Hacker News Reader

Comment by aidenn0 | Hacker News Reader

> The problem comes not from the language JavaScript, but from the fact that browsers, by default, will pull in JavaScript code that gets sent to them and run it to do anything at all. Emacs is supposed to defend your freedom. It's supposed to help you to defend your freedom, and lead you to defend your freedom, which means it shouldn't lead you to throw your freedom away as soon as you visit a site that tries to send you a non-free program to run straight off of that other machine. So it's important not to lead users to do computing this way.

I don't know how this is related to extending Emacs with JavaScript, but it's more or less correct about how JavaScript works in the browser (modulo "anything at all" being "anything at all in the browser sandbox"). If you only want to run free software, you necessarily must disable JS in your browser.

View on HN

I don't understand the argument that Javascript isn't free. Every library I'm aware of is MIT or otherwise FOSS licensed, and (at least before Node.js and NPM came along) it isn't owned or licensed by a specific corporation. It's probably the most free programming language ever created.

It's RMS, so I know he's going to throw the baby out with the bathwater on this, then throw out the bathtub, then disassemble the plumbing, brick up the bathroom and never bathe again on principle, but Javascript has probably served as a greater benefit for FOSS culture than any other language. Certainly more so than lisp. Making it out to be an implicitly evil language seems... out of touch?

quick edit: I know the argument about privacy invading javascript software, but software can be free and still invade your privacy. That's got nothing to do with the language.

Just to explain, the non-free code JavaScript code he is referring to is the inline JavaScript code on individual web pages (which in turn often uses the large MIT-licensed libraries).

The JS mess has brought us megabyte huge blobs of minified JS that does who knows what, slowing down getting information to a crawl compared to what could be. Not all JS is like that, but a lot of people are actively participating in creating that mess.

I do think reading https://www.gnu.org/philosophy/javascript-trap.html is helpful to understand his position. Specially if you're familiar with his 'four freedoms' concept

I'm not a fan of RMS, but as you noted, his blurb in the talk wasn't "Javascript the language is not free", or even "Javascript the ecosystem is not free", it's about the privacy invading factor of JS in a modern web browser. Since, as you said, software can be free and still invade your privacy.

He just doesn't want this GNU project to include support for a language whose primary purpose seems to be invading privacy -- even if it has a lot of great secondary purposes and a good open source ecosystem. Given that the GNU/FSF projects are all about advocacy in the area of software freedom and privacy, it seems like a reasonable perspective to have. Yeah, RMS definitely takes things to an extreme, but I don't see the "JS is implicitly evil" thing you're calling out, just refusing to appear to endorse or support something that goes against his principles.

And of course ironically enough those very principles mean he (should be...) perfectly happy with the emacs-ng fork, since that's part of the freedom he's advocating for.

yes, js can be used to invade privacy, but...

a) that's not its primary use by a long shot. The VAST majority of JS written has nothing to do with tracking / privacy stuff.

b) we don't need JS to invade your privacy on the web... Does he browse without images turned on too?!

(and i recognize you're just explaining his position not arguing against JS)

> “b) we don't need JS to invade your privacy on the web... Does he browse without images turned on too?”

He doesn’t really browse the web at all:

“””How I use the Internet

I am careful in how I connect to the internet.

Specifically, I refuse to connect through portals that would require me to identify myself, or to run any nontrivial nonfree Javascript code. I use LibreJS to prevent nonfree Javascript code from running.

I am careful in how I use the Internet.

I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it.

I occasionally also browse unrelated sites using IceCat via Tor. Except for rare cases, I do not identify myself to them. I think that plus Tor plus LibreJS is enough to prevent my browsing from being associated with me. “””

https://stallman.org/stallman-computing.html

The JavaScript on a typical web site is most definitely not free. Someone wholesale copied the Crunchyroll player code into a Kodi plugin and got a (legitimate) DMCA takedown notice.

It's too late to update, but most commercial sites no longer have an explicit "all rights reserve" message, presumably because minifiers remove the comments. However, in many jurisdictions (including the US) such a notice is optional anyways.

Technically, elisp can do the same.

The "by default" is an important distinction.

That's not a language issue, but a platform (i.e. browser) issue. It's entirely possible to enable JS and not have this as the default.

In Emacs, you can install any package that will then do most/all the evil that JS can. In principle, you should be very careful about the packages you install.

That's what he said, more or less: "The problem comes not from the language JavaScript, but from the fact that browsers, by default, ..."

I think it's the cultural issues he's getting at. Minified or otherwise obfuscated elisp packages would rightly be viewed with suspicion. Unauditable JS is the norm, right?

He had devoted a part of the talk about browsers too, starting with:

> But one thing I think we really shouldn't have is the equivalent of a modern web browser.

I think people are focusing on the Javascript part alone too much, when he made it clear numerous times that he is talking about the browser model, not javascript language itself.

but... if he doesn't want the equivalent of a modern browser, then downloading and executing JS isn't really an issue, and thus the whole JS=BAD because you download it and execute it goes out the window.

I don't get it. Like, i don't care if we can write emacs stuff in JS or not, but i don't see how it's any more dangerous than Lisp.

I agree, his reasoning is strange: JS is used in other contexts to compromise user control. We want user control. Thus we will avoid Javascript in this context.

I mean he is only saying JS=BAD in the context of downloading and executing obfuscated non-free javascript. The scenario where JS isn't downloaded and executed (e.g. outside browser) isn't even being what's talked about here much less being also lumped into the BAD group, so it's weird that people here are making this about JS at all, when it's clearly not.

Reply on news.ycombinator.com