[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security concerns with minified javascript code



 ❦ 26 août 2015 09:27 -0700, Russ Allbery <rra@debian.org> :

>>> In the Debian context, the problem is hard. But if you allow network
>>> access and execution of arbitrary code recovered from some random
>>> registry, rebuilding the minified version from the unminified one is
>>> quite trivial.
>
>>> I know how it sounds.
>
>> Well, we don't normally consider a program free if the only way users
>> can modify it is something like that.
>
> Yeah.  The problem is that nearly the entire rest of the free sofware
> world *does* consider programs like that free.  (See the Ruby, Java, and
> Go communities, among many others, that have standard build and deploy
> tools that work that way.)
[...]

Thanks Russ! I agree with your summary of the situation.
-- 
Few things are harder to put up with than the annoyance of a good example.
		-- "Mark Twain, Pudd'nhead Wilson's Calendar"

Attachment: signature.asc
Description: PGP signature


Reply to: