Add LibreJS in browser extentions section

Website

Short description

LibreJS is a free add-on for GNU IceCat and other Mozilla-based browsers. It blocks nonfree nontrivial JavaScript while allowing JavaScript that is free and/or trivial.

Why I think this tool should be added

Many websites run nontrivial JavaScript on your computer. Some use it for complex tasks; many use it gratuitously for minor jobs that could be done easily with plain HTML. Sometimes this JavaScript code is malicious. Either way, the JavaScript code is often nonfree. For explanation of the issue, see “The JavaScript Trap”(The JavaScript Trap - GNU Project - Free Software Foundation).

I think allowing every script to run in the browser unless it is in a blocklist is very insecure. This puts the security practitioner in an endless arms-race with the security crackers. I think allow by default should be replaced with deny by default.

Section on Privacy Guides

Browser Extentions

Also read “Default Permit” in The Six Dumbest Ideas in Computer Security

1 Like

I’m a big free software advocate, but unfortunately I don’t think LibreJS fits as a Privacy Guides recommendation. I’m definitely in the camp that software will always be more trustworthy if it’s FOSS, but the GNU Project/FSF does overstate the misconception that free software is always inherently (more) secure or that proprietary software is always inherently totally unsafe for anyone to use in any scenario. Another downside is that it’s exclusively for Firefox, which itself may be considered for removal from Privacy Guides.

I’d say NoScript would be a better option for what you’re suggesting as it can block all scripts and is available for both Firefox and Chromium, however all current recommendations allow the user to block scripts with uBlock Origin, NoScript, or Brave Shields depending on the browser they chose.

2 Likes

GNU Project/FSF does overstate the misconception that free software is always inherently (more) secure or that proprietary software is always inherently totally unsafe for anyone to use in any scenario.

Please stop with your strawman, No one from FSF said this misconception. Ironically, The opposite is true, see JSON and Hippocratic license. You are stating the obvious and wasting time.

Obviously, Everyone will be wary of something that has shown to be dangerous for a long time. Its called Inductive reasoning.

exclusively for Firefox

It didn’t state that on their criteria.

I’d say NoScript would be a better option for what you’re suggesting as it can block all scripts

I tried it, I don’t think you can inspect the script properly in the extention. It only allows you to accept it with blind trust. I suggest reading about LibreJS.

however all current recommendations allow the user to block scripts with uBlock Origin, NoScript, or Brave Shields depending on the browser they chose.

uBlock Origin and Brave Shields allows scripts by default and blocks if it is in a blocklist which I mentioned feels insecure.

Your own source proves me right:

In addition to being nonfree, many of these programs are malware because they snoop on the user.

My framing of their position on security might’ve been a bit oversimplified, but the point is that they’re making exaggerations and generalizations about the security of software purely based on the license of the software, and then recommending users entirely avoid non-free software for that reason.

They perpetuate this same misconception in other ways as well, such as their endorsed GNU/Linux distributions which exclusively promote insecure Linux-libre distributions. Again, they do this while calling most proprietary software malware and suggesting people avoid it for security reasons. There are many more examples I could give but I think I proved my point well enough.

I’m critiquing your underlying reasoning behind recommending this extension, which is that non-free JS should be blocked and that free JS should be allowed for privacy or security reasons. If it’s obvious to you that this is a flawed approach, it makes no sense to create this suggestion based on reasoning you yourself disagree with. Perhaps one of us is misunderstanding the other?

Not everything which meets the minimum criteria gets recommended, that’s why we have discussions about whether something is necessary and whether it has pros and cons. But yes, incompatibility with Chromium isn’t a deal-breaker. I’m just comparing it to what is already recommended and what alternatives could be better if for some reason something like this were to be added as a recommendation.

All recommended browsers do not block scripts by default, doing so would require manual intervention from the user one way or another. Either by changing a setting or installing an extension which does so by default. The reason this is worth mentioning is because we should avoid recommending extensions if they’re not strictly necessary, as explained in the extensions page you linked to:

In general, we recommend keeping your browser extensions to a minimum to decrease your attack surface. They have privileged access within your browser, require you to trust the developer, can make you stand out, and weaken site isolation.

However, some provide functionality which can outweigh these downsides in certain situations, particularly when it comes to content blocking.

Don’t install extensions which you don’t immediately have a need for, or ones that duplicate the functionality of your browser. For example, Brave users don’t need to install uBlock Origin, because Brave Shields already provides the same functionality.

If we can agree that blocking or allowing JavaScript based on its license is out of scope for Privacy Guides (as it is at least a somewhat flawed approach to security), then the main consideration is whether we should recommend blocking JavaScript by default or not, which can be done with the already recommended browsers/extensions.

Blocking JavaScript is already sort of recommended, for example it’s listed as optional in the Brave Shields section. We could have a discussion about whether that recommendation should be displayed more prominently for other browsers, but because of how much it’d inconvenience users I don’t see it ever becoming fully recommended. At most we could make more mentions of it as being an option to be aware of.

1 Like

Your own source proves me right:

No, Mx. Smirk Face, You didn’t read my sources. I am telling you to read stuff and you didn’t see anything at all. I am wasting my time here, never recommending privacyguides again.

1 Like