On 01/06/13 19:56, Michał Masłowski wrote: > Why wouldn't the same problems occur with free scripts? Disabling > all JavaScript not on some "trusted" sites that need it would > solve them. (Although most of these problems can be implemented > differently to not use JavaScript.)
Yes. I think a better approach is needed than trusting websites to specify a license themselves. Technical solutions are often better than legal ones. More on this below... > I think free JavaScript would be better by allowing users to study > how it works and modify it, so modified browsers could run their > replacements instead of the scripts provided by the site or other > tools could access the same data (e.g. video download scripts). > (There are more benefits with useful scripts or if the user has > their own site.) I agree that this is one approach, and perhaps a good one. I think it is necessary, but perhaps not a complete solution on its own. I think that in the case of JavaScript, code signing could potentially be useful. For example, web browsers could distribute signatures of verified common JS code (e.g. jQuery), and also allow webpages to include JS signatures for scripts on the page. A web browser user could then choose to trust people or groups (like a group dedicated to signing only free JS) so that only signed JS is run in the browser. JS code signers could simply not sign malicious scripts, and so browsers with code verification capabilities could simply ignore the those scripts. > (I'm not a Web developer and I consider the approach of running > programs From any visited Web site a mistake.) I do agree. The other solution is to not use JavaScript. But, although that might be feasible for myself at the moment, I don't think it's a good solution for the general population. Too many people rely on JavaScript these days. -- Andrew Roffey OpenPGP fingerprint: F9E6 E6C4 0080 85F4 0E30 B0D9 7F7B DC7F 9657 B073
