RMS has said he doesn't mind using ATMs that use non-free software because he can't be responsible for what other people run on their devices. If we consider th

RMS has said he doesn't mind using ATMs that use non-free software because he can't be responsible for what other people run on their devices. If we consider the website a service, where the javascript runtime is isolated to the web, then it is a similar situation - while it is evaluated on your device, the code itself is not installed on your computer, and it is sandboxed to have very limited access. This only really applies to JS served from the website. Offline apps are a little more iffy, and browser extensions certainly qualify as installed software that you are running. Possibly less so in Chrome, where the extension API has some pretty hard limits on what extension code can access, but in Firefox you have the ability to do almost anything on the user's machine, which is why Mozilla reviews add-ons before approving them and has stricter guidelines for how they should behave.