS was just a little too unusable too me. When you are running a 2.4Ghz Core 2 Duo - it runs SLOW!
- rakoo 2y ago
  And how do we propose we catch the rabbit without chasing it then

justinclift 2y ago

Trying this out, it seemed ok right up until trying iDRAC7 on my homelab servers. :( Even after whitelisting the domain for the iDRAC interface on the servers, just having it installed is completely breaking the remote console (something I need to use multiple times a day). Damn, I wanted this to be ok too.

efilife 2y ago

There's a better solution: uMatrix. You get complete control about what you run