[Bug-librejs] LibreJS Proposal Draft

[Ethan Dorta]

Requested from the #librejs IRC on Freenode

LibreJS depends on comments, WebLabels, and whitelisted files
accompanied by hashes. The WebLabels problem is addressed below, 
and whitelisted files work the way they are.
However, comments are often removed in production due to minification. The
popularity of the WebPack build cycle has made this very popular as
well, due to the large size of the output files. While not all comments
are removed (certain comments marked in a certain way will stay),
comments within dependencies (that could be proprietary) are. This
method will probably have to be phased out for something else.

The main problem with formats such as WebLabels is that a
developer/development team must go out of their way to support it, and
doing it simply to support one addon is not very appealing. My idea is a
simple WebPack plugin (just copy and paste one line of code into a
config file) that generates everything for you. This only works for
webpack build cycles, but thankfully they are popular as of now. Plugins
for other build cycles like Grunt and Browserify can come later.

https://bugzilla.mozilla.org/show_bug.cgi?id=1255894 is currently a
blocking bug in getting LibreJS to work. There is a way to get around
this by making duplicate requests, but this can cause problems in the
situation of single-use links and authentication. No releases should be
made until this is addressed, unless it is agreed upon that comment
inspection will no longer be used.

Also, WebExtensions is becoming a web standard, so we will have to think
about supporting browsers other than Mozilla-based ones. Chrome,
Chromium, possibly Edge (I don't know why, but someone will try it), and maybe
Opera. 

Background scripts will handle remote scripts being loaded into the
page via script tags, and content scripts can handle embedded scripts,
and scripts trying to load other scripts via fetching/XMLHttpRequest.
(Demo of this at https://github.com/Flarp/Salsa-Addon)

That's all I have for now. Anything I missed?