/philosophy/javascript-trap.html-diff

<!--#include virtual="/server/header.html" -->
<!-- Parent-Version: (削除) 1.77 (削除ここまで) (追記) 1.98 -->
<!-- This page is derived from /server/standards/boilerplate.html -->
<!--#set var="TAGS" value="essays licensing traps" -->
<!--#set var="DISABLE_TOP_ADDENDUM" value="yes" (追記ここまで) -->
<title>The JavaScript (削除) Trap</title> (削除ここまで) (追記) Trap - GNU Project - Free Software Foundation</title> (追記ここまで)
<!--#include virtual="/philosophy/po/javascript-trap.translist" -->
<!--#include virtual="/server/banner.html" -->
(追記) <!--#include virtual="/philosophy/ph-breadcrumb.html" -->
<!--GNUN: OUT-OF-DATE NOTICE-->
<!--#include virtual="/server/top-addendum.html" -->
<div class="article reduced-width"> (追記ここまで)
<h2>The JavaScript Trap</h2>
(削除) <p>by (削除ここまで)
(追記) <address class="byline">by (追記ここまで) <a (削除) href="http://www.stallman.org/">Richard Stallman</a></p> (削除ここまで) (追記) href="https://www.stallman.org/">Richard
Stallman</a></address>
<div class="introduction">
<p>There are two kinds of moral wrongs a web page can do. This page
describes the wrong of sending nonfree programs to run in your
computer. There is also the wrong we call SaaSS, “Service as a
Software Substitute” where the page invites you
to <a href="/philosophy/who-does-that-server-really-serve.html">send
your data</a> so it can do computing on it in the server—computing
which is unjust because you have no control over what computing is
done.</p>
</div> (追記ここまで)
<p><strong>You may be running nonfree programs on your computer every
day without realizing it—through your web browser.</strong></p>
(追記) <!-- any links that used to point to the appendices should point to
 free-your-javascript.html instead. -->
<div class="announcement comment" role="complementary">
<hr class="no-display" />
<p>Webmasters: there are
<a href="/software/librejs/free-your-javascript.html">several ways</a>
to indicate the license of JavaScript programs in a web site.</p>
<hr class="no-display" />
</div> (追記ここまで)
<p>In the free software community, the idea that
(追記) <a href="/philosophy/free-software-even-more-important.html">
any (追記ここまで) nonfree (削除) programs
mistreat their users (削除ここまで) (追記) program mistreats its users</a> (追記ここまで) is familiar. Some of us (削除) refuse entirely to
install (削除ここまで)
(追記) defend our freedom by rejecting all (追記ここまで) proprietary (削除) software, and many (削除ここまで) (追記) software on our
computers. Many (追記ここまで) others (削除) consider nonfreedom (削除ここまで) (追記) recognize nonfreeness as (追記ここまで) a strike against the (削除) program. Many (削除ここまで)
(追記) program.</p>
<p>Many (追記ここまで) users are aware that this issue applies to the plug-ins that
browsers offer to install, since they can be free or (削除) nonfree.</p>
<p>But (削除ここまで) (追記) nonfree. But (追記ここまで)
browsers run other nonfree programs which they don't ask you
(削除) about (削除ここまで) (追記) about, (追記ここまで) or
even tell you about—programs that web pages contain or link to.
These programs are most often written in JavaScript, though other
languages are also used.</p>
<p>JavaScript (officially called ECMAScript, but few use that name)
was once used for minor frills in web pages, such as cute but
inessential navigation and display features. It was acceptable to
consider these as mere extensions of HTML markup, rather than as true (削除) software; they
did not constitute a significant (削除ここまで)
(追記) software, and disregard the (追記ここまで) issue.</p>
(削除) <p>Many (削除ここまで)
(追記) <p>Some (追記ここまで) sites still use JavaScript that way, but (削除) some (削除ここまで) (追記) many (追記ここまで) use it for major
programs that do large jobs. For instance, Google Docs (削除) downloads (削除ここまで) (追記) tries to
install (追記ここまで) into your (削除) machine (削除ここまで) (追記) browser (追記ここまで) a JavaScript program which measures half a
megabyte, in a compacted form that we could call (削除) Obfuscript because it has no
comments (削除ここまで) (追記) Obfuscript. This
compacted form is made from the source code, by deleting the extra
spaces that make the code readable (追記ここまで) and (削除) hardly any whitespace, (削除ここまで) (追記) the explanatory remarks that
make it comprehensible, (追記ここまで) and (追記) replacing each meaningful name in (追記ここまで) the (削除) method names are one
letter long. (削除ここまで) (追記) code
with an arbitrary short name so we can't tell what it is supposed to
mean.</p>
<p>Part of the <a href="/philosophy/free-sw.html">meaning of free
software</a> is that users have access to the program's source code
(its plan). (追記ここまで) The source code of a program (削除) is (削除ここまで) (追記) means (追記ここまで) the preferred form for
(削除) modifying it; the compacted (削除ここまで)
(追記) programmers to modify—including helpful spacing, explanatory
remarks, and meaningful names. Compacted (追記ここまで) code is (削除) not (削除ここまで) (追記) a bogus, useless
substitute for (追記ここまで) source (削除) code, and (削除ここまで) (追記) code; (追記ここまで) the real source code of (削除) this program (削除ここまで) (追記) these programs (追記ここまで) is
not available to the (削除) user.</p> (削除ここまで) (追記) users, so users cannot understand it; therefore
the programs are nonfree.</p>
<p>In addition to being nonfree, many of these programs
are <em>malware</em> because
they <a href="https://github.com/w3c/fingerprinting-guidance/issues/8">snoop
on the user</a>. Even nastier, some sites use services which record
<a href="https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts/">all
the user's actions while looking at the page</a>. The services
supposedly “redact” the recordings to exclude some
sensitive data that the web site shouldn't get. But even if that
works reliably, the whole purpose of these services is to give the web
site other personal data that it shouldn't get.</p> (追記ここまで)
<p>Browsers don't normally tell you when they load JavaScript
programs.
(削除) Most (削除ここまで) (追記) Some (追記ここまで) browsers have a way to turn off JavaScript entirely,
but (削除) none of
them can check for JavaScript programs that are nontrivial and
nonfree. Even (削除ここまで) (追記) even (追記ここまで) if you're aware of this issue, it would take you considerable
trouble to identify (追記) the nontrivial nonfree programs (追記ここまで) and (削除) then (削除ここまで) block (削除) those programs. (削除ここまで) (追記) them. (追記ここまで)
However, even in the free software community most users are not aware
of this issue; the browsers' silence tends to conceal it.</p>
(削除) <p>It (削除ここまで)
(追記) <p>To be clear, the language JavaScript is not inherently better or worse 
for users' freedom than any other language.
It (追記ここまで) is possible to release a JavaScript program as free software, by
distributing the source code under a free software license. (削除) But even
if (削除ここまで) (追記) If (追記ここまで) the (削除) program's source (削除ここまで)
(追記) program (追記ここまで) is (削除) available, there (削除ここまで) (追記) self-contained—if its functioning and purpose are
independent of the page it came in—that (追記ここまで) is (削除) no easy way (削除ここまで) (追記) fine; you can copy it (追記ここまで)
to (削除) run (削除ここまで) (追記) a file on (追記ここまで) your
(削除) modified version instead (削除ここまで) (追記) machine, modify it, and visit that file with a
browser to run it. It's even possible to package it for installation
just like other free programs and invocation with a shell command.
These programs present no special moral issue different from those
of C programs.</p>
<p>The issue (追記ここまで) of the (削除) original. Current free (削除ここまで) (追記) JavaScript trap applies when the JavaScript
program comes along with a web page that users visit.
Those JavaScript programs are written to work with a
particular page or site, and the page or site depends on them to
function.</p>
<p>Suppose you copy and modify the page's JavaScript code.
Then another problem arises: even if the program's source
is available, (追記ここまで) browsers do not offer a (削除) facility (削除ここまで) (追記) way (追記ここまで) to run your (削除) own (削除ここまで) modified version
instead of the
(削除) one delivered in the page. (削除ここまで) (追記) original when visiting that page or site. (追記ここまで) The effect
is comparable to tivoization, although (追記) in principle (追記ここまで) not quite so hard
to overcome.</p>
<p>JavaScript is not the only language web sites use for programs sent
to the user. Flash (削除) supports (削除ここまで) (追記) supported (追記ここまで) programming through an extended variant
of
(削除) JavaScript. We will need to study the issue (削除ここまで) (追記) JavaScript, but that is a thing (追記ここまで) of (削除) Flash to make suitable
recommendations. (削除ここまで) (追記) the past. Microsoft (追記ここまで) Silverlight
seems likely to create a problem similar to Flash, except worse, since
Microsoft uses it as a platform for nonfree codecs. A free
replacement for Silverlight does not do the job (追記) adequately (追記ここまで) for the
free world unless it normally comes with free replacement codecs.</p>
<p>Java applets also run in the browser, and raise similar issues. In
general, any sort of applet system poses this sort of problem. Having
a free execution environment for an applet only brings us far enough
to encounter the problem.</p>
(追記) <p>It is theoretically possible to program in HTML and CSS, but in
practice this capability is limited and inconvenient; merely to make
it do something is an impressive hack. Such programs ought to be
free, but CSS is not a serious problem for users' freedom as of
2019.</p> (追記ここまで)
<p>A strong movement has developed that calls for web sites to
communicate only through formats and protocols that are free (some say
(削除) "open"); (削除ここまで)
(追記) “open”); (追記ここまで) that is to say, whose documentation is published and which
anyone is free to implement. (削除) With (削除ここまで) (追記) However, (追記ここまで) the presence of (追記) JavaScript (追記ここまで) programs
in web
(削除) pages, (削除ここまで) (追記) pages makes (追記ここまで) that criterion (削除) is necessary, but not sufficient. (削除ここまで) (追記) insufficient. The (追記ここまで) JavaScript (追記) language (追記ここまで)
itself, as a format, is free, and use of JavaScript in a web site is
not necessarily bad. However, as we've seen above, it (削除) also isn't
necessarily OK. (削除ここまで) (追記) can be bad—if
the JavaScript program is nonfree. (追記ここまで) When the site transmits a program
to the user, it is
not enough for the program to be written in a documented and
unencumbered language; that program must be free, too. (削除) “Only (削除ここまで) (追記) “Transmits only (追記ここまで) free
programs (削除) transmitted (削除ここまで) to the user” must become part of the criterion
for (削除) proper behavior by (削除ここまで) (追記) an ethical (追記ここまで) web (削除) sites.</p> (削除ここまで) (追記) site.</p> (追記ここまで)
<p>Silently loading and running nonfree programs is one among several
issues raised by (削除) "web applications". (削除ここまで) (追記) “web applications.” (追記ここまで) The term (削除) "web
application" (削除ここまで) (追記) “web
application” (追記ここまで) was designed to disregard the fundamental
distinction between software delivered to users and software running
on (削除) the (削除ここまで) (追記) a (追記ここまで) server. It can refer to a specialized client program running
in a browser; it can refer to specialized server software; it can
refer to a specialized client program that works hand in hand with
specialized server software. The client and server sides raise
different ethical issues, even if they are so closely integrated that
they arguably form parts of a single program. This article addresses
only the issue of the client-side software. We are addressing the
server issue separately.</p>
<p>In practical terms, how can we deal with the problem of (追記) nontrivial (追記ここまで) nonfree
JavaScript programs in web sites? The first step is to avoid running
it.</p>
<p>What do we mean by (削除) "nontrivial"? (削除ここまで) (追記) “nontrivial”? (追記ここまで) It is a matter of
degree, so this is a matter of designing a simple criterion that gives
good results, rather than finding the one correct answer.</p>
<p>
Our (削除) tentative policy (削除ここまで) (追記) current criterion (追記ここまで) is to consider a JavaScript program nontrivial (削除) if:</p> (削除ここまで)
(追記) if any of these conditions is met:</p> (追記ここまで)
<ul>
 <li>it (削除) makes an AJAX request or (削除ここまで) is (削除) loaded along with scripts that make (削除ここまで) (追記) referred to as (追記ここまで) an (削除) AJAX request,</li>
 <li>it loads (削除ここまで) external (削除) scripts dynamically (削除ここまで) (追記) script (from another page).</li>
 <li>it declares an array more than 50 elements long.</li>
 <li>it defines a named entity (function (追記ここまで) or (削除) is loaded along with
 scripts (削除ここまで) (追記) method) (追記ここまで) that (削除) do,</li> (削除ここまで) (追記) calls anything other
 than a primitive.</li> (追記ここまで)
 <li>it defines (追記) a named entity with more than three conditional
 constructs and loop construction.</li>
 <li>code outside of named definitions calls anything but primitives and (追記ここまで)
 functions (削除) or methods (削除ここまで) (追記) defined further up in the page.</li>
 <li>code outside of named definitions contains more than three
 conditional constructs (追記ここまで) and (削除) either loads an external script
 (from html) or is loaded as one,</li> (削除ここまで) (追記) loop construction, total.</li>
 <li>it calls <b>eval</b>.</li>
 <li>it does Ajax calls.</li>
 <li>it uses bracket notation for dynamic object property access,
which looks like <b><em>object</em>[<em>property</em>]</b>.</li>
 <li>it alters the DOM.</li> (追記ここまで)
 
 <li>it uses dynamic JavaScript constructs that are difficult to
 analyze without interpreting the program, or is loaded along with
 scripts that use such constructs. (削除) These constructs are:
 <ul>
 <li>using the eval function,</li>
 <li>calling methods with the square bracket notation,</li>
 <li>using (削除ここまで) (追記) Specifically, using (追記ここまで) any other
 construct than a string literal with certain methods (削除) (Obj.write, Obj.createElement, ...).</li>
 </ul>
 </li> (削除ここまで)
 (追記) (<b>Obj.write</b>, <b>Obj.createElement</b>, and others).</li> (追記ここまで)
</ul>
<p>How do we tell whether the JavaScript code is free? (削除) At the end of
this article (削除ここまで) (追記) In a <a 
href="/licenses/javascript-labels.html">separate article</a>, (追記ここまで)
we propose a (削除) convention (削除ここまで) (追記) method (追記ここまで) by which a nontrivial JavaScript
program in a web page can state the URL where its source code is
located, and can state its license too, using stylized comments.</p>
<p>Finally, we need to change free browsers to detect and block
nontrivial nonfree JavaScript in web pages. The program
<a href="/software/librejs/">LibreJS</a> detects nonfree,
nontrivial JavaScript in pages you visit, and blocks it. LibreJS is
(追記) included in IceCat, and available as (追記ここまで) an add-on for (削除) IceCat and IceWeasel (and Firefox).</p> (削除ここまで) (追記) Firefox.</p> (追記ここまで)
<p>Browser users also need a convenient facility to specify JavaScript
code to use <em>instead</em> of the JavaScript in a certain page.
(The specified code might be total replacement, or a modified version
of the free JavaScript program in that page.) Greasemonkey comes close
to being able to do this, but not quite, since it doesn't guarantee to
modify the JavaScript code in a page before that program starts to
execute. Using a local proxy works, but is too inconvenient now to be
a real solution. We need to construct a solution that is reliable and
convenient, as well as sites for sharing changes. The GNU Project
would like to recommend sites which are dedicated to free changes
only.</p>
<p>These features will make it possible for a JavaScript program included
in a web page to be free in a real and practical sense. JavaScript
will no longer be a particular obstacle to our freedom—no more than
C and Java are now. We will be able to reject and even replace the
nonfree nontrivial JavaScript programs, just as we reject and replace
nonfree packages that are offered for installation in the usual way.
Our campaign for web sites to free their JavaScript can then begin.</p>
<p>In the mean time, there's one case where it is acceptable to run a
nonfree JavaScript program: to send a complaint to the website
operators saying they should free or remove the JavaScript code in the
site. Please don't hesitate to enable JavaScript temporarily to do
that—but remember to disable it again afterwards.</p>
(削除) <p><strong>Thank you to <a href="/people/people.html#mattlee">Matt Lee</a>
and <a href="http://ejohn.org">John Resig</a> for their help in
defining our proposed criterion, and to David Parunakian for
helping to make me aware of the problem.</strong></p>
<h3 id="AppendixA">Appendix A: a convention for releasing free JavaScript programs</h3>
<p>For references (削除ここまで)
(追記) <!-- any links that used (追記ここまで) to (削除) corresponding source code, we recommend</p>
<pre dir="ltr">
 // @source:
</pre>
<p>followed by the URL. This satisfies the GNU GPL's requirement (削除ここまで) (追記) point (追記ここまで) to
(削除) distribute source code. If (削除ここまで) the (削除) source is on a different site, you
must take care (削除ここまで) (追記) appendices should point (追記ここまで) to
 (追記) free-your-javascript.html instead. -->
<div class="announcement comment" role="complementary">
<hr class="no-display" />
<p>Webmasters: there are (追記ここまで)
<a (削除) href="/licenses/gpl-faq.html#SourceAndBinaryOnDifferentSites">
handle that properly</a>. Source code is necessary for the program (削除ここまで) (追記) href="/software/librejs/free-your-javascript.html">several ways</a> (追記ここまで)
to
(削除) be free.
</p>
<p>To (削除ここまで) indicate the license of (削除) the (削除ここまで) JavaScript (削除) code embedded in a page, we
recommend putting the license notice between two notes of this form:</p>
<pre dir="ltr">
<!--TRANSLATORS: Do not translate these license notices. The <pre>
 elements have dir="ltr" explicitly set to cater for RTL languages.-->
 @licstart The following is the entire license notice for the 
 JavaScript code in this page.
 ...
 @licend The above is the entire license notice
 for the JavaScript code in this page.
</pre>
<p>Of course, all of this should be contained (削除ここまで) (追記) programs (追記ここまで) in a (削除) multiline comment.</p>
<p>The (削除ここまで) (追記) web site.</p>
<hr class="no-display" />
</div>
<p><strong>Acknowledgements:</strong> I thank (追記ここまで) <a (削除) href="/licenses/gpl.html">GNU GPL</a>, like many other free
software licenses, requires distribution of a copy of the license with
both source (削除ここまで) (追記) href="/people/people.html#mattlee">Matt Lee</a> (追記ここまで)
and (削除) binary forms of the program. However, the GNU GPL is
long enough that including it in a page with a JavaScript program can
be inconvenient. You can remove that requirement, (削除ここまで) (追記) <a href="https://johnresig.com/">John Resig</a> (追記ここまで) for (削除) code that you
have the copyright on, with a license notice like this:</p>
<pre dir="ltr">
 Copyright (C) YYYY Developer
 The JavaScript code (削除ここまで) (追記) their help (追記ここまで) in (削除) this page is free software: you can
 redistribute it and/or modify it under the terms of the GNU
 General Public License (GNU GPL) as published by the Free Software
 Foundation, either version 3 of the License, or (at your option)
 any later version. The code is distributed WITHOUT ANY WARRANTY;
 without even the implied warranty of MERCHANTABILITY or FITNESS
 FOR A PARTICULAR PURPOSE. See the GNU GPL for more details.
 As additional permission under GNU GPL version 3 section 7, you
 may distribute non-source (e.g., minimized or compacted) forms of
 that code without the copy of the GNU GPL normally required by
 section 4, provided you include this license notice (削除ここまで)
(追記) defining our proposed criterion, (追記ここまで) and (削除) a URL
 through which recipients can access the Corresponding Source.
</pre>
<p>I thank Jaffar Rumith (削除ここまで) (追記) David Parunakian (追記ここまで) for
bringing (削除) this issue (削除ここまで) (追記) the problem (追記ここまで) to my attention.</p>
(削除) <h3 id="AppendixB">Appendix B: Publishing free JavaScript programs as
 a webmaster</h3>
<p>If you're a webmaster deploying free JavaScript software
 on your site, clearly and consistently publishing information about
 those files' licenses and source code helps your visitors make
 sure that they're running free software, and help you comply with
 license conditions.</p>
<p>One method of stating the licenses is the one described above in
 <a href="#AppendixA">Appendix A</a>. A second
 method, <a href="/licenses/javascript-labels.html"> JavaScript
 license web labels</a>, can be more convenient for libraries of
 minified JavaScript code, especially when you didn't write them.</p> (削除ここまで)
(追記) </div> (追記ここまで)
</div><!-- for id="content", starts in the include above -->
<!--#include virtual="/server/footer.html" -->
<div (削除) id="footer"> (削除ここまで) (追記) id="footer" role="contentinfo"> (追記ここまで)
<div class="unprintable">
<p>Please send general FSF & GNU inquiries to
<a href="mailto:gnu@gnu.org"><gnu@gnu.org></a>.
There are also <a href="/contact/">other ways to contact</a>
the FSF. Broken links and other corrections or suggestions can be sent
to <a href="mailto:webmasters@gnu.org"><webmasters@gnu.org></a>.</p>
<p><!-- TRANSLATORS: Ignore the original text in this paragraph,
 replace it with the translation of these two:
 We work hard and do our best to provide accurate, good quality
 translations. However, we are not exempt from imperfection.
 Please send your comments and general suggestions in this regard
 to <a href="mailto:web-translators@gnu.org">
 <web-translators@gnu.org></a>.</p>
 <p>For information on coordinating and (削除) submitting (削除ここまで) (追記) contributing (追記ここまで) translations of
 our web pages, see <a
 href="/server/standards/README.translations.html">Translations
 README</a>. -->
Please see the <a
href="/server/standards/README.translations.html">Translations
README</a> for information on coordinating and (削除) submitting (削除ここまで) (追記) contributing (追記ここまで) translations
of this article.</p>
</div>
<!-- Regarding copyright, in general, standalone pages (as opposed to
 files generated as part of manuals) on the GNU web server should
 be under CC BY-ND (削除) 3.0 US. (削除ここまで) (追記) 4.0. (追記ここまで) Please do NOT change or remove this
 without talking with the webmasters or licensing team first.
 Please make sure the copyright date is consistent with the
 document. For web pages, it is ok to list just the latest year the
 document was modified, or published.
 
 If you wish to list earlier years, that is ok too.
 Either "2001, 2002, 2003" or "2001-2003" are ok for specifying
 years, as long as each year in the range is in fact a copyrightable
 year, i.e., a year in which the document was published (including
 being publicly visible on the web or in a revision control system).
 
 There is more detail about copyright years in the GNU Maintainers
 Information document, www.gnu.org/prep/maintain. -->
<p>Copyright © (削除) 2009, 2010 (削除ここまで) (追記) 2009-2013, 2016-2019, 2021, 2023, 2024 (追記ここまで) Richard Stallman</p>
<p>This page is licensed under a <a rel="license"
(削除) href="http://creativecommons.org/licenses/by-nd/3.0/us/">Creative (削除ここまで)
(追記) href="http://creativecommons.org/licenses/by-nd/4.0/">Creative (追記ここまで)
Commons (削除) Attribution-NoDerivs 3.0 United States (削除ここまで) (追記) Attribution-NoDerivatives 4.0 International (追記ここまで) License</a>.</p>
<!--#include virtual="/server/bottom-notes.html" -->
<p class="unprintable">Updated:
<!-- timestamp start -->
$Date: 2025年12月29日 04:35:00 $
<!-- timestamp end -->
</p>
</div>
(削除) </div> (削除ここまで)
(追記) </div><!-- for class="inner", starts in the banner include --> (追記ここまで)
</body>
</html>