[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security concerns with minified javascript code



 ❦ 25 août 2015 22:37 GMT, Bas Wijnen <wijnen@debian.org> :

>> We need to leave the Javascript ecosystem mature a bit more but in the
>> meantime, a bit of tolerance would be appreciated
>
> The minifier is a compiler.  If it's not in main, files that are compiled with
> it cannot be in main.  For javascript, the easy solution is to not use the
> compiler.  Non-minified code works fine.

Non-minified code is decomposed in several dozen files. Using them is as
painful as trying to concat them and minifying them properly. There are
a lot of solutions. All of them will make the package a bit more buggy
than the previous ones. At the end, we will just get angry users and angry
upstream.

For years, we have been able to ship generated files without checking if
they can really be built from sources (for example, autoconf stuff). And
JS stuff should comply to stricter standards from day one? 

The main effect of this religious and overzealous application of our
guidelines is that people just stay away of JS stuff in Debian and
packaging any web-related app is becoming more complex as anyone needs
to deal with JS stuff in its own package.
-- 
Make sure your code "does nothing" gracefully.
            - The Elements of Programming Style (Kernighan & Plauger)

Attachment: signature.asc
Description: PGP signature


Reply to: