1
the JavaScript problem: a conflict of interest
(linkage.ds8.zone)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Jul 2024
1 points (53.8% liked)
JavaScript
141 readers
3 users here now
A community to discuss all things JavaScript (and related areas, i.e. TypeScript)
founded 1 year ago
MODERATORS
Precisely my point. Recall what I wrote about conflict of interest. I’m not talking about a problem of the language syntax and semantics. I’m talking about JavaScript products (in the mathematical sense of a product not in the commercial sense; the code artifacts, iow).
That does nothing to remedy the conflict of interest. They can also push obfuscated JS but that’s beside the point. The problem is users are not going to review that code even the first time they visit a site, much less every single time due to the nature of dynamically re-fetching the code every single time you visit a page. Even if some OCD nutty user had that level of motivation, they do not benefit from the reviews of others because the code is not being reviewed from a static centralised space. Your idea that software freedom will somehow escape the conflict of interest problem is nonsense. A site admin can do whatever they want to the code to serve themselves and you end up with users running code that is designed to serve someone else.
FOSS C projects hard and fast benefit the user because of the distribution of the code. We do not fetch a dynamically changing version of unreviewable unverified C code every time we visit a website. Distribution of C code is more controlled than that.
FOSS JS depends on how it’s distributed. Someone can write JS in their basement with no public oversight, license it to pass the LibreJS plugin test, and technically it’s FOSS but because of how it’s reviewed and distributed the benefits are diminishing. If the FOSS JS is in a public repo and statically downloadable (e.g. electronmail), then the conflict of interest is removed and the code is static (not fetched on-the-fly upon every execution which escapes a QA process).
Electronmail demonstrates FOSS JS that avoids the conflict of interest problem but that’s exceptional. That’s not how most JS is distributed. Most JS is distributed from a stakeholder, thus presents a conflict of interest.
If i build a shitty house and it collapses, I own it, I don't write a manifesto about how it's all lumber's fault.
As does FOSS C - do you install linux from the source tree and build everything yourself? no, you download an .iso, so you are bound to the whims of the OS maintainer, who have their own interests. When you install filezilla you probably download the binary instead of building it from source - oh no, now you are subjected to the filezilla foundation's nefarious interests (purchasing a commercial support license so they can afford to develop GPL software)
Literally every JS package I've ever used does this. They have github actions set up to commit the compiled binaries to the
distfolder, which is then published to NPM - https://github.com/twbs/bootstrap/tree/main/distFrankly this entire post is just a critique of how commercial entities redistribute MIT licensed code, rather than anything specific to JS. Whatever point that could be made here is entirely obfuscated by flowery language
If you sell the house in a high-pressure sales tactic way (“buy in the next 5 min or deal is off the table”) and deny inspection to the buyer before it collapses, that would be as close as this stupid analogy can get to the JS scenario.
Nonsense. As you were told, C is not dynamically fetched and spontaneously executed upon visiting a website.
Nonsense. Have a look at gentoo. You absolutely can build everything from source. You can inspect it and you can also benefit from the inspection of others. Also, look into “reproduceable builds”.
Nonsense. The web is unavoidably littered with unpublished JS that’s dynamically fetched every time you visit the page.