Re: Web versions

[Jean Louis]

* Alfred M. Szmidt <ams@gnu.org> [2021-03-15 17:48]:
>    > Or maybe they will, but that doesn't mean it is something the GNU
>    > project should promote.
> 
>    The GNU project should promote Free Software in all the ways that the
>    user can benefit from those freedoms, regardless of what technology
>    underlies those freedoms.  If WebAssembly or Javascript can be used in a
>    way that honors the four freedoms, the FSF's position should be to
>    encourage *those* ways, and discourage *other* ways.  Discouraging the
>    technology itself is, IMHO, outside the FSF's scope.
> 
> The FSF and the GNU project have often recommended against using
> various technologies becuase they reduce the freedom of users, it is
> perfectly within the scope of what their mission is.  One such scope
> is limiting Javascript use/Webassembly, and recommending users to not
> depend on that specific technology.  Again, the Javascript trap is a
> good place to start ...

You know that I like GNU and free software philosophy.

I just cannot see clearly how is Javascript trap relevant to
WebAssembly as the Javascript trap is about proprietary software.

I can see some more specific problems generally described here:
https://en.wikipedia.org/wiki/WebAssembly#Security_considerations

The major problem is that software is pretty easily delivered to user
who is led to believe it will be safe, user will run software and will
not know if it is safe or not.

Webassembly already exists. People will start making free software for
it anyway. It is good platform for delivery of software.

That it can be abused or used, it is clear. But so any other
software. Nothing prevents people to place malicious or abusive or
backdoor-ed software into free software and offer to people to
download it. Place a link for software package, say that user will get
something for free, just has to run the software, and there you
are. This same principle has been used since there is Internet and
DOS.

>From security perspective we as aware users shall strive to protect
our data, so majority of aware people do not run insecure Javascript,
so they will not run WebAssembly as well. Myself I do not install
containers, etc. I do review the background of people who are
prepareing the OS and I can prepare the OS myself for myself. So I do
not run proprietary stuff, and thus avoid much of insecurity, but that
is far from perfect as any software, thus also free software, is
pretty insecure technically. Targeted attack would be easy to conduct
on large groups of people and is being conducted 24 hours.

>From freedom perspective, if somebody wish to run WebAssembly, if I am
proponent of the GPL, then why should I ever say "no" to run free
software anyhow?

We essentially argue here about the freedom 0.

"The freedom to run the program as you wish, for any purpose (freedom 0)."
https://www.gnu.org/philosophy/free-sw.html

GNU project in general need not prepare GNU tools for WebAssembly, it
may decide how to do it, so that is also freedom zero for GNU. That is
maybe general direction, I would myself not put efforts into
Webassembly.

As specific direction, single developers or groups of developers of
GNU software specifically, could decide to compile software to be run
under WebAssembly. So everybody has freedom zero, to run the program
as you wish, for any purpose.

So we shall uphold freedom zero and not deny it or object to it.

Jean