Re: [Help-librejs] Detection of fake license information on websites?

[Dmitry Alexandrov]

grizzlyuser <address@hidden> wrote:
> In my understanding, the main features of LibreJS are:
> 1. Detect non-free JS.
> 2. Block non-free JS.

Given the state of affairs at the today’s Web, I would phrase it the other way 
around: detect free javascripts and unblock them.  :-)

> One of the main reasons for that is to protect the user from the code that's 
> likely to be malicious in one way or another.
>
> Yes, there are sandboxes and anti-fingerprinting measures for JS in modern 
> web browsers, but AFAIK they do not provide 100% protection for user safety 
> and privacy anyway.

I’m not affiliated with LibreJS, yet let me tell you, that no, you probably 
misunderstood the goal.  That is not the main reason, not even the secondary.  
Freedom has little to do with maliciousness or ‘privacy’.  Only with freedom.

> If site publisher decides to serve some malicious minified / obfuscated JS 
> code to all the visitors, and provides fake information about the license and 
> source code on the webpage, in order to cheat LibreJS, are there any 
> countermeasures for that?

Well, how can you provide a fake information about the licence?  Except 
perhaps, when you grant rights, which you are not eligible to grant (because 
you are not the proprietor of the program or otherwise).  Note, that does not 
necessary require any evil intentions, it also may be a honest mistake.  In any 
case, that’s a thing we hardly can fully control whatsoever, for any type of 
creative work.

You indeed can toss user a fake sources, though.

> Many software projects currently try to adopt reproducible builds practices 
> [1].
>
> But due to the nature of the Web, running JS code from untrusted 
> third-parties is very common, and there seems to be no easy solution to 
> follow that practice for every single website.

As far as I am aware, mere ‘minifying’ programs in Javascript contributes 
virtually nothing to their effectiveness, so they hardy may be called ‘builds’. 
 In that case, all we need to ensure that the program is technically free is 
just ignore the existence of ‘minified’ version one and run the actual source.

This is not panacea, however.  It is possible, that the source is not directly 
runnable by browser, but indeed may require some building from another 
language, such as Coffescript.

> Instead of LibreJS, for now I chose to disable JS altogether on almost all 
> websites I visit.

That is, probably, a good choice.  I do the same.

> Extensions like NoScript and uBlock Origin both can block all JS code by 
> default on non-whitelisted websites.

I chose µMatrix, since unlike µBlock (by the same author) it not only blocks 
scripts but also properly shows <noscript> content when they are blocked, and 
unlike NoScript, which does that unconditionally, it allows to alter this 
behaviour on per-domain basis.  It also provides an interface to cookies’ 
policy and all other supported content policies, while µBlock only to some.  
(No, I have no a slightest idea, why their author decided to release two 
programs with deeply yet not completely intersecting featuresets.)

signature.asc
Description: PGP signature