As a developer who uses JavaScript in the web, I'm curious why people think
it's insecure? Can you tell me what features of JavaScript are insecure and
how can one make malicious code with JavaScript run in a browser?
Web JavaScript code isn't like any other software you install on you
computer, because it runs in a very restricted environment.
If there are known security issues concerning JavaScript running in a
browser, then those issues should definitely be fixed on the side of the
browser. Even if a web JavaScript is licensed as free software, that in no
way insures it's secure and non-malicious.
As I browse the web most things I see done with JavaScript are very trivial
and specific to that site. It doesn't seem useful to put everything in
repository because there are too many scripts and most of them are very
specific to one website. Non-trivial JavaScript code is used mostly in sites
which offer SaaSS and those shouldn't be used anyway.
It seems to me that most people who worry about insecure web JavaScript are
people who don't actually know how it works and what it does. Am I wrong?
That said, I think everything should be licensed as free software and
compatible with LibreJS, even if trivial. Because, why hoard the code?
Someone may find it useful.
On another note, what *Calinou* suggests is much worse than local non-free
JavaScript, since all visitors will be tracked by a third party. Just like
Google is doing in almost all sites right now. Connecting to third party
sites is very bad for privacy, even if it's just images and CSS, but almost
all sites are doing it, even FSF sites.
