Re: Web versions, thoughts

[Parodper]

O 02/04/21 ás 21:13, Zany And Crazy escribiu:

> Porting something to the web is not only rewriting from >scratch in JavaScript

Isn't WebAssembly a way to make C++ code run in the browser? I thought
that's what it was.



But code is not the only thing that forms a program. There is also the 
need for the graphical interfaces, which is usually written in HTML+CSS. 
Also, interacting through a web browser is different from a native 
system. You need to take into account the different types of screens and 
devices.


And all of this costs money, in both developers and servers. Executing a 
webpage every time you need to run a program costs more than just 
downloading and running locally.

Re: Web versions, thoughts

[Jacob Bachmeyer]

Zany And Crazy wrote:

Porting something to the web is not only rewriting from >scratch in JavaScript



Isn't WebAssembly a way to make C++ code run in the browser? I thought
that's what it was.


The API available to WebAssembly code is radically different from the 
API for native code, as I have previously mentioned.  A HURD port is 
theoretically possible, and would be needed for most GNU packages to be 
meaningfully ported in this way.



-- Jacob

Re: Web versions, thoughts

[Jean Louis]

* Zany And Crazy  [2021-04-02 22:14]:
> >Porting something to the web is not only rewriting from >scratch in 
> >JavaScript
> 
> Isn't WebAssembly a way to make C++ code run in the browser? I thought
> that's what it was.

How I have understood from reading, it is not hard to modify or
prepare it for WebAssembly, some compilers have that target too.

Jean

Re: Web versions, thoughts

[shulie]

On 4/1/21 12:31 AM, Zany And Crazy wrote:
> I stopped reading after about the 3rd or 4th
> post, so I have no idea what you guys are saying. 30 years have
> passed, Linux and all it's software's market share stands at what, 2%



usenet isn't working any more for you

Re: Web versions, thoughts

[Zany And Crazy]

>Porting something to the web is not only rewriting from >scratch in JavaScript

Isn't WebAssembly a way to make C++ code run in the browser? I thought
that's what it was.

Re: Web versions, thoughts

[Parodper]

O 01/04/21 ás 06:31, Zany And Crazy escribiu:

OK, I posted that post about putting software on the web because I
thought it's a cool idea. I stopped reading after about the 3rd or 4th
post, so I have no idea what you guys are saying. 30 years have
passed, Linux and all it's software's market share stands at what, 2%?
The world has moved on  - to the web. So, it's obvious that all the
folks WRITING those software, who're not doing it for the money, AT
LEAST WANT AN AUDIENCE! And putting it on the web will GIVE you that!
So - what the fuck are you arguing with *ME* for?? If there IS a
problem with making it "free" - FIGURE OUT A WAY OUT OF IT! I'm on
YOUR side - let's do it, shall we? :)
Microsoft is going to "move to the cloud" soon - if THIS isn't Linux's
chance, I don't know WHAT THE FUCK IS!
Come on guys, get together and put your heads together now :) I wanna
see all those things running nice n quick inside my BRAVE browser Real
Soon :)



You seem to think this is easy. It is not. Porting something to the web 
is not only rewriting from scratch in JavaScript, which by itself is 
difficult, but you would have to redesign the programs to fit the web. 
That would require maintaining two separate versions of the same program.


Also, since on your message you talk about Microsoft moving to the 
cloud, I'd guess you are talking about Office. That would mean 
LibreOffice and OpenOffice to us, because most of the GNU programs 
*can't work* on the web, since they are so tied to an operating system. 
For those you already have web terminals.


You also think that the cause of the low market share of GNU programs 
(vague and therefore false, there are famous and not-so-famous programs) 
is the lack of an audience, but putting something on the web does not 
make it automatically announce itself. Microsoft did not change the 
popularity of its programs by moving them to the web, they were already 
famous so it made them economic sense to move them to the web.

Re: How to ensure not to fall into new Webassembly trap - was Re: Web versions

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider]]]
[[[ whether defending the US Constitution against all enemies, ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

We treat WebAssembly code just like minified code.  It is not
source code, so it ought to carry a pointer to the source code.

LibreJS does not have a way of verifying that the pointer points to
real source code or that the source code corresponds to the binary.
This is a shortcoming.


-- 
Dr Richard Stallman
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)

Re: Web versions

[shulie]

On 3/16/21 1:41 PM, Jean Louis wrote:
> Generalization is not good.



generalizations are 100% valid means of evaluating groups of things and
individal facts.

Re: Web versions

[shulie]

On 3/16/21 6:11 AM, Schanzenbach, Martin wrote:
> Obviously the OP was a tongue-in-cheek kind of question. But this should not 
> prevent us from
> lucidly reflecting on the topic 



Actually, it is a reason, and in addition, there is no way to lucidly
reflecting on an action that is patentedly insane.

Re: Web versions

[shulie]

On 3/16/21 6:55 AM, Jean Louis wrote:
> Emacs may not be equivalent to common web browser, but it does have
> web browser built-in,



yeah so?  Did you think we don't know that?  It doesn't dowload code and
run it without notice.

Re: Web versions

[Jean Louis]

* Jacob Bachmeyer  [2021-03-18 01:32]:
> > I would like to have Emacs in Webassembly. Somebody is already working
> > in that direction with Emacs fork: https://github.com/emacs-ng/emacs-ng
> > 
> > Regarding "web security policies, I would not know what it means.
> 
> Rules like the same-origin policy and the other browser sandbox rules that
> limit the harm that can be done by "Web" programs to the user.  These rules,
> for example, could make using a browser-based R difficult because it might
> not be able to connect and retrieve public datasets.

Last days I have been researching those Webassembly programs and I
found that it is possible to upload data into browser, including fetch
data from remote sources, and including communicate with foreign
ports. It is possible to run databases, use local and remote files.

Maybe you know more about details. That is impression I have got.

> > If there is Emacs in Webassembly, it gives me freedom to operate my
> > business remotely. Security is provided by SSL and username/password
> > related to the database that I would access.
> 
> ...until the cybercafe computer you used to access your server turns out to
> have been recording your keystrokes and now Mallory also has your
> username/password...

I am well aware of keystroke recording programs, and those which read
the passing insecure network data.

Re: Web versions

[Jacob Bachmeyer]

Jean Louis wrote:

* Jacob Bachmeyer  [2021-03-17 05:16]:
  

Alfred M. Szmidt wrote:


   2.  Browsers do not offer POSIX API to JS/WebAssembly for very
goodreasons.

The other issue is that it wouldn't really be an operating system, if
it runs in a web browser.  Which kinda is the whol point of the GNU
project. :-)
  

The GNU project also provides some application software.  Octave or Emacs,
to name two examples, could usefully be offered as "run this in your
browser" in addition to the regular native ports, but general lower
performance and Web security policies are likely to make browser ports of
packages like R and libGMP useful only as demonstrations.



Webassembly's performance is according to the reference about 10% less
than native.
code. https://www.usenix.org/conference/atc19/presentation/jangda

In the sense I don't think that argument "lower performance" stands
there.
  


Considering that absolute maximum performance is one of libGMP's goals, 
yes, lower performance is an issue.  Last I checked, they were looking 
for a way to perform multiplications with operands on disk that are too 
large to fit in memory and they have multiple assembler variants of the 
same low-level routines for different processors.



I would like to have Emacs in Webassembly. Somebody is already working
in that direction with Emacs fork: https://github.com/emacs-ng/emacs-ng

Regarding "web security policies, I would not know what it means.
  


Rules like the same-origin policy and the other browser sandbox rules 
that limit the harm that can be done by "Web" programs to the user.  
These rules, for example, could make using a browser-based R difficult 
because it might not be able to connect and retrieve public datasets.



If there is Emacs in Webassembly, it gives me freedom to operate my
business remotely. Security is provided by SSL and username/password
related to the database that I would access.


...until the cybercafe computer you used to access your server turns out 
to have been recording your keystrokes and now Mallory also has your 
username/password...



-- Jacob

Re: How to ensure not to fall into new Webassembly trap - was Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-17 16:33]:
>>What we can do in GNU in regards to new technologies considered trap,
>>as users will be lured to launch non-free software without possibility
>>to verify it is to expand or extend the LibreJS to verify Webassembly
>>programs for their licenses.
>> 
>> It is easier, and far more practical to recommend to solve the problem
>> in a different manner than try and verify all running code in the
>> world.
> 
>How? I have proposed how I think it should be implemented.
> 
> So why not go forward and try implementing it?  You could post a call
> for help here and see if you can find people who are able to help you.

But I have no clue of Javascript development and making plugins for
browser.

What I can do, I can place order and hire programmer to make it for
me, that is easy and I know where to reach for them.

Re: How to ensure not to fall into new Webassembly trap - was Re: Web versions

[Alfred M. Szmidt]

   >What we can do in GNU in regards to new technologies considered trap,
   >as users will be lured to launch non-free software without possibility
   >to verify it is to expand or extend the LibreJS to verify Webassembly
   >programs for their licenses.
   > 
   > It is easier, and far more practical to recommend to solve the problem
   > in a different manner than try and verify all running code in the
   > world.

   How? I have proposed how I think it should be implemented.

So why not go forward and try implementing it?  You could post a call
for help here and see if you can find people who are able to help you.

Re: How to ensure not to fall into new Webassembly trap - was Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-17 12:04]:
>What we can do in GNU in regards to new technologies considered trap,
>as users will be lured to launch non-free software without possibility
>to verify it is to expand or extend the LibreJS to verify Webassembly
>programs for their licenses.
> 
> It is easier, and far more practical to recommend to solve the problem
> in a different manner than try and verify all running code in the
> world.

How? I have proposed how I think it should be implemented.

>RMS has to get involved on this, as to devise a method how to make
>sure that Webassembly programs are free software.
> 
> Why don't you take it up and try to devise this method?  It would not
> only be useful for web browsers, but programs in general.

I did not think of technical method, rather strategic, something
similar to LibreJS. I have already made proposal in that same email
that you are referencing now. For me personally I will have to clean
some lists of Webassembly sites to keep it safe.

>A white list of websites offering Webassembly as free software could
>be compiled as well.
> 
> It is easier to simply deal with the problem by avoiding running
> random code automagically.  But if you think such a list is possible,
> would you like to start working on it?

I do not program in Javascript.

It is for me natural that such a script or plugin should NOT allow the
execution of Webassembly program unless the program is in the white
list. A plugin could also keep hashes of reproducible Webassembly
programs.

Thus I am and already did mention that Webassembly should be default
be disabled, unless plugin similar to LibreJS tells: this binary here
is safe, it is free software, or maybe that plugin verifies its hash
being reproducible as free software. Users should be able to allow
websites to run Webassembly as they wish, as I may download SSH as
Webassambly and wish to run it from the USB stick for example.

>Firefox is already warning users of abusive websites reported by
>users, which run Webassembly.
> 
> If you can convince the firefox developers to do it, it sounds like it
> would be useful.

We can open up ticket and see reactions. But I do not believe
so. Mozilla as foundation does not give me impression to be keen not
to allow non-free software execution, as that is the fundamental
reason why they included Webassembly in the first place. They want to
be in the group of "vendors":
https://developer.mozilla.org/en-US/docs/WebAssembly just as Google,
Apple and Microsoft: https://research.mozilla.org/webassembly/

Convincing an organization to change their fundamental reason why they
included into Firefox is not likely. The fundamental reason is like
you said, to quickly run programs without consent. Now to convince
them to run programs with consent would impede their position as one
of "vendors" in the browser competition. No matter that Mozilla is a
non-profit, they obviously act as profit, not really looking for
users' freedom.

There is option in Firefox to exclude Webassembly, thus that opens up
option to have a plugin but there are no plugins yet. I wonder why in
so many years there is no plugin for users to be warned and to
consent.

I did not see that this plugin works, it did not detect Webassembly in
my Firefox:
https://addons.mozilla.org/en-US/firefox/addon/webassembly-detector/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search

Thus there is so far none workable plugin that would tell to user,
that Webassembly wants to be executed, and ask for consent.

Jean

Re: How to ensure not to fall into new Webassembly trap - was Re: Web versions

[Alfred M. Szmidt]

   What we can do in GNU in regards to new technologies considered trap,
   as users will be lured to launch non-free software without possibility
   to verify it is to expand or extend the LibreJS to verify Webassembly
   programs for their licenses.

It is easier, and far more practical to recommend to solve the problem
in a different manner than try and verify all running code in the
world.

   RMS has to get involved on this, as to devise a method how to make
   sure that Webassembly programs are free software.

Why don't you take it up and try to devise this method?  It would not
only be useful for web browsers, but programs in general.

   A white list of websites offering Webassembly as free software could
   be compiled as well.

It is easier to simply deal with the problem by avoiding running
random code automagically.  But if you think such a list is possible,
would you like to start working on it?  

   Firefox is already warning users of abusive websites reported by
   users, which run Webassembly.

If you can convince the firefox developers to do it, it sounds like it
would be useful.

How to ensure not to fall into new Webassembly trap - was Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-17 11:26]:
>In that particular example I have been checking programs that are free
>software as they are hosted on Github with free software licenses. I
>gave you hyperlinks as references, you could verify it yourself.
> 
> No, I (and really, it is not about you or me here -- it is about the
> casual user) cannot -- since the web browser runs the program before I
> can do so.

Sure I get it. I also speak for casual users. Casual users will go for
software no matter what. You have to be aware that GNU/Linux
distributions are there which contain proprietary software, and casual
users do not think about that, they simply go for software.

The way to go is how we do it in GNU anyway:

- promotion GNU free software philosophy

- endorsing and referencing full free software operating systems

- creating software to protect users from malicious events

What we can do in GNU in regards to new technologies considered trap,
as users will be lured to launch non-free software without possibility
to verify it is to expand or extend the LibreJS to verify Webassembly
programs for their licenses.

RMS has to get involved on this, as to devise a method how to make
sure that Webassembly programs are free software.

A white list of websites offering Webassembly as free software could
be compiled as well.

When we install fully free GNU operating system it is installed in
specific environment where we assume that all parts of the environment
are free software.

A white list would be list of websites that offer only fully free
software of Javascript and Webassembly. This list becomes environment
in which free software users could receive services, run software as
they wish in Webassembly or Javascript and basically enjoy the fully
free software environment through the browser. A plugin like LibreJS
or other plugin could make sure of that. Plugin could also ask users
to report new free software websites to distinguish from those
proprietary and abusive one.

Firefox is already warning users of abusive websites reported by
users, which run Webassembly.

Jean

Re: Web versions

[Alfred M. Szmidt]

   In that particular example I have been checking programs that are free
   software as they are hosted on Github with free software licenses. I
   gave you hyperlinks as references, you could verify it yourself.

No, I (and really, it is not about you or me here -- it is about the
casual user) cannot -- since the web browser runs the program before I
can do so.

   Level of verification is never perfect, regardless of the type of
   software. How do I know that software delivered in Guix or Parabola
   GNU OS is free software? I do not know, I can just assume as
   developers claim to be so, and OS-es are endorsed by FSF.

They don't only claim it, they also have policies that implement what
things are added.  Additionally, you can download the software before
you execute it. 

You speak of verification, but there is none when it comes to pasting
a URL into a web browser.  Making it easy to run non-free software is
not something that is useful.

The reset of your message goes into tangets, and so I won't answer it.
You also again confuse that the issue is webassembly, it is not.  It
is how it is used, which is like Javascript.

Re: Web versions

[Jean Louis]

* Jacob Bachmeyer  [2021-03-17 05:16]:
> Alfred M. Szmidt wrote:
> >2.  Browsers do not offer POSIX API to JS/WebAssembly for very
> > goodreasons.
> > 
> > The other issue is that it wouldn't really be an operating system, if
> > it runs in a web browser.  Which kinda is the whol point of the GNU
> > project. :-)
> 
> The GNU project also provides some application software.  Octave or Emacs,
> to name two examples, could usefully be offered as "run this in your
> browser" in addition to the regular native ports, but general lower
> performance and Web security policies are likely to make browser ports of
> packages like R and libGMP useful only as demonstrations.

Webassembly's performance is according to the reference about 10% less
than native.
code. https://www.usenix.org/conference/atc19/presentation/jangda

In the sense I don't think that argument "lower performance" stands
there.

I would like to have Emacs in Webassembly. Somebody is already working
in that direction with Emacs fork: https://github.com/emacs-ng/emacs-ng

Regarding "web security policies, I would not know what it means.

If there is Emacs in Webassembly, it gives me freedom to operate my
business remotely. Security is provided by SSL and username/password
related to the database that I would access.

Jean

Re: Web versions

[Jean Louis]

* Jacob Bachmeyer  [2021-03-17 05:09]:
> Jean Louis wrote:
> > * Jacob Bachmeyer  [2021-03-16 10:30]:
> > >3.  Web apps stored on "the cloud" are bad because they often do not
> > > respect the user's freedoms, as even if the software is under Free license
> > > terms, technical issues can make running a modified version difficult or
> > > impossible.
> > 
> > Just because there is possibility of abuse one shall reject the
> > technological opportunity?!
> 
> That is ridiculous, but we should still take steps to mitigate possibilities
> for abuses.  After all, we have the GPL to mitigate the abuse of "walking
> off" with a copy of a Free program and making a proprietary derivative, and
> GPL3 was introduced to mitigate the abuse of Tivoisation.

Exactly. We can mitigate it:

- plugins for safety of work with Webassembly for now do not
  exist. There is this Webassembly detector:
  
https://addons.mozilla.org/en-US/firefox/addon/webassembly-detector/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search
  and there is possibility to disable it completely.

  In my opinion we shall have a plugin that asks user if to run it or
  not and start making list of safe websites with Webassembly.

> >  Or maybe you wanted to define "GNU operating
> > system" as only those software packages developed by GNU, but not
> > those software packages delivered with the GNU operating systems like
> > Parabola in my case?
> 
> The original request that started this discussion was a suggestion to port
> all of the software developed by GNU to WebAssembly to run in browsers.
> There are some packages, such as coreutils, for which that is obviously
> nonsensical.  This does not mean that we could not support WebAssembly as a
> general compilation target, or that we could not build effectively a
> browser-based HURD port, (and HURD's architecture fits such an environment
> fairly well, treating the browser itself as a Mach-analogue) but generally
> relying on browsers is dangerously close to SaaSS.

In one of the referenced hyperlinks I have shown that somebody has
already started with GCC, binutils in Webassembly. I do not see why
coreutils do not make sense. Why you think so? How to handle all the
scripts when compiling software?

Maybe review the fact that Webassembly need not run in browser, it can
run standalone, that makes such programs cross platform, thus
useful. Coreutils are then easily deployed on various systems.

Binutils, GDB is already there:
https://github.com/pipcet/binutils-gdb

> but generally relying on browsers is dangerously close to SaaSS.

It is generalization. If you know a bug, why not report specific bug?

Web browser with Webassembly is not anymore a web browser only, just
as Emacs is not just editor.

> The original request was for GNU packages to be offered as SaaSS.

Making GNU packages run in Webassembly does not make it automatically
hosted or served by third party. There is difference between SaaSS and
software alone.

As software it is useful to have possibility to run GNU, various other
free software, including Emacs in Webassembly, or complete OS-es.

If some company or party will run any software as SaaSS that is their
choice. Serving it or selling it in that way is separate issue of
having software for Webassembly.

Having software means: user can run it from their own computer after
downloading and making informed decision as Alfred said. Users can
host it on local area network. But need not. Users can host it on
their websites, LAN or similar. But need not to, they can execute it
even from USB. Thus usefulness of having software that runs on every
OS is separate from SaaSS.

Jean

Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-16 21:12]:
>Webassembly runs in the browser, I click on the URL and
>application is in the browser, 
> 
> And thats the problem.  How do you check that the program you just ran
> (pretense) is free software?

In that particular example I have been checking programs that are free
software as they are hosted on Github with free software licenses. I
gave you hyperlinks as references, you could verify it yourself.

Level of verification is never perfect, regardless of the type of
software. How do I know that software delivered in Guix or Parabola
GNU OS is free software? I do not know, I can just assume as
developers claim to be so, and OS-es are endorsed by FSF.

On the next level of verification one will find that proprietary
pieces may be found in such OS-es and those issues are handled by bug
tracker.

But I still cannot verify if software is really free software, I would
need to verify each upstream and compare it with the one that I got.

Then again, how do I know that binary is really free software? I would
need to do it on the next higher level of verification.

Maybe I would need to re-compile myself and get reproducible build
that I become more sure that it is free software, and also not
tampered or malicious one.

There is practically no difference between Webassembly and packages
delivered with GNU OS.

> When you download something, you have not executed the program yet,
> and can make an informed decision if you wish to run it or not,
> e.g.,

There are various gradients of informed decision as I have
demonstrated above. Teenagers will be informed enough if the software
they downloaded can run on their computer. They may not go into any
verifications. Majority of people will not verify anything.

Once I was verifying all software and there were still proprietary
issues. That is why we are safer with FSF endorsed GNU OS and other
endorsed OS distributions.

We rely on trust to FSF or our basic knowledge about the distribution
mostly. Majority of people will not go into extensive verifications of
each single package.

Thus making adequately informed decision is difficult task for any
software.

For Webassembly, I have been following the list of examples and found
the SSH in browser, it is free software and I find it very handy. I
can finally use mutt/ssh and handle my stuff on servers through a
browser.

My way of making informed decision is looking for useful pieces of
software that is free and then using it.

> if it is free software or not by looking at whatever tar-ball it came
> with, examining the license, etc.

You can do that with Webassembly in the same way.

> That is not normally the case with Javascript or Webassembly -- when
> you access the program, you're already executing it

It should be by consent of the user -- that is open task to do, to
make some plugins to help user consent to each website
specifically. LibreJS is good plugin for Javascript, but I think it
will not handle Webassembly.

In desktop OS, when I access the system like any computer, I am
already executing software. Unless I am informed that it is GNU/Linux
or other free system, I am already executing it. Majority of users are
in this situation, they are not root or administrators or aware users.

Majority of GNU/Linux users are in  the same situation as you
described it, there are many distributions and they are not fully free
-- so users will not necessarily know differences.

Thus Javascript or Webassembly shall simply by sorted by GNU into same
lists, or packages that we are distributed in FSF endorsed
distributions. It is the same process of selection of software just as
how developers do it now.

How do we choose software? By accessing and downloading the indexed
and curated list of software that is assumed to be free software
because of developers who have set their set of principles.

How can we choose Webassembly as free software? By having lists of
websites that provide useful Webassembly programs. If such list is not
curated by free software enthusiast then one may find some proprietary
software inside just as it happened to me with that PDF kit.

Firefox is free browser, so GNU OS may ship derivative with
Webassembly disabled or with a plugin that may ask if to run software
or not.

about:config and one can disable javascript.options.wasm not to run
it. Easy.

To mitigate risks not to run Webassembly or Javascript automatically
one can use plugins (if such exists).

We could create plugin that white lists the free software websites
running Webassembly, where users can report the website to be free
software for further review, and otherwise to keep Webassembly
blocked.

Jean

Re: Web versions

[Jacob Bachmeyer]

Alfred M. Szmidt wrote:
   2.  Browsers do not offer POSIX API to JS/WebAssembly for very good 
   reasons.


The other issue is that it wouldn't really be an operating system, if
it runs in a web browser.  Which kinda is the whol point of the GNU
project. :-)
  


The GNU project also provides some application software.  Octave or 
Emacs, to name two examples, could usefully be offered as "run this in 
your browser" in addition to the regular native ports, but general lower 
performance and Web security policies are likely to make browser ports 
of packages like R and libGMP useful only as demonstrations.



-- Jacob

Re: Web versions

[Jacob Bachmeyer]

Jean Louis wrote:

* Jacob Bachmeyer  [2021-03-16 10:30]:
  

   3.  Web apps stored on "the cloud" are bad because they often do not
respect the user's freedoms, as even if the software is under Free license
terms, technical issues can make running a modified version difficult or
impossible.



Just because there is possibility of abuse one shall reject the
technological opportunity?!
  


That is ridiculous, but we should still take steps to mitigate 
possibilities for abuses.  After all, we have the GPL to mitigate the 
abuse of "walking off" with a copy of a Free program and making a 
proprietary derivative, and GPL3 was introduced to mitigate the abuse of 
Tivoisation.



[...]
 Or maybe you wanted to define "GNU operating
system" as only those software packages developed by GNU, but not
those software packages delivered with the GNU operating systems like
Parabola in my case?
  


The original request that started this discussion was a suggestion to 
port all of the software developed by GNU to WebAssembly to run in 
browsers.  There are some packages, such as coreutils, for which that is 
obviously nonsensical.  This does not mean that we could not support 
WebAssembly as a general compilation target, or that we could not build 
effectively a browser-based HURD port, (and HURD's architecture fits 
such an environment fairly well, treating the browser itself as a 
Mach-analogue) but generally relying on browsers is dangerously close to 
SaaSS.



I am sure that my Hyperscope system can be modified to run in any
browser. It will become possible to develop Dynamical Knowledge
Repositories as envisioned by Engelbart and request documents of any
kinds and see/view them without modifying the OS. Open up DJVU
document on any computer, use Emacs from any worldwide Internet cafe
or point, play your favorite game without installing anything on a
host computer.
  


Those are great.  That is something that *fits* the Web platform model.


[...]
For me, Webassembly does not dictate necessarily "external network
resources". Why not speak of the concept of running software in
Webassembly without using external network resources, such as it is
GNU Health, that could eventually in future, run inside of Firefox or
modified Firefox browser in local area network. That is useful. There
would be no need to install clients on every computer, it would be
just enough to run the computer even from the USB stick, fire up
browser, and one could manage the hospital. Software could be
downloaded for execution from local area network. GNU Health is part
of GNU system and GNU package, GNU software, routine operation of
hospital management is to run GNU Health to manage patients and their
health improvements.
  


GNU Health is another good example of a package that could usefully be 
ported to a Web-ish runtime, and SaaSS is not a problem if the servers 
are running Free software under your own control on your own LAN, as 
would be expected in a hospital installation.



I believe that "Who Does That Server Really Serve?" better applies
to these issues than "The JavaScript Trap" does: the former warns
against relying on systems outside of the user's control, even if
those systems are also running Free software, while the latter
applies to a widespread means of "sneaking" non-free software into
otherwise-Free environments under the user's proverbial nose.



Sure I understand that viewpoint. I just don't think of proprietary
viewpoint. There is plethora of free software already written for
Webassembly. https://github.com/search?p=2&q=webassembly&type=Repositories

You can install applications yourself, you can install them on your
computer or your local area server or your own server.
  


The original request was for GNU packages to be offered as SaaSS.


As platform for development of free software Webassembly is great
tool. Let us think of free software.
  


I agree with this point.


Or Vim editor ported to Webassembly:
https://github.com/rhysd/vim-wasm why we don't have Emacs running?
  


Probably because Emacs is a full Lisp runtime and vim is much simpler.  
I had to learn to use vim for a while when I had just gotten a new AMD64 
system and Emacs had not yet been ported to x86-64.  (Nor had X yet been 
adapted to support building both 32-bit and 64-bit libraries; Emacs 
gained x86-64 support before I had X multilibs.)



-- Jacob

Re: Web versions

[Alfred M. Szmidt]

   [...] I click on the URL and application is in the browser ...

I think that sentence sums up the overall problem.

In Emacs, since you gave that as an example, when you install a
package, the list is curated.  Same with your GNU/Linux system.  When
you copy a snippet of Emacs lisp code, you will see the license text
and can decide what to do before running the program.

Had non-free software been irrelevant, web browsers executing random
code (if we can wish for a world where non-free software is
irrelevant, we can wish for software without security issues :), then
the Javascript trap wuldn't have been a trap.

Re: Web versions

[Alfred M. Szmidt]

   It is free software and specific use example. In those examples I
   cannot see anything bad.

You show one example, when the majority do not follow that example.
It is the overal practise of how "web applications" work that is the
problem, not unicorn instances that just happen to be OK.  Javascript
and Webassembly (or maybe more specifically, web browsers) facilitate
the issue but running unknown code so trivially from someone else.

I am sure we could find examples of where DRM can be put to good
use... 

Re: Web versions

[Alfred M. Szmidt]

   Webassembly runs in the browser, I click on the URL and
   application is in the browser, 

And thats the problem.  How do you check that the program you just ran
(pretense) is free software?  

When you download something, you have not executed the program yet,
and can make an informed decision if you wish to run it or not, e.g.,
if it is free software or not by looking at whatever tar-ball it came
with, examining the license, etc.

That is not normally the case with Javascript or Webassembly -- when
you access the program, you're already executing it

Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-16 19:11]:
> Nobody has argued that there are no other models where
> Javascrip/Webassembly could be used in an ethical fashion, but a
> discussion that talks about anything, and everything will end up in
> nothing.
> 
> The way that Javascript, and Webassembly is intended to be use is the
> problem.

Generalization is not good. Then we can say this world is the problem
because there are some problems in the world.

Useful Webassembly application, SSH in browser:
https://www.ssheasy.com/
https://madewithwebassembly.com/showcase/ssheasy/

It is free software. It runs on user's computer. That means I can host
it myself anywhere and access my servers through SSH without using my
personal computer. Then I can read and write emails, handle notes,
handle customers, make sales on the run.

That is very specific use case.

What I have been doing before is I have been downloading Putty.exe to
access my remote servers from Internet cafes' Windoze
computers. Sometimes it worked to run the Putty sometimes not,
permissions were not enough. This way it will work stable.

Many Webassembly applications can accept uploading of a file into your
own browser. So files and data need not necessarily go to remote
server.

Or DICOM parser:
https://www.orthanc-server.com/external/wasm-dicom-parser/

After making X-ray image in hospital, image is given to patient
sometimes on the DVD-ROM. DICOM viewer runs in the browser,
client-side, read the page. It can help doctors to review X-ray
images.

It is free software and specific use example. In those examples I
cannot see anything bad.

Jean

Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-16 20:17]:
>I have downloaded so much software in last 24 hours as I was
>installing new OS (Parabola), so I have downloaded it from some server
>and I run it.
> 
> How is that related the topic of Javascript / Webassembly and porting
> the GNU system to it?

You don't see similarity, that is why you got the
examples. Webassembly runs in the browser, I click on the URL and
application is in the browser, I can run it on my computer. Quick
check shows it is free software. I can move application to my own
server or inspect the source. Four freedoms granted. Then I can run it
any time from any computer, be it my computer or not. Isn't that nice?

The difference is that I run such application by one click, it is
easier than using package manager to download application and then run
the application from personal computer.

> How is this similar to how Javascript / Webassembly works when you
> access a URL in a web browser where it?

It is practically same thing with the difference that Webassembly
application will work on any OS that has browser that supports it. I
do not need to think of dependencies, it just works.

>>There are now many Javascript application such as notes, where all
>>users' data remain in the browser, nothing is stored on the remote
>>server. That is good development.
>> 
>> It is not, since such a program could just as well be run locally,
>> without the dependancy on someone else infrastructure.  If that server
>> goes away, you're shit out of luck.
> 
>I am sure you are mistaken there. I said, there are now applications
>(at least I know about them now), that run quite everything on your
>computer, through browser. So there is no server dependency.
> 
> But you wrote "remote server", which is it?  The whole disucssion is
> about _HOW_ technology is used, not _WHAT_ technology is used.

Remote server, yes. Application is loaded from remote server. But it
could be as well on your own computer. You can keep Webassembly
applications on your personal computer. Remote server need not be
third party's server. Important is that application is accessible and
that it can be run.

When I download packages of Parabola GNU/Linux-libre, several mirrors
are used, they are all remote servers, applications are loaded on
computer and I can run it.

Same with Webassembly. Difference is that Webassembly applications are
cross platform.

I don't think that I understood functionality of it wrong. I think you
are pushing in some direction where Webassembly does not belong, in my
opinion you have to study it better to understand what it is.

Jean

Re: Web versions

[Alfred M. Szmidt]

   I have downloaded so much software in last 24 hours as I was
   installing new OS (Parabola), so I have downloaded it from some server
   and I run it.

How is that related the topic of Javascript / Webassembly and porting
the GNU system to it?  How is this similar to how Javascript /
Webassembly works when you access a URL in a web browser where it?

   >There are now many Javascript application such as notes, where all
   >users' data remain in the browser, nothing is stored on the remote
   >server. That is good development.
   > 
   > It is not, since such a program could just as well be run locally,
   > without the dependancy on someone else infrastructure.  If that server
   > goes away, you're shit out of luck.

   I am sure you are mistaken there. I said, there are now applications
   (at least I know about them now), that run quite everything on your
   computer, through browser. So there is no server dependency.

But you wrote "remote server", which is it?  The whole disucssion is
about _HOW_ technology is used, not _WHAT_ technology is used.

   That is one good example. You can edit notes and save it, all locally,
   it works offline.

I don't think anyone claimed that one cannot find examples where
something still is ethically sound, running in a web browser, and in
Javascript or some other language.  The issue is that this is not the
intent, or how Javascript / Webassembly is mainly used.  So why bring
up such examples?  It is not the issue here, it is not the issue of
the Javascript trap either.

Re: Web versions

[Alfred M. Szmidt]

   2.  Browsers do not offer POSIX API to JS/WebAssembly for very good 
   reasons.

The other issue is that it wouldn't really be an operating system, if
it runs in a web browser.  Which kinda is the whol point of the GNU
project. :-)

   3.  Web apps stored on "the cloud" are bad because they often do not 
   respect the user's freedoms, as even if the software is under Free 
   license terms, technical issues can make running a modified version 
   difficult or impossible.

Indeed.

   Therefore:
   Porting to "the Web" is simply not practical or appropriate for most 
   GNU software.  This does not exclude the possibility of writing useful 
   Free software for "the Web" but the GNU project is focused on the GNU 
   operating system.

   The GNU operating system is not supposed to depend on external network 
   resources for routine operation.  I believe that "Who Does That Server 
   Really Serve?" better applies to these issues than "The JavaScript Trap" 
   does:  the former warns against relying on systems outside of the user's 
   control, even if those systems are also running Free software, while the 
   latter applies to a widespread means of "sneaking" non-free software 
   into otherwise-Free environments under the user's proverbial nose.

Very good point, I forgot about that article.

Re: Web versions

[Alfred M. Szmidt]

Please use a kinder tone on this list, your language is simply not
acceptable here.

Re: Web versions

[Alfred M. Szmidt]

Nobody has argued that there are no other models where
Javascrip/Webassembly could be used in an ethical fashion, but a
discussion that talks about anything, and everything will end up in
nothing.

The way that Javascript, and Webassembly is intended to be use is the
problem.  

Re: Web versions

[Jean Louis]

>Or collaborative PDF annotation environment:
>https://pspdfkit.com/guides/web/current/pspdfkit-for-web/getting-started/

 This reference below is most probably not free software, I have assumed it to 
be so as I found reference on Github in the collection of various free software 
reference, mistake. I don't recommend this.

Re: Web versions

[Jean Louis]

* Jacob Bachmeyer  [2021-03-16 10:30]:
>3.  Web apps stored on "the cloud" are bad because they often do not
> respect the user's freedoms, as even if the software is under Free license
> terms, technical issues can make running a modified version difficult or
> impossible.

Just because there is possibility of abuse one shall reject the
technological opportunity?!

Why then reject all software at all, as I could jokingly paraphrase
that as:

--- jokingly paraphrased --
   3.  Programs on the distk are bad because they often do not
respect the user's freedoms, as they are often proprietary, as even
if the software is under Free license terms, lack of user's skills
and technical issues can make running a modified version difficult
or impossible.
--

GNU/Linux has been abused by people since its inception, it is still
insecure, and we still use it. It is being used worlwide millions or
billions times to subjugate users who run software remotely on
GNU/Linux systems -- all that is not relevant.

Possibility of some abuse or evil conduct is not reason to say not to
create free software on a free software platform (Webassembly).

Is it useful to create software? If yes, why not.

> Therefore:
>Porting to "the Web" is simply not practical or appropriate for most GNU
> software.  This does not exclude the possibility of writing useful Free
> software for "the Web" but the GNU project is focused on the GNU operating
> system.

GNU Operating Systems are various, they may already contain
Webassembly if some of GNU systems include Firefox with it. For
example in Parabola GNU/Linux-libre, the system I use on this computer
there is package "wabt" with description "The WebAssembly Binary
Toolkit is a suite of tools for WebAssembly".

Thus GNU project already delivers tools for further development of
Webassembly. "GNU Operating System" is the one I am running here, and
I can install that package for Webassembly within seconds.

Logic fails there. Or maybe you wanted to define "GNU operating
system" as only those software packages developed by GNU, but not
those software packages delivered with the GNU operating systems like
Parabola in my case? 

Webassembly already has envisioned POSIX API. Please see:
https://webassembly.org/docs/use-cases/ where it says: "POSIX
user-space environment, allowing porting of existing POSIX
applications" -- so why not?

Then read: "Developer tooling (editors, compilers, debuggers, …)." --
so that means one can in future, as how it is envisioned, develop new
programs for platforms X by using editors and compilers. For me that
means using GCC and Emacs or similar tools. Existing POSIX
applications will work in Webassembly.

> Therefore:
>Porting to "the Web" is simply not practical or appropriate for most GNU
> software.  This does not exclude the possibility of writing useful Free
> software for "the Web" but the GNU project is focused on the GNU operating
> system.

Things are not practical when they are not implemented and not
integrated. Webassembly makes it practical as it provides
integration. It may not be the best method to run compatible
applications on multiple OS-es. But then who is to make it better?
There were various attempts to have toolkits that work well across
OS-es and they are still there, this attempt with Webassembly makes it
possible. It is of course there because Apple, Google and Microsoft
and Mozilla have envisioned how it will be useful for them, but there
is also the use for free software developers. It is new direction, new
platform, seem to be the most advanced in the under developed 21st
century. I have expected much more of computing in 2021, we are back
in the era of Netscape and Javascript introduction, just on a new
level.

By the way, back in time, I remember that all kinds of plugins were
installable in browsers, so all kinds of programs could run anyway
inside of browsers. I have been running perl remotely executed on my
browser. Here are some traces of that technology:
https://www.brainbell.com/tutors/Perl/newfile295.html and I remember
using similar technology before 1999.

It is possible to modify browsers to run any kind of code. There is
nothing new to the concept. Webassembly is attempt to make it in a
safe environment. Those large companies are not known to keep the
things safe, I know, but still, that is so far one of advanced cross
platform environments.

Let us develop software for it.

I am sure that my Hyperscope system can be modified to run in any
browser. It will become possible to develop Dynamical Knowledge
Repositories as envisioned by Engelbart and request documents of any
kinds and see/view them without modifying the OS. Open up DJVU
document on any computer, use Emacs from any worldwide Internet cafe
or point, play your favorite game without installing anything on a
host computer.

> The GNU operating system is not supposed to depend on external network
> resources for routine operation.

I agree w

Re: Web versions

[Jean Louis]

* aviva  [2021-03-16 05:55]:
> On 3/15/21 6:26 PM, Jean Louis wrote:
> > That is one good example. You can edit notes and save it, all locally,
> > it works offline.
> 
> And why is that good?  Are you lacking a shell?

At certain situations on travel I am lacking a computer and I use
browser to handle emails, notes, planning, documents and to print
it. If Nextcloud is good for that, then why not cloud-less technology?
I could place the final file with modified data any browser or any
computer to work equally. I believe TiddlyWiki could then equally well
run on my Android tablet, Motorola Lineage OS E + LTE, on GNU/Linux
computer and hostile Windoze computers in Internet points in East
Africa. I could print the notes from any computer where I arrive with
certainty they come out same as I expect it, without having my
personal computer with me. Storage could be on one of devices, on the
remote server or USB stick or similar. I would not need to pay for VPS
or dedicated server to run my application as application runs in the
browser and I can move NOTES.html to other devices. That is
integration. 

Me and you we are on different places on the planet, and have
different education and experiences. For logic to be the same one
would need to start from same set of data. Logic depends on data. With
different data and context, logic is also different.

Sure I use shell and I can use shell to create notes. But assumption
that I should use shell to save notes does not conform majority of
people on this planet. They don't have it.

Would GNU software be the initiator of the WWW and first creator of a
browser, I do not think we would be discussing here how taking notes
in a browser is odd and how one should be using shell. As it is not
so, the set of data is different and logic is different.

Would GNU Emacs be very advanced to support 3D, to have video
capabilities, better image editing capabilities, it would be today
what Webassembly wants to become. By simple click one would invoke
programs and run them quicker and equally well on every operating
system. That is what Emacs wants to become.

Integration is what brings people to use technology. Not the
technology itself. Think of integration on Android, there are
contacts, one can click on phone number and phone call is activated,
or click on email to send email, or click on image to share image with
specific contact by using any kind of communication line. That is one
small example of integration, it helps people to connect and get
things faster.

Downloading software, unpacking it, building it from sources and
installing it is one good example of lack of integration for the end
user (although the underlying integration efforts could be great).

Clicking on software and clicking on it to install and run it is
little better integration. There is no need to think on how to build
it.

In the next step one could just click and run the software. Or not
even click, just stumble upon the website.

Integration is what becomes useful for people.

Webassembly integrates things, it skips the OS problem and provides
equal experience on any OS where the browser can run. I also believe
that it is free software at least in the Firefox version.

Why would not GNU programs run in Webassembly? I see no reason.

GNU Health could then run on various operating systems without
installing it on each single computer, this lessens the cost of
installation in hospitals. Just click on the URL and manage customer's
information. This use case can be completely off the
Internet and can run in local area network.

Sales teams can have their CRM's running straight in browser,
Webassembly offers more than Javascript alone can offer. Click on URL
and manage databases.

Plethora of uses.

Jean

Re: Web versions

[Jean Louis]

* shulie  [2021-03-16 11:22]:
> On 3/15/21 6:26 PM, Jean Louis wrote:
> > If I download software into Emacs, I run it in Emacs.
> 
> And you need to be told that emacs is not compatable to web borwser ..
> but if EMACS was, it wouldl download random code from an unknown source
> and run an entire OS in it with full trottle access and network access. 
> And it would be JUST as stupid.

Emacs may not be equivalent to common web browser, but it does have
web browser built-in, eww that works within Emacs. Additionally there
is webkit based browsing within Emacs, depending of configuration at
build time.

To make Emacs run some code based on extension or some embeded script
(beyond Javascript) inside of HTML tag would be relatively easy.

The subject of security for Webassembly is built upon the experiences
with insecurity with browsers over period of time. There are also many
insecurities in operating systems and in just any kind of classes of
software that is out there.

How to Run a More Secure Browser
https://www.dragonflybsd.org/docs/handbook/RunSecureBrowser/

Further you need not consider your personal, with personal data backed
computer to be the only one to run WebAssembly. I can imagine plethora
of uses of Webassembly. That potentially the vendor/hoster can take
control over software is clear. It is clear that Microsoft, Google,
Apple all want to run Webassembly to gain more customers. That however
opens the door to free software as well, we may as well gain more
aware customers, it is upon developers as social group to build upon
it. Developers will work and create free software for it (it is
inevitable). Question is just how much.

Use cases and usefulness vouch for it. It allows computers to be
cheaper which would run Webassembly. Computers can run it that are
similar to those Chromebooks with low hardware power. It may bring
computing to masses, to developed countries, it may increase
education in the world due to low cost hardware requirements.

The subject of security of Webassembly may be solved by making sure
that browser executing binaries is well sandboxed and that OS is
separate from browser while making sure that software that is run is
free software. I do not know if integrity of the binary may be ensured
with some hash, for example, for user to know that the build is
reproducible and that it was made from free software version ACME
1.2.3

This is 21st century. Software is supposed to run on many operating
systems equally and Webassembly is one solution for it. If you have
something technical to add to security of Webassembly, I am sure that
developers would consider your bug reports.

Use cases:
https://webassembly.org/docs/use-cases/

Jean

Re: Web versions

[Schanzenbach, Martin]

> On 16. Mar 2021, at 06:07, Jacob Bachmeyer  wrote:
> 
> Colby Russell wrote:
>> On 3/15/21 9:02 PM, Jacob Bachmeyer wrote:
> [...]
>> > One of the rationales presented to me (off-list) for this was that a
>> > WebAssembly port of GNU could be run as a web app and therefore be
>> > "always up-to-date"
>> 
>> Despite quoting the salient parts from The JavaScript Trap, you have
>> regressed to committing the same error of critiquing the computing model
>> of traditional web apps, which is, once again, totally irrelevant. It
>> is neither here nor there.  Here you do it again:
>> 
>> > Web apps stored on "the cloud" are bad [...] Porting to "the Web" is
>> > simply not practical or appropriate
>> 
>> Please, please stop using this kind of sleight of hand to redirect the
>> context to web apps and "the cloud".  "The cloud" and "the Web" are
>> _simply_not_relevant_ to the computing model described above, which
>> treats the browser as a runtime which can be targeted during compilation
>> and which you happen to get "for free" on upwards of 90% of personal
>> computing devices, *NOT* as a thin client that you all keep insisting
>> on.
> 
> The original poster who started this discussion (and does not seem to have 
> actually replied to the list even once afterwards...) directly told me (and 
> possibly others) off-list that avoiding package management tasks (which "the 
> cloud" is well-known to promise to "magically" handle for you) was one of his 
> goals.
> 
>>  It's as if there's a short-circuit in at least half of respondents'
>> brains that prevents them from engaging in any way without at some point
>> insisting that this *MUST* involve cloud architecture and SaaS-like web
>> apps being the central focus.  It is _absurd_ that it takes this much
>> energy to continually refute this over and over.  Ideally, it shouldn't
>> have to occur even a single time, but failing that, once should suffice.
>> At this point, I have to wonder how many times this has to be pointed
>> out?  Is there any number which would be sufficient?
> 
> We are in violent agreement here, but the original poster clarified 
> (off-list) that SaaS-like services were exactly what he wanted.
> 
> 
> I am beginning to suspect that we have all been trolled, especially since 
> giving those extra details to only some participants would be likely to cause 
> violent discussion between those (including me) who were told (off-list) what 
> the original poster was actually requesting and those (presumably including 
> you) who are still thinking of the general case, where Free software *can* be 
> packaged using the "Web platform" as a portable runtime.  Mozilla's XULRunner 
> was a closely-related example, and I believe that there are similar current 
> "Web app on local storage as desktop app" runtimes currently maintained.
> 
> If this was a troll, it has been quite successful -- just look at all the 
> vitriol and hot air in this thread.  We all seem to have been had.
> 

Obviously the OP was a tongue-in-cheek kind of question. But this should not 
prevent us from
lucidly reflecting on the topic and find truth in the joke; to then find common 
ground.
However, from my (brief) experience here in this ML, this discussion is a 
disaster.
It is not even a discussion. Some replies here a display of ignorance combined 
with superstition and outright
hostility.
No effort is made to understand the issue and preconceived talking points are 
thrown out seemingly at random.
A magnificent display of what goes wrong when you religiously believe and are 
unable to actually apply your
values to developments in the world.
Which is why I stopped replying. It was a disappointing experience and I see no 
basis for discourse.

> 
> On a side note, at what point does it become appropriate to forward replies 
> received off-list to the list when bad faith is suspected?
> 
> 
> -- Jacob
> 



signature.asc
Description: Message signed with OpenPGP

Re: Web versions

[aviva]

On 3/16/21 1:07 AM, Jacob Bachmeyer wrote:
>
> I am beginning to suspect that we have all been trolled



yah think?

Re: Web versions

[shulie]

On 3/15/21 4:26 PM, Alfred M. Szmidt wrote:
>  square Richard's call to action
>to replace non-free JS with free JS



BTW - in this case, Richard is talking about the little snippet garbage
that people use as large scale widgets for web bowsers.  THOSE things,
since you are running javascript anyway, can be freed build kits rather
than using unfree ones owned by google.  But they both suck because in
both cases, the user has no control.  And it doesn't sidestep the other
aspect of this he discusses, which is software as a service, which is
what ALL of this is and he wanted to ditch it in GPL3

https://news.slashdot.org/story/09/04/27/1356235/rms-says-software-as-a-service-is-non-free


https://www.gnu.org/philosophy/who-does-that-server-really-serve.html


Javascript is just a form of Software as a Service, instead of on a
remote server, you LET THEM take over your computer.  It is stupid.  It
is dangerous.  It strips the user of all computer ownership.   NO NO NO

Re: Web versions

[shulie]

On 3/15/21 6:26 PM, Jean Louis wrote:
> If I download software into Emacs, I run it in Emacs.

https://web.archive.org/web/20010302031109/http://crackmonkey.org/fanmail.html#CHAPTER1

Re: Web versions

[shulie]

On 3/15/21 4:26 PM, Alfred M. Szmidt wrote:
> Javascript isn't bad,



Yes - it is pretty bad which is why we need to do this WHOLE end run
around it to protect ourselves.  Turning the browser into apware,
frankly sucks,   It is used for tracking, fingerprinting, stealing, and
abusing users and there is no need for it at all.


Taking it OUT of the browser, I couldn't care less about it other than
it is a cluster of bad programming paradigns and produces vomit like
code that is impossible to maintain.

Re: Web versions

[shulie]

On 3/14/21 11:04 PM, DJ Delorie wrote:
> Since you insist on misinterpreting, let me clarify.


I am not misinterpreting anything. You do not install anything in a
browser that can run an OS.

Re: Web versions

[shulie]

On 3/15/21 11:30 PM, Colby Russell wrote:
> It's as if there's a short-circuit in at least half of respondents'
> brains that prevents them from engaging in any way without at some point
> insisting that this *MUST* involve cloud architecture and SaaS-like web
> apps being the central focus.


Because YOUR browser doesn't get information from random physical
locations on the internet... you have a SPECIAL browser

Re: Web versions

[shulie]

On 3/15/21 6:26 PM, Jean Louis wrote:
> If I download software into Emacs, I run it in Emacs.



And you need to be told that emacs is not compatable to web borwser ..
but if EMACS was, it wouldl download random code from an unknown source
and run an entire OS in it with full trottle access and network access. 
And it would be JUST as stupid.

Re: Web versions

[shulie]

On 3/15/21 6:15 AM, Jean Louis wrote:
> If not, let us not work with hypothetical illusions.


Software running in your broswer to take over your computer and creating
a security whole is NOT hypothetical, although it WAS when RMS first
addressed it.

Re: Web versions

[shulie]

On 3/14/21 6:18 PM, DJ Delorie wrote:
> The GNU project should promote Free Software in all the ways that the
> user can benefit from those freedoms,



Correct and that is why this is disqualified out of the gate.  This is
broken by design you know like APSX and Outlook and even Java.  The
nifty arm chair analysis of what it MIGHT do is irrelevant.  What it
does is strip the user of control of there own computer and enslave them
to someone elses manipulations without limit.

Re: Web versions

[shulie]

On 3/14/21 11:04 PM, DJ Delorie wrote:
> "technology is designed to be something".



Something in this case is software designed to enslave the user and
allow for hackers to take over your computer.

Re: Web versions

[shulie]

On 3/15/21 11:30 PM, Colby Russell wrote:
> It is _absurd_ that it takes this much
> energy to continually refute this over and over.



it is obsurd from the ground up.  Conceptually it is evil.

Re: Web versions

[shulie]

On 3/14/21 11:08 PM, DJ Delorie wrote:
> GCC has been used to write software that hacks into other people's



We are nt talking about GCC... We are talking about running a complete
OS in the broswer after loading it from an unsafe source.  NO NO NO. 
You DO understand that Browsers were created to allow for ANONYMOUS AND
SECURE information transport from one secure system to another.  It is
not supposed to be a security hole to run an entire OS our of.  We have
something to do that... X11

Re: Web versions

[shulie]

On 3/14/21 11:10 PM, DJ Delorie wrote:
> It can and it does, and I showed you 


No sooner than we finally ditch flash and  javabeans and the same bad
idea lifts its ugly head AGAIN. 


It is a no.  Someone will likely seriously die because of this being
implimented.  Stuffing a VM and an OS in a broswer is bad.  It has
always been bad and it is still bad.


You already have a network ready OS - you don't NEED to stuff binaries
and running code into the browser.

Re: Web versions

[shulie]

On 3/14/21 6:18 PM, DJ Delorie wrote:
> This is a value judgement on the developer writing the software, not the
> technology of the software itself. 



No.  That value was made when they created the software.  It is the
intention of the software itself.  There is nothing nuetral about it. 
It is designed the screw the end user.

Re: Web versions

[shulie]

On 3/15/21 6:08 AM, Jean Louis wrote:
> Question of losing control over software that runs on computer must
> involve the question "Is the software proprietary?" 



No.  Richard had been working on this since the new GPL and this issue
isn't is it proprietary.  The issue is software as a service that does
an end run around the entire licensing issue because new gives you the
software.  It just takes over your computer.

Re: Web versions

[shulie]

On 3/14/21 11:05 PM, DJ Delorie wrote:
> How so?


because you are loading unknow code from a proven hostile source and it
is running and entire OS ... in your browser.  We are talking a security
breach that makes outlook look like trusted entity.


Come now.  We are adults.

Re: Web versions

[shulie]

On 3/14/21 7:57 AM, Schanzenbach, Martin wrote:
> No, it was not:
>
> "
> ince WebAssembly is now a reality, maybe you guys should get to making the 
> browser versions of LL your software?
> "



webassembly needs to be removed from any browser.  It is a security hole
if you can an OS in it without local supervision.

Re: Web versions

[shulie]

On 3/14/21 8:36 AM, Schanzenbach, Martin wrote:
> But I think it is important to look at such technology without prejudice.



No, you need to have servere prejudice.  It is a bad idea from the
ground up, and it is not even an original idea.  And can there be a
WORST programming language than javascript?


No - we do not promote the intentional building of back doors in our
computers and do so without prejudice.  We are extremely prejudice.  I
would rather be dead than run something like that.  It is time to rip
javascript completely out of the browser.  It provides NOTHING but
security nightmares and user tracking.

Re: Web versions

[shulie]

On 3/15/21 11:30 PM, Colby Russell wrote:
> Of course not, and it doesn't matter; it wouldn't make sense to expect
> it to use those APIs even if they were available.  That would entail
> reliance on the local machine's resident system to perform essential
> services e.g. to manage the user's files and the files used by the
> system itself.


rite - files are magic things that exist in the alternate universe


quack quack?

Re: Web versions

[shulie]

On 3/14/21 7:57 AM, Schanzenbach, Martin wrote:
> This issue is completely unrelated to the technology.


It is EXACTLY what the technology is designed to do, so by all means,
believe otherwise.

Re: Web versions

[Jacob Bachmeyer]

DJ Delorie wrote:

[...]
You are arguing that we should take away a technology from the user,
because some people use that technology in ways you disagree with.
However, other people use that same technology in other ways.  It is not
the technology that is evil, it's how it's used that may be evil.


OK, so what is a "not evil" use for Digital Restrictions Management?


-- Jacob

Re: Web versions

[Jacob Bachmeyer]

Colby Russell wrote:

[...]
Consider this passage from The JavaScript Trap:

If the program is self-contained [...] you can copy it to a file on
your machine, modify it, and visit that file with a browser to run
it.  But that is an unusual case.

In particular, consider the irony of it, in light of the way this
discussion has gone.  In this discussion, it has been you all who would
bear responsibility for this case remaining "unusual": by continually
invoking the web app canard and responding to imagined caricatures of
the arguments being sent your way, rather than the actual arguments
themselves.


The original message that started this discussion was a request to port 
all GNU packages to WebAssembly targets.


As I understand, that is not currently technically feasible because 
WebAssembly does not offer the APIs that most GNU packages use.  I 
further suggest that making it feasible would be a bad idea because that 
would effectively remove the browser sandbox.


One of the rationales presented to me (off-list) for this was that a 
WebAssembly port of GNU could be run as a web app and therefore be 
"always up-to-date" and I answered that removing the option to continue 
using an old (possibly customized) version from the user, as that would 
do, is wrong.



In short:
   1.  Most GNU packages are written to POSIX API, possibly with GNU 
extensions.
   2.  Browsers do not offer POSIX API to JS/WebAssembly for very good 
reasons.
   3.  Web apps stored on "the cloud" are bad because they often do not 
respect the user's freedoms, as even if the software is under Free 
license terms, technical issues can make running a modified version 
difficult or impossible.


Therefore:
   Porting to "the Web" is simply not practical or appropriate for most 
GNU software.  This does not exclude the possibility of writing useful 
Free software for "the Web" but the GNU project is focused on the GNU 
operating system.


The GNU operating system is not supposed to depend on external network 
resources for routine operation.  I believe that "Who Does That Server 
Really Serve?" better applies to these issues than "The JavaScript Trap" 
does:  the former warns against relying on systems outside of the user's 
control, even if those systems are also running Free software, while the 
latter applies to a widespread means of "sneaking" non-free software 
into otherwise-Free environments under the user's proverbial nose.



-- Jacob

Re: Web versions

[Jacob Bachmeyer]

Colby Russell wrote:

On 3/15/21 9:02 PM, Jacob Bachmeyer wrote:

[...]

> One of the rationales presented to me (off-list) for this was that a
> WebAssembly port of GNU could be run as a web app and therefore be
> "always up-to-date"

Despite quoting the salient parts from The JavaScript Trap, you have
regressed to committing the same error of critiquing the computing model
of traditional web apps, which is, once again, totally irrelevant. It
is neither here nor there.  Here you do it again:

> Web apps stored on "the cloud" are bad [...] Porting to "the Web" is
> simply not practical or appropriate

Please, please stop using this kind of sleight of hand to redirect the
context to web apps and "the cloud".  "The cloud" and "the Web" are
_simply_not_relevant_ to the computing model described above, which
treats the browser as a runtime which can be targeted during compilation
and which you happen to get "for free" on upwards of 90% of personal
computing devices, *NOT* as a thin client that you all keep insisting
on.


The original poster who started this discussion (and does not seem to 
have actually replied to the list even once afterwards...) directly told 
me (and possibly others) off-list that avoiding package management tasks 
(which "the cloud" is well-known to promise to "magically" handle for 
you) was one of his goals.



  It's as if there's a short-circuit in at least half of respondents'
brains that prevents them from engaging in any way without at some point
insisting that this *MUST* involve cloud architecture and SaaS-like web
apps being the central focus.  It is _absurd_ that it takes this much
energy to continually refute this over and over.  Ideally, it shouldn't
have to occur even a single time, but failing that, once should suffice.
At this point, I have to wonder how many times this has to be pointed
out?  Is there any number which would be sufficient?


We are in violent agreement here, but the original poster clarified 
(off-list) that SaaS-like services were exactly what he wanted.



I am beginning to suspect that we have all been trolled, especially 
since giving those extra details to only some participants would be 
likely to cause violent discussion between those (including me) who were 
told (off-list) what the original poster was actually requesting and 
those (presumably including you) who are still thinking of the general 
case, where Free software *can* be packaged using the "Web platform" as 
a portable runtime.  Mozilla's XULRunner was a closely-related example, 
and I believe that there are similar current "Web app on local storage 
as desktop app" runtimes currently maintained.


If this was a troll, it has been quite successful -- just look at all 
the vitriol and hot air in this thread.  We all seem to have been had.



On a side note, at what point does it become appropriate to forward 
replies received off-list to the list when bad faith is suspected?



-- Jacob

Re: Web versions

[Jacob Bachmeyer]

Jean Louis wrote:

[...]

Question is rather if software is free or if one need proprietary programs
to run it in WebAssembly.

If there is nothing proprietary, we shall encourage creation of software
as WebAssembly is there because some people find it useful, we encourage
creation of free software.


The original message that prompted this discussion was a request to port 
all existing GNU packages to a WebAssembly target.


As I understand, such ports would not be possible for many GNU utilities 
because they rely on facilities that are not available in browsers for 
good reason.  Making those APIs available in browsers would be a bad 
idea because it would effectively eliminate the browser sandbox, 
allowing common Web malware free reign on most user's systems.



-- Jacob

Re: Web versions

[Colby Russell]

On 3/15/21 9:02 PM, Jacob Bachmeyer wrote:
> that is not currently technically feasible because WebAssembly does
> not offer the APIs that most GNU packages use

Of course not, and it doesn't matter; it wouldn't make sense to expect
it to use those APIs even if they were available.  That would entail
reliance on the local machine's resident system to perform essential
services e.g. to manage the user's files and the files used by the
system itself.

It is the responsibility of the system living in the system image, as
with all other systems, to implement the POSIX API--or any other API it
wants to offer to programs that will be run within the image. (Given
that we are discussion GNU, however, then yes, that means POSIX.)
Expecting otherwise is a critical failure in understanding fundamental
architectural issues.

> One of the rationales presented to me (off-list) for this was that a
> WebAssembly port of GNU could be run as a web app and therefore be
> "always up-to-date"

Despite quoting the salient parts from The JavaScript Trap, you have
regressed to committing the same error of critiquing the computing model
of traditional web apps, which is, once again, totally irrelevant. It
is neither here nor there.  Here you do it again:

> Web apps stored on "the cloud" are bad [...] Porting to "the Web" is
> simply not practical or appropriate

Please, please stop using this kind of sleight of hand to redirect the
context to web apps and "the cloud".  "The cloud" and "the Web" are
_simply_not_relevant_ to the computing model described above, which
treats the browser as a runtime which can be targeted during compilation
and which you happen to get "for free" on upwards of 90% of personal
computing devices, *NOT* as a thin client that you all keep insisting
on.  It's as if there's a short-circuit in at least half of respondents'
brains that prevents them from engaging in any way without at some point
insisting that this *MUST* involve cloud architecture and SaaS-like web
apps being the central focus.  It is _absurd_ that it takes this much
energy to continually refute this over and over.  Ideally, it shouldn't
have to occur even a single time, but failing that, once should suffice.
At this point, I have to wonder how many times this has to be pointed
out?  Is there any number which would be sufficient?

Don't want to hear it from me?  Then read RMS's words from The
JavaScript Trap, which has been referenced here multiple times by now.
Fuck it, let's go for another:

    self-contained [...] you can copy it to a file on your machine,
    modify it, and visit that file with a browser to run it

--
Colby Russell

Re: Web versions

[aviva]

On 3/15/21 6:26 PM, Jean Louis wrote:
> That is one good example. You can edit notes and save it, all locally,
> it works offline.

And why is that good?  Are you lacking a shell?

Re: Web versions

[aviva]

On 3/15/21 7:27 PM, Colby Russell wrote:
> that do not conform to their preferred
> canard.



A canard is a duck and you are a quack.  Experience counts and you have
none.  That is also true about logic

Re: Web versions

[Colby Russell]

On 3/15/21 5:26 PM, Jean Louis wrote:
> I said, there are now applications (at least I know about them now),
> that run quite everything on your computer, through browser. So there
> is no server dependency.

Please, Jean Louis, heed Alfred's earlier request to focus your comments
only on those scenarios that are most convenient to his side of the
argument ("stick to one topic [...] running software in a web browser
that you download from someone elses server"); tie yourself to the mast
of traditional web apps and their flaws, and do not point to proof of
alternative computing models that do not conform to their preferred
canard.

--
Colby Russell

Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-16 00:14]:
> Lets try to stick to one topic, and not fan out so much?  That is,
> running software in a web browser that you download from someone elses
> server.

I have downloaded so much software in last 24 hours as I was
installing new OS (Parabola), so I have downloaded it from some server
and I run it.

If I download software into Emacs, I run it in Emacs.

Then there is Racket interface, I could download scheme and run it in
Racket interface (but did not do).

Difference is that browser software would be compiled. But I could as
well download byte code for Emacs and run it, it is also kind of
obfuscated in that sense. 

>There are now many Javascript application such as notes, where all
>users' data remain in the browser, nothing is stored on the remote
>server. That is good development.
> 
> It is not, since such a program could just as well be run locally,
> without the dependancy on someone else infrastructure.  If that server
> goes away, you're shit out of luck.

I am sure you are mistaken there. I said, there are now applications
(at least I know about them now), that run quite everything on your
computer, through browser. So there is no server dependency.

TiddlyWiki note taking in a browser
https://tiddlywiki.com/

That is one good example. You can edit notes and save it, all locally,
it works offline.

Or https://nullboard.io/preview

Such applications work offline in browser. No need for network.

Re: Web versions

[Colby Russell]

On 3/15/21 4:06 PM, Jean Louis wrote:
> this remains forever on the mailing list [...] you are not anonymous

Right.

> In Texas [...] events like that could be like US $500 each

Wrong.

> We are friends here.

Wrong.

--
Colby Russell

Re: Web versions

[Alfred M. Szmidt]

   Large number of people spawn VPS-es today, they have no idea if it is
   "free" software and even so, if they hear free they may not know what
   it means. All they want is to run their Wordpress or other instances.

Wordpress would be running on their computer (even if they are
borrowing hardware from someone else).

But the rest of your message is conflating issues, what Gobble does
isn't pertinent here, nor what the GDPR says, or GitBlob, or people
violating licenses (which can be a good thing, if those licenses are
unjust!) so I'm having a hard time following it or responding to it.

Lets try to stick to one topic, and not fan out so much?  That is,
running software in a web browser that you download from someone elses
server.

That some people will not care about their rights is not something we
can fix, people will do what people will do.  But what the GNU
project, and the FSF can and do is highlight these issues by taking an
extra step

   There are now many Javascript application such as notes, where all
   users' data remain in the browser, nothing is stored on the remote
   server. That is good development.

It is not, since such a program could just as well be run locally,
without the dependancy on someone else infrastructure.  If that server
goes away, you're shit out of luck.

Re: Web versions

[Jean Louis]

* Colby Russell  [2021-03-15 23:53]:
> On 3/15/21 3:26 PM, Alfred M. Szmidt wrote
> > Nobody claimed anything like that, so why make the absurd claim?
> 
> Go  yourself.

Colby you are losing temper, and this remains forever on the mailing
list. In some countries this type of communication is offense, crime,
illegal. And you are not anonymous with that domain. 

I can see that people underestimate online communities and abuse the
friendliness in communication. But at some point of time the court,
and the bill may be delivered to your door.

If you sell anything, then it is best way to decrease the sales.

In Texas, it is Class C Misdemeanor, disorderly conduct, events like
that could be like US $500 each. If person is in other country,
jurisdiction is also there, courts in other country could look quite
different on such issues.

But in general, why waste your time for any purpose, to end up like
that.

We are friends here.

Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-15 22:43]:
>I just cannot see clearly how is Javascript trap relevant to
>WebAssembly as the Javascript trap is about proprietary software.
> 
> You could replace Javascript with Webassembly and the Javsscript trap
> would make an equal important point.  The reason why the title
> mentions a trap is that they can get caught up in where they do not
> know if the software (web page) accessed is really free software or
> not, and start depending on it without any idea that they have even
> been caught.

Large number of people spawn VPS-es today, they have no idea if it is
"free" software and even so, if they hear free they may not know what
it means. All they want is to run their Wordpress or other instances.

People may start depending on remote services, and that may be
different kind of trap. We shall isolate here the subject as if
subject is running free software in Webassemble or "who does that
server serve?" -- those are different subjects.

Many applications delivered on Google Playstore are also free
software, users cannot know that easily, they just click and play. I
am using F-Droid, I assume software is free, yet there are freedom
issues in some of those as well, also related to remote servers,
spying and similar.

Users are advised to ask if it is free software or not. There is work
for GNU in future to make users aware of it. The hypothetical
awareness campaign in the future shall not impede development of free
software in WebAssembly. Just as with Javascript liberation, we can
have software running remotely on any computer equally through
WebAssembly. It is something like general layer where piece of
software will run on various operating systems equally.

How I understood it, it will run locally on users' computers, so that
may offer more liberties that could be given by free software
developers. Users' data for example, could remain on users' computers,
instead of being processed on remote server.

There are now many Javascript application such as notes, where all
users' data remain in the browser, nothing is stored on the remote
server. That is good development.

By considering just one bad hypothetical possibility one shall not
impede on freedom zero, as to allow developers or not to "bless them"
to develop the free software because it will be trivial for users to
download and run such. So what? Better so if it is trivial.

I would like to present GNU Health to hospitals in East Africa and
help, what if the management of some medical hospital can easily be
helped with Webassembly container, then this could be good. At this
moment I do not know how it can be, or how it can work, I did not
study much of it.

> Compare this with normal software, which you have to at download, with
> that comes a small threshold for investigating about the program.  If
> If i just point you to http://example.com/foo you can't (easily) see if
> it is free software or not before you've run the program.

That treshold will come only at aware users. Majority of users just
download and run, in fact, the rush is so great that any treshold for
investigating about the program is useless. Maybe you have played
games in past, those who did, one must remember that often there is no
time for demo, not even reading any instructions, click space, fire,
and go. Millions of users are game players. They will not bother
looking into licenses. Millions will abuse licenses anyway, who
cares. Not all the world is Western World where licenses are
observed. People in third world countries do with software anyway what
they want, copy, duplicate, modify anyhow (peek and poke, or change
free software), sell anyhow, including illegally re-license as
proprietary. Who cares? Is anybody going to come on ground to third
world countries to find out some license abuses? Only largest
companies like Microsoft will ask largest companies to pay.

Some people will look into it, I just don't have a feeling that number
is considerable.

It is true that we, who are aware, we can see when software is
free. So we will be able to see that in Javascript area and also in
Webassembly area. It is equal to web link. Differences are small.

Yet we are minority. Majority will skip and go to what they want.

And those issues are not related to freedom. That people do not read
licenses is clear. 

> Web browsers make it so trivial these days to run any random code and
> it is very easy to start depending on software you do not control
> anymore -- without even noticing it.  Could you make this free
> software? Sure, but that isn't the point here.

So it will be with Webassembly, people will run various codes without
knowing, but that is not a fact that one can use to say: "now, don't
develop for Webassembly" -- it is also not enough now to say "it is
trap".

Would free software developers create more free software for
Webassembly than proprietary, then we would not be in this situation
of fear. The situation comes due to object

Re: Web versions

[Colby Russell]

On 3/15/21 3:26 PM, Alfred M. Szmidt wrote

Nobody claimed anything like that, so why make the absurd claim?


Go fuck yourself.

--
Colby Russell

Re: Web versions

[Alfred M. Szmidt]

Asking someone to "knock it off" isn't very kind.  So a small reminder
that this list applies GNU Kind Communications Guidelines
(https://www.gnu.org/philosophy/kind-communication.en.html).

Re: Web versions

[Alfred M. Szmidt]

   Furthermore, how are we supposed to square Richard's call to action
   to replace non-free JS with free JS, if JS is to be understood to
   be inherently bad (as in the picture painted in this discussion)?

Nobody claimed anything like that, so why make the absurd claim?

Javascript isn't bad, it is how it is used that is the issue.  So
again, this is all nicley explained in for example, the Javascript
trap.

Re: Web versions

[Colby Russell]

Furthermore, how are we supposed to square Richard's call to action to
replace non-free JS with free JS, if JS is to be understood to be
inherently bad (as in the picture painted in this discussion)?



In fact, The JavaScript Trap has multiple similar calls to action.

* * * * *

On 3/15/21 2:42 PM, Alfred M. Szmidt wrote:
> it can just as well be binary.

... at which point, you're making an argument for *my* side of this, and
not yours.

> And as long as people are unwilling to read it, I'll happily point it 
out.


Alfred: can you knock it off already?  We've read it!  If there's anyone
demonstrating an unwillingness to read, it is you.

In 2019, in an email, Richard asked me whether I'd like to help GNU and
the free software movement.  In fact, I've been contributing to free and
open source software for my entire adult life, have a nuanced
understanding of the various movements and the underlying philosophies,
and had already undertaken to work on some of the problems inherent to
the practices of mainstream JS development by then.  (I feel partially
responsible, since I put a lot of effort into making sure high quality
documentation about the JavaScript language existed in the early days of
developer.mozilla.org.)  So I am one such person equipped to respond to
these calls to action.

But it's beyond me why I or anyone else *should* respond, if this is the
sort of intransigence that one is going to encounter.  What's the
payoff supposed to be?  To invest substantial effort into solving the
problem, only to be frustrated by folks who abandon the position that
should be undergirding the initial call and who refuse to be coherent?

--
Colby Russell

Re: Web versions

[Alfred M. Szmidt]

   I just cannot see clearly how is Javascript trap relevant to
   WebAssembly as the Javascript trap is about proprietary software.

You could replace Javascript with Webassembly and the Javsscript trap
would make an equal important point.  The reason why the title
mentions a trap is that they can get caught up in where they do not
know if the software (web page) accessed is really free software or
not, and start depending on it without any idea that they have even
been caught.

Compare this with normal software, which you have to at download, with
that comes a small threshold for investigating about the program.  If
If i just point you to http://example.com/foo you can't (easily) see if
it is free software or not before you've run the program.

Web browsers make it so trivial these days to run any random code and
it is very easy to start depending on software you do not control
anymore -- without even noticing it.  Could you make this free
software? Sure, but that isn't the point here.

   Webassembly already exists. People will start making free software for
   it anyway. It is good platform for delivery of software.

If something exists, or not -- is simply a tanget.  Javascript _also_
exists, and there is lots of free software that is written Javascript.

Re: Web versions

[Alfred M. Szmidt]

   ... The JavaScript Trap is a (reasonable) argument against
   trends of modern web apps, i.e., a software architecture relying on
   code-on-demand that lies under someone else's control, esp. when that
   software is not freely licensed.  

Which is exactly the same argument that can be made for Webassembly.
Oftn Javascript is so obfuscated that it can just as well be binary.

And as long as people are unwilling to read it, I'll happily point it out.

Re: Web versions

[Colby Russell]

On 3/15/21 9:47 AM, Alfred M. Szmidt wrote:
> Again, the Javascript trap is a good place to start ...

No, it isn't.  The JavaScript Trap is a (reasonable) argument against
trends of modern web apps, i.e., a software architecture relying on
code-on-demand that lies under someone else's control, esp. when that
software is not freely licensed.  It is not an argument against JS.
*Every* occurrence of the words "JavaScript" and "WebAssembly" in the
messages written here have been arguments against the former, not the
latter.  There is no reasonable argument against the latter on free
software principles.

Please stop responding to your opponents as if they haven't read The
JavaScript Trap.  Please start responding as if you've actually read
(and understood) the arguments your opponents are standing behind.
Assume that your opponents have an understanding of the relevant issues
at hand that is at least as sophisticated as your understanding, and
that they abhor inscrutable and obfuscated ("minified") code-on-demand
bundles at least as much as you.

Consider this passage from The JavaScript Trap:

    If the program is self-contained [...] you can copy it to a file on
    your machine, modify it, and visit that file with a browser to run
    it.  But that is an unusual case.

In particular, consider the irony of it, in light of the way this
discussion has gone.  In this discussion, it has been you all who would
bear responsibility for this case remaining "unusual": by continually
invoking the web app canard and responding to imagined caricatures of
the arguments being sent your way, rather than the actual arguments
themselves.

PS: Neither GNU nor FSF even have a fatwa against JS.  IceCat has
endorsement.  Just like Emacs uses large amounts of elisp, IceCat
consists of hundreds of thousands of lines of JS.  Both its existence
and that of LibreJS are contradictions of the notion that JS is
inherently worthy of being shunned.

--
Colby Russell

Re: Web versions

[Jean Louis]

* Alfred M. Szmidt  [2021-03-15 17:48]:
>> Or maybe they will, but that doesn't mean it is something the GNU
>> project should promote.
> 
>The GNU project should promote Free Software in all the ways that the
>user can benefit from those freedoms, regardless of what technology
>underlies those freedoms.  If WebAssembly or Javascript can be used in a
>way that honors the four freedoms, the FSF's position should be to
>encourage *those* ways, and discourage *other* ways.  Discouraging the
>technology itself is, IMHO, outside the FSF's scope.
> 
> The FSF and the GNU project have often recommended against using
> various technologies becuase they reduce the freedom of users, it is
> perfectly within the scope of what their mission is.  One such scope
> is limiting Javascript use/Webassembly, and recommending users to not
> depend on that specific technology.  Again, the Javascript trap is a
> good place to start ...

You know that I like GNU and free software philosophy.

I just cannot see clearly how is Javascript trap relevant to
WebAssembly as the Javascript trap is about proprietary software.

I can see some more specific problems generally described here:
https://en.wikipedia.org/wiki/WebAssembly#Security_considerations

The major problem is that software is pretty easily delivered to user
who is led to believe it will be safe, user will run software and will
not know if it is safe or not.

Webassembly already exists. People will start making free software for
it anyway. It is good platform for delivery of software.

That it can be abused or used, it is clear. But so any other
software. Nothing prevents people to place malicious or abusive or
backdoor-ed software into free software and offer to people to
download it. Place a link for software package, say that user will get
something for free, just has to run the software, and there you
are. This same principle has been used since there is Internet and
DOS.

>From security perspective we as aware users shall strive to protect
our data, so majority of aware people do not run insecure Javascript,
so they will not run WebAssembly as well. Myself I do not install
containers, etc. I do review the background of people who are
prepareing the OS and I can prepare the OS myself for myself. So I do
not run proprietary stuff, and thus avoid much of insecurity, but that
is far from perfect as any software, thus also free software, is
pretty insecure technically. Targeted attack would be easy to conduct
on large groups of people and is being conducted 24 hours.

>From freedom perspective, if somebody wish to run WebAssembly, if I am
proponent of the GPL, then why should I ever say "no" to run free
software anyhow?

We essentially argue here about the freedom 0.

"The freedom to run the program as you wish, for any purpose (freedom 0)."
https://www.gnu.org/philosophy/free-sw.html

GNU project in general need not prepare GNU tools for WebAssembly, it
may decide how to do it, so that is also freedom zero for GNU. That is
maybe general direction, I would myself not put efforts into
Webassembly.

As specific direction, single developers or groups of developers of
GNU software specifically, could decide to compile software to be run
under WebAssembly. So everybody has freedom zero, to run the program
as you wish, for any purpose.

So we shall uphold freedom zero and not deny it or object to it.

Jean

Re: Web versions

[Jean Louis]

* aviva  [2021-03-15 17:02]:
> On 3/15/21 6:15 AM, Jean Louis wrote:
> >  Is there a person that was hurt?
> 
> When software is hijacked, people get hurt.  google it yourself.

As side notes, I do understand your intentions and from that viewpoint
we are on the same side. We all support GNU and free software.

In conversation it would be better if you provide facts, some existing
real information that one can rely upon. To say that some software
hurts people is too general.

You said "when software is hijacked" -- but I do not know how it
relates to this WebAssembly subject. As a side note, I have been using
free software operating systems since quite some time, like 2 decades,
and several times it got hijacked, and users' data was
compromised. Free software is not inherently secure.

People get hurt, yes, some people including me, got hurt through
hijacking, but I do not see how it is related to
WebAssembly. Incidents I know have taken place on Debian
GNU/Linux. There are so many security incidents that many devices can
be hijacked and spied upon. Free software is often used in such
devices. For example Minix is used in Intel management engine chips.

Security is technical aspect, it should not be relevant for freedom to
use software as one wish.

Jean

P.S.

"to google" is not really a verb. I myself use various other search
engines, normally I do not use Google, but I may do so from time to
time. I have almost forgot about it.

Re: Web versions

[Colby Russell]

On 3/15/21 9:47 AM, Alfred M. Szmidt wrote:
> If you are shipping an operating system, like GNU, you don't need to
> run it in a web browser.  That is a good thing.

If you are going to represent your comment as a response to something
I've written, then please actually respond to it.  Otherwise, your
argument is hollow.

--
Colby Russell

Re: Web versions

[Alfred M. Szmidt]

If you are shipping an operating system, like GNU, you don't need to
run it in a web browser.  That is a good thing.

Re: Web versions

[Alfred M. Szmidt]

   > Or maybe they will, but that doesn't mean it is something the GNU
   > project should promote.

   The GNU project should promote Free Software in all the ways that the
   user can benefit from those freedoms, regardless of what technology
   underlies those freedoms.  If WebAssembly or Javascript can be used in a
   way that honors the four freedoms, the FSF's position should be to
   encourage *those* ways, and discourage *other* ways.  Discouraging the
   technology itself is, IMHO, outside the FSF's scope.

The FSF and the GNU project have often recommended against using
various technologies becuase they reduce the freedom of users, it is
perfectly within the scope of what their mission is.  One such scope
is limiting Javascript use/Webassembly, and recommending users to not
depend on that specific technology.  Again, the Javascript trap is a
good place to start ...

Re: Web versions

[Alfred M. Szmidt]

   You are arguing that we should take away a technology from the user,

The GNU project has often made decisions on not using a specific
technology, or trying to get around the problem in ways to promote
user freedom.

   because some people use that technology in ways you disagree with.
   However, other people use that same technology in other ways.  It is not
   the technology that is evil, it's how it's used that may be evil.

Re: Web versions

[aviva]

On 3/15/21 6:15 AM, Jean Louis wrote:
>  Is there a person that was hurt?



When software is hijacked, people get hurt.  google it yourself.

Re: Web versions

[Jean Louis]

* aviva  [2021-03-15 05:52]:
> On 3/14/21 6:18 PM, DJ Delorie wrote:
> >  If WebAssembly or Javascript can be used in a
> > way that honors the four freedoms,
> 
> But it can't...period.  And in the real world , it doesn't.  We don't
> promote software that hurts peopleperiod.

We shall also be objective. Is there a person that was hurt?

If not, let us not work with hypothetical illusions.

If free software is insecure or secure is not related to free software
philosophy.

In fact, free software is there for everybody, including for criminals
and for people who can harm other people. That is the freedom in the
GPL. Free software may be used for any purpose.

If you start saying that free software should not hurt people, that
is where limits start, you would start arguing how it hurts this way,
other person how it hurts that way, or how it could be used, abused,
etc. There is no end to hypothetical discussions.

One video website software on Github said: that the software is free,
but it cannot be used for bad purposes or something against God or
similar. That renders software non-free. If people cannot use video
website application for publishing of porn because author thinks it
is not alright and it is against the God, that is where software stops
being free.

Question is rather if software is free or if one need proprietary programs
to run it in WebAssembly.

If there is nothing proprietary, we shall encourage creation of software
as WebAssembly is there because some people find it useful, we encourage
creation of free software.

Re: Web versions

[Jean Louis]

* aviva  [2021-03-15 05:51]:
> On 3/14/21 6:18 PM, DJ Delorie wrote:
> > Thus, in a way you are arguing AGAINST the
> > user's freedom.
> 
> No - I am arguing against creating a system where you lose control of
> your computer and it is over run by hackers because of poor deisgn. 
> NOTHING can excuse that,

Question of losing control over software that runs on computer must
involve the question "Is the software proprietary?" 

RMS have made it clear in many of his speeches that when
proprietary software runs on the computer, that is where user loses
the control.

Re: Web versions

[DJ Delorie]

aviva  writes:
> On 3/14/21 6:18 PM, DJ Delorie wrote:
>>  If WebAssembly or Javascript can be used in a
>> way that honors the four freedoms,
>
> But it can't...period.  And in the real world , it doesn't.  We don't
> promote software that hurts peopleperiod.

It can and it does, and I showed you that *I* use it in that way.  The
software has been very helpful to me, in ways I completely control.

But don't let me interfere with your period.

Re: Web versions

[DJ Delorie]

aviva  writes:
> On 3/14/21 6:18 PM, DJ Delorie wrote:
>> Thus, in a way you are arguing AGAINST the
>> user's freedom.
>
> No - I am arguing against creating a system where you lose control of
> your computer and it is over run by hackers because of poor deisgn. 
> NOTHING can excuse that,

GCC has been used to write software that hacks into other people's
computers.  Should we argue against writing gcc?  After all, there's no
exuse for using software for criminal activities.

You are arguing that we should take away a technology from the user,
because some people use that technology in ways you disagree with.
However, other people use that same technology in other ways.  It is not
the technology that is evil, it's how it's used that may be evil.

Re: Web versions

[DJ Delorie]

aviva  writes:
> On 3/14/21 6:18 PM, DJ Delorie wrote:
>> This application totally honors the four freedoms,
>
> No - it doesn't actually.  It fails value one that the user is in
> control of there system.

How so?  I downloaded the sources and ran them on my own system.  How am
I not in control?

Re: Web versions

[DJ Delorie]

>>> technology which is designed to be slaveware and dependent un insecure
>> This is a value judgement
>
>
> Right, being a slave is bad.  That IS a value judgement.  Values - that
> those are good.  Get some!

Since you insist on misinterpreting, let me clarify.

The value judgement is that the "technology is designed to be something".

I say that the technology just *is*.  We should judge the technology
independently of how some people choose to use it.

Re: Web versions

[aviva]

On 3/14/21 6:18 PM, DJ Delorie wrote:
>  Discouraging the
> technology itself is, IMHO, outside the FSF's scope.


Your opinion has been heard and its been explained already to you that
it is wrong.

Re: Web versions

[aviva]

On 3/14/21 6:18 PM, DJ Delorie wrote:
>  If WebAssembly or Javascript can be used in a
> way that honors the four freedoms,



But it can't...period.  And in the real world , it doesn't.  We don't
promote software that hurts peopleperiod.

Re: Web versions

[aviva]

On 3/14/21 6:18 PM, DJ Delorie wrote:
> Thus, in a way you are arguing AGAINST the
> user's freedom.



No - I am arguing against creating a system where you lose control of
your computer and it is over run by hackers because of poor deisgn. 
NOTHING can excuse that,

Re: Web versions

[aviva]

On 3/14/21 6:18 PM, DJ Delorie wrote:
> This application totally honors the four freedoms,



No - it doesn't actually.  It fails value one that the user is in
control of there system.

Re: Web versions

[aviva]

On 3/14/21 6:18 PM, DJ Delorie wrote:
> shulie  writes:
>> technology which is designed to be slaveware and dependent un insecure
> This is a value judgement



Right, being a slave is bad.  That IS a value judgement.  Values - that
those are good.  Get some!

Re: Web versions

[aviva]

On 3/14/21 6:47 PM, Colby Russell wrote:
>
> The problems inherent to traditional web apps are neither here nor
> there.



that is wrong. 

Re: Web versions

[aviva]

On 3/14/21 6:47 PM, Colby Russell wrote:
>>
> You have your thumb on the scale.  The context is a copy of the GNU
> operating system built to run on the platform that is universally
> available to essentially everyone in the world without even trying:



we have that anyway.  What this offers is a gnu system in a browser. 
That is bad.  There is NOTHING good about that.

Re: Web versions

[Colby Russell]

On 3/14/21 1:25 PM, Alfred M. Szmidt wrote:

The same is absolutley not true for Javascript or Webassembly, it is
nigh impossible to download the full set of scripts and other code to
run it locally.

You have your thumb on the scale.  The context is a copy of the GNU
operating system built to run on the platform that is universally
available to essentially everyone in the world without even trying: the
runtime that is built into commodity web browser.s

This conversation is filled with subtle attempts to substitute the thing
that's actually on the table with a strawman that no one is proposing;
you want those talking about the browser runtime as a compilation target
to take responsibility for traditional web apps.

The problems inherent to traditional web apps are neither here nor
there.

If I make available a ZIP file containing a file libre.x.htm which takes
as input an image of the GNU operating system (shipped within the same
ZIP file), then there are *ZERO* web servers involved--at least to no
greater degree than traditional distributions' package repositories--and
of course I may at my choice place those files on a computer of my own
that makes them accessible via HTTP, thus protecting my freedom and
allowing me to exercise it to the greatest extent possible in hostile
environments where I am otherwise required to use proprietary systems.

--
Colby Russell

Re: Web versions

[DJ Delorie]

shulie  writes:
> technology which is designed to be slaveware and dependent un insecure

This is a value judgement on the developer writing the software, not the
technology of the software itself.  Please do not confuse the two.

For example, I regularly use a javascript application that is served by
another site but runs 100% on my computer with 100% of the sources
available to myself.  I think I even did a "save file" to run it when
the network is down.  This application is hosted in source form on
github and licensed in a GNU-compatible way.

This application totally honors the four freedoms, yet uses a technology
you say we should not use.  Thus, in a way you are arguing AGAINST the
user's freedom.

> Or maybe they will, but that doesn't mean it is something the GNU
> project should promote.

The GNU project should promote Free Software in all the ways that the
user can benefit from those freedoms, regardless of what technology
underlies those freedoms.  If WebAssembly or Javascript can be used in a
way that honors the four freedoms, the FSF's position should be to
encourage *those* ways, and discourage *other* ways.  Discouraging the
technology itself is, IMHO, outside the FSF's scope.

Re: Web versions

[shulie]

On 3/11/21 1:42 PM, DJ Delorie wrote:
> Everything I've suggested so far complies with the wording and spirit of
> the GPL, and is fully under the user's control.



no it doesn't, and the user is not in control.