[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security concerns with minified javascript code



 ❦ 29 août 2015 19:12 -0700, Steve Langasek <vorlon@debian.org> :

> Yet you try to compare this with autoconf.  Even if we tolerated configure
> scripts today in the archive that we can't rebuild using the software in
> Debian (which by and large we do *not* tolerate - because we've learned our
> lesson), there's a big difference in impact between a build script used once
> at package build time and never shipped in the package to our users, vs.
> swaths of user-facing UI code.

The build script determines the outcome of what will effectively run on
our users' machine. I fail to see how this is not an important
issue. But until the effort to get ppc64el, not regenerating the
configure script was just a fine option and not considered as DFSG
violation (all bugs were filed with normal severity). And this existed
for as long as Debian existed!

>> all the code is free software and is provided with the appropriate
>> source. A tiny part of it is difficult to rebuild from scratch.
>
> I don't know if this is true or not; the only package you've used as an
> example in this thread is jquery 3.0.0-pre, which is a) not a package you're
> the maintainer of, and b) not a version of the package that's present in
> Debian.

It seems that I have some difficulties to express myself correctly. I am
sorry for that and let me explain my point more concisely.

Software using jQuery (or another piece of Javascript) usually ship with
a post-processed version of jQuery. For example (I take this example as
Iceweasel doesn't build this component, I don't want to trigger some
witch hunt):
 https://sources.debian.net/src/iceweasel/38.1.0esr-3/browser/components/loop/content/shared/libs/jquery-2.1.0.js/

Is that the preferred form of modification? It depends, but from the
jQuery author point of view, it isn't:
 https://github.com/jquery/jquery/tree/2.1-stable/src

However, this is a readable source code that will accomodate any
modification that a end user will deem necessary. This is far more
readable than the output of autoconf (again). For me, there is no strong
problem with DFSG #2 by just using this file as the source code.
-- 
Make input easy to proofread.
            - The Elements of Programming Style (Kernighan & Plauger)

Attachment: signature.asc
Description: PGP signature


Reply to: