When to Reject Nonfree JavaScript?

We live in a world where we have a great collection of Free Software ranging from operating systems to Web browsers, which are sadly being used to access freedom and privacy-infringing “cloud” software for almost everything that matters. As an otherwise Free Software person, I’ve felt unease running nonfree JavaScript in my browser. I browse websites with JavaScript disabled by default, but what about Web apps? I have another browser profile with JavaScript enabled that I can easily switch to, but should I open the app in the first place? When I gave it a serous thought recently, I found out that I’ve been following some criteria all along that made sense to the Free Software person in me. So what was it?

Before discussing the criteria, a quick note for those who reached here accidentally: this is about Free/Libre/Swatantra/Open Source Software: software that lets one use, study, modify, and redistribute it freely. Signal is free(dom-respecting), while WhatsApp is not (despite being free of cost). If you want to know more, please visit gnu.org. If you are already a Free Software user and worry about nonfree JavaScript, please read on.

The JavaScript Trap by Richard Stallman is a good starting point for a discussion on this topic. The write-up starts with a thought-provoking warning “You may be running nonfree programs on your computer every day without realizing it—through your web browser,” and moves on to the issues with nonfree software dynamically delivered and enabled by the Web in general. Then it discusses the criteria to find and block nontrivial JavaScript. This is the part that I came to disagree. The article defines nontrivial JavaScript based on certain technical criteria like “it declares an array more than 50 elements long,” “it does Ajax calls,” etc. The call is to reject any such JavaScript that is not licensed under a Free Software license like GNU GPL. There is a browser addon called LibreJS to automate it (which I had used for a while).

I don’t think it is fair to treat websites that serve nonfree JS like some proprietary monstrosity like Microsoft Windows. Maybe the well-intentioned webmaster simply doesn’t know what software licensing is. It is not practical (or even nice) to email hundreds of thousands of webmasters asking them to put a license on their scripts (which they didn’t write themselves probably, by the way) because it doesn’t work with LibreJS.

Next is technical. Security is already taken care of since browsers run JavaScript inside a sandbox. But sandboxes can have bugs. Regarding privacy, even a site serving Free JavaScript can infringe on that (as Stallman and FSF always warn). So that’s all about whether you trust the source or not, other than whether “it declares an array more than 50 elements long.”

But what makes Free Software great other than security and privacy is the freedom to modify and share. Now, does it actually matter for most JavaScript out there? I don’t think so. Why do I care if a website lets me modify and share JS that is so specific to their service?

So, here is my final criteria:

• Browsing and reading: always disable JavaScript; HTML and CSS are sufficient for online articles and documentation.

• General-purpose Web Apps: first, do it offline as much as possible. Offline or online, Free JavaScript is a must for Web apps.

• Specific services (like netbanking): I don’t care if the JS is free or not, for I have no other use for it. Ensuring privacy is a different issue.

• Others’ computing: running nonfree JS from a cloud service that your employer adopted to get their computing done (preferably on their machine) is also okay, but help them migrate eventually.