Hacker News Reader

Comment by samwillis | Hacker News Reader

> While we can't link to Google's issue tracker directly because of another freedom issue -- its use of nonfree JavaScript -- we're told ...

While there may be genuinely good arguments for keeping JPEG-XL, I cannot take seriously the arguments of an organisation that cuts itself off from the rest of the world for such silly reasons.

Edit: Google's argument that there wasn't enough interest is equally impossible to take seriously when it was always behind an optional flag. No web devs are going to invest time in developing JPEG-XL functionality until their users can actually use it.

View on HN

Unfortunately, I think this is a phenomenon with the FSF...

They want to raise a point X, which could in theory be communicated in a persuasive way.

But they can't resist also mentioning their zero-tolerance on unrelated point Y.

I think the Y makes people tend to go WTF, and then dismiss both X and Y.

Every time now, I'm thinking "You don't have to always mention Y!"

On at least a couple occasions, I actually abandoned an argument I was making on some X in a venue, because some FSF person jumped in with a Y. If I didn't know they were a true-believer in Y and at least sympathetic to X, I'd think they were trying to discredit both.

The FSF has some great principles, but a lot of the communications don't seem to be calibrated for me, nor for my understanding of anyone else.

I've been saying this for years and years. [1] The FSF / GNU folks are only preaching to the choir and don't really have any positive solutions.

They're happy to tell you what not to do, what software not to use (and what software they won't use) but that's it.

Their communications are calibrated for true believers only. They rely heavily on the reader/audience 1) agreeing with a fairly extreme position relative to the mainstream, and 2) the idea that the FSF/GNU has a position of authority/trust with the audience.

What's annoying is that I agree with them on the idea that deprecating JPEG-XL is counter to user interests and that Google has too much power. But they could've led with IceCat and made a more pragmatic case that might resonate with a larger audience. Hilariously, though, "building binary packages for Windows and MacOS currently requires nonfree software, so we no longer distribute binary packages for those platforms."

So... if you're already happy to be an Orthodox Free Software True Believer then you have an alternative. If you aren't, well, too damn bad. If you're a budding free software fan but happen to have a macOS machine or Windows machine your parents supplied, too bad. If you'd like to make a work computer slightly more free, too bad. Etc.

[1] https://web.archive.org/web/20100703110224/http://www.linux-... [2] https://www.gnu.org/software/gnuzilla/

> If you're a budding free software fan but happen to have a macOS machine or Windows machine your parents supplied, too bad.

There's much more to this. I have tried for well over a decade to run Linux as my daily driver on my laptop and gave up in 2018 January and just run Windows + WSL, especially since WSL2 this is quite good. There's always something that doesn't work. (And yes, if all you connect your laptop to is a normal wifi then your experience might differ. My problems were with Bluetooth, enterprise wifi and multifunctional printers.) It's entirely possible some people would prefer not running Linux because the manufacturers refuse to pay much attention to it.

I have been on Linux since 1993. Still running it on servers and router. It's still not the year of Linux on the desktop.

FSF is the uncompromising idealist for better and for worse. It takes some serious balls to live life the way RMS does, fetching HTML by sending email and all that. No one else wants to be that extreme, so even though they value computing freedom in the abstract they compromise and tolerate little injustices in the name of getting things done.

At the end of the day RMS is still right though. Those little injustices add up, the corporations creep up on you slowly and next thing you know you're being surveilled by the javascript you used to see as harmless, and soon you learn how to tolerate that too. Dude saw ridiculously far into the future even decades ago but it doesn't matter because stuff like RYF certification is irrelevant and will only ever apply to machines that must 20 years old by now because manufacturers don't care and everyone is on mobile now anyway.

The Javascript issue never made sense to me. You are reading a non-free document to begin with, what difference does it make if it is running Javascript or not? If they wanna spy on you they can do that with HTML and CSS just as well. Even releasing the spying software under GPL wouldn't stop it from spying on you.

The party one should be angry about here is the browser, which provides little to no tools to show the user what is going on and provides no real means to stop it. This is quite a bit different from the early web days when every browser had a "Javascript off" and style sheet selector right in the main menu by default.

> Dude saw ridiculously far into the future even decades ago

Not far enough. Ever since the whole world moved to "software as a service" and your computer has become little more than a thin terminal to some Google/Facebook/whatever-service FSF started to feel quite out of touch. Sure, they tell you "don't do that", but while that isn't wrong, it's not exactly helpful either. Many service simply have to run on a computer that you don't own and we need rules to govern that. None of the Free Software licenses help here.

FSF never bothered to create any kind of licenses or best practices that deal with how those services should work. They are stuck in dealing with software freedom problems of the 90s, not the problems we face today. Luckily we do have the GDPR now, but the FSF had nothing to do with that and never provided anything similar.

>The party one should be angry about here is the browser, which provides little to no tools to show the user what is going on

Wait, what? The browser is the single best platform in existence for showing people what is going on behind the scenes - hit F12 and enjoy. Very few other software projects give users these kinds of tools, available at runtime.

But if you refuse to use software because of religious reasons, you may not be aware of this.

None of that is accessible in the normal user interface, nor is there an easy way to disable any of that stuff from happening in the first place. As said, we used to have buttons to disable Javascript, CSS, image loading and cookies straight in the main menu, no addons or developer tools needed.

We wouldn't have needed EU cookie banner laws if browser didn't stop making cookie storage obvious. Lynx is about the only browser left that still makes cookie storage an explicit action. A Stop button that actually stops a webpage from executing Javascript in the background would be welcome as well.

Browser have long given up trying to be document viewers that serve the user and just turned into advertisement displays.

You can turn off JavaScript execution in all browsers by going to about:config and setting javascript.enabled=false. It's not a button, but I think it's okay.

Browser have long given up trying to be document viewers...

I know, and isn't it wonderful? Its very cool to have a truly cross-platform, graphical, debuggable environment! Plus the two best ones are open source (Firefox and Chromium).

> The Javascript issue never made sense to me. [...] Even releasing the spying software under GPL wouldn't stop it from spying on you.

Exactly. The licence is not the only problem with javascript on the web because you can't use your freedoms in practice anyway since the code is automatically downloaded and executed when you load the page in a common web browser.

What we need is something that allows people to choose what code to run, similarly to how software traditionally is downloaded and executed in two separate steps. We need to get away from the assumption that people will run all code you throw at them when they visit your site. Then maybe licences on javascript can start to make more sense.

> because you can't use your freedoms in practice anyway

Yes, you could. You can adapt the code and use an extension to use your "fork" instead of the provided one. A convenient extension to do this might not exist yet, but you could block the website's provided JavaScript with uBlock Origin / uMatrix and use your fork with ViolentMonkey or another *Monkey extension. And distribute your fork on some user scripts repository (for instance).

Free software is not (only) about avoiding spying. It's about running the code you want to run for any endeavor you can have, and be able to study and distribute your modifications.

I totally agree with your last paragraph and I agree something should be done to deal with how (web) software is distributed and run.

> Yes, you could. You can adapt the code and use an extension to use your "fork" instead of the provided one.

Ok, that's possible to do but it's not a solution to the problem because:

- You would not have much use of it because javascript is often very dependent on the web page and the server so if any of those changes, your script breaks. There is no expectation that people do this so the website owners have no reason to keep a stable API.

- Only the people who use that extension or browser benefit from having that freedom. Compare this to traditional software where forks can easily be created and maintained and get more popular than the original fork. Now people who don't even know about the forks will benefit from it because they will likely use the fork that gets popular which can be the better one. An example of this is software distributions (like Debian and so on) that may modify upstream software in a way that benefits all users, even the ones who are not aware. That would be extremely difficult to do with all websites on the web without things constantly breaking.

I agree that its not practical nor satisfactory indeed.

GNU has some interesting things to say about this.

https://www.gnu.org/philosophy/javascript-trap.html

However this page is a little out of date :)

That's assuming RMS isn't just LARPing.

Except they compromised on the very issue of media formats. They are making an unnecessary fight between two royalty-free formats, yet compromised and are hosting videos in royalty-bearing formats in their website. https://www.fsf.org/blogs/community/the-fsfs-approach-to-usi...

Chromium's issue tracker appears to be open source, under the same BSD-type license as the core browser. https://chromium.googlesource.com/infra/infra/+/refs/heads/m...

The deployment references google-analytics, but everyone already blocks that, right?

> I cannot take seriously the arguments of an organisation that cuts itself off from the rest of the world for such silly reasons.

Why would they risk unsuspecting visitors running Google code on their computer? It is a spyware company.

There is nothing silly about not wanting to link to Google. Maybe futile given their market domination. But not silly.

If Google's website is designed in the fashion where none of the content is available statically and the only way to access it is via running a blob of intrusive code, I can understand their sentiment.

I would love people to stop linking, and posting links, to e.g. Facebook because the only thing it would show me is "you have to register to view this".

If non-intrusive browsers existed, which could run Javascript, is that considered acceptable to go to JS sites? eg what about Firefox or its derivatives?

The FSF opposes nonfree i.e. proprietary software. JavaScript is fine if properly licensed:

https://www.gnu.org/software/librejs/free-your-javascript

Just like any other software.

I wonder what FSF thinks of PDF.

Why do you think there is an issue?

The FSF - and Stallman! - publish PDF documents. At https://stallman.org/cgi-bin/showpage.cgi?path=/archives/202... you can see Stallman uses xournal to fill in a PDF form.

I wouldn’t be surprised if RMS said “I don’t file tax returns, because I would have to either (a) use nonfree online filing software, (b) use nonfree PDF technologies (since the US Form 1040 features XFA forms, and Wikipedia says the are nonfree [0]), or (c) hire an accountant, but they would also be using nonfree software, and the IRS is using proprietary software to process the tax returns anyway, so therefore I am not filing them”.

[0] https://en.wikipedia.org/wiki/XFA

The link I gave described that exact topic. Stallman wrote:

"I do not submit my tax returns on line because it requires nonfree software. I use xournal to write my data on the PDF form, and print that. As I have no printer, I will visit a copying store to do the printing."

Note that the copying store will be using a printer with nonfree software.

Thus, your (a) is correct, your (b) appears to be incorrect as Stallman was doing this 3 years ago, and your (c) is incorrect as Stallman doesn't have that objection.

We futher know (c) is incorrect because Stallman at https://stallman.org/rms-lifestyle.html write that he will use someone else's cell phone, even though it it not free.

Regarding (b), I can't tell if the 1040 at https://www.irs.gov/pub/irs-pdf/f1040.pdf uses XFA forms ("deprecated in PDF 2.0", in 2017), but it appears to work in Firefox, which I believe is using free software. Even if it does, you can order the forms at https://www.irs.gov/forms-pubs/forms-and-publications-by-us-... or visit a post office or library (see https://www.irs.com/en/articles/local-irs-tax-forms ).

These do not require using software, so I don't see why you conclude that Stallman would have a free software objection to filing taxes at all.

When you open the form linked, SumatraPDF will warn that “The document uses unsupported features (XFA) and might not render properly”, and it cannot fill out the form. Perhaps it’s not XFA specifically, but some other strange technology.

I did see that note about how Stallman does his taxes. But if Stallman has a sectarian objection to basic things like using a cell phone, or to even more basic non-tech things like personal hygiene, an objection to taxes wouldn’t seem far-fetched to me.

FWIW, https://github.com/sumatrapdfreader/sumatrapdf/issues/1249 ("Support form filling for at least 1040 irs form") has a comment saying "MuPDF-GL has the capability to edit fields and save the PDF" of a 1040.

I have just learned the Firefox 93 added support XFA - https://techdows.com/2021/10/open-xfa-pdfs-in-firefox.html .

So it would appear there are free software solutions to XFA forms.

Just because something doesn't seem far-fetched to you, doesn't mean most people will regard it as far-fetched.

Many people all sorts of "sectarian objections" - far more than there are SovCits or other tax protesters. Stallman has never come across as a tax protester. Ergo, I think it's far-fetched that "sectarian objections" is strongly associated with tax protests.

Further, at https://stallman.org/archives/2017-may-aug.html we can read Stallman opinine that we need to "return to the "bad old days", when Americans in general could have a decent life, not penury; when the US could afford to build what the public needed instead of privatizing everything with a toll" by making taxation more progressive. At https://stallman.org/archives/2011-jan-apr.html we read he supports "The Fairness in Taxation Act [which] would raise taxes to 45% on incomes over a million dollars a year."

PDF is a programming language, or at least PostScript is. I wonder if Stallman will refuse to open a random PS file?

At worst, postscript can crash your printer or take up a lot of cpu. There are no networking libraries or access to system stuff for postscript. So it should be safe for all practical purposes assuming you don’t care about the possible inconveniences that any Turing complete language can provide. This is a very different concern than executing random JavaScript.

I can't imagine why you would not be able to run site JavaScript in sandboxed manner (it already is) - just throw in some additional limitations and you are done.

This will break JS on some sites but not all of them, but that is apparently not sufficient for Stallman & co.

The reason you can’t do it is because JavaScript is Turing complete (like postscript, but unlike HTML) and JS needs to load from the network. This does not happen with postscript. There is no comparison to postscript that is meaningful in my mind.

I don't see why you cannot realistically pin JS loads from network to make them deterministic.

It is not the determinism that’s a concern. JavaScript can test the capabilities of your machine and then create a new connection to transmit its results back to another computer. Even in the hypothetical scenario when you are only allowed to download messages and not upload messages, things are hard: because you have a fully programmable language at your disposal, you can create a system to transmit information by a sequence of reads with JavaScript. So the only safe way is to pre-download everything, then turn off the network and only then evaluate JavaScript in an environment without network or storage. FSF is not against such a mode of operation, but it becomes cumbersome for most people. And as the development of browsers consolidates, the fraction of the web that can be used in that way (for those who want to be super careful) becomes smaller.

I don't think there's any doubt that Postscript would have the same copyright and software freedom issues as Javascript. I myself have written a GUI Postscript program for NeWS.

So yes, of course Stallman would have objections to some Postscript files.

No. The objection to linking to sites with JS is that they contain nonfree JS blobs that spy on you, run unknown obfuscated code, and are not open to modification, because they’re almost always obfuscated.

Still silly, because whoever cares about that stance can just visit the site with (requests for) Javascript disabled.

Chromium bug tracker doesn't work with Javascript disabled.

okay, I appreciate your reply. Even so, linking to the issue is helpful, including JavaScript disablers.

So do I with yours.

I both understand the FSF not wanting to link to something that's not readable without running non-free code, and the wish to have the link anyway, at least for reference.

> If non-intrusive browsers existed, which could run Javascript, is that considered acceptable to go to JS sites?

User agents need not be browsers. What if we had a scraper for every site? What if we had reverse engineered free software clients for every website's API endpoints? We'd be in full control.

People maintain humongous repositories of ad blocker filters and executable countermeasures against "clever" websites. Perhaps it would be feasible to maintain a collection of scrapers and custom clients too.

And that exact mindset made them totally irrelevant in the real world. The FSFE and other organizations like the EFF and the EDRI are much more relevant and have a bigger impact than an org which still insists on using devices from 2007

I agree with the FSF principles. But they could add a picture, or a link to an archive site that strips most JS. To avoid users having to go and open the real thing to see it

But then they themselves may have to read the source material, instead of relying on a vague "we're told" that may or may not be true.

Reply on news.ycombinator.com