[deleted]
Avoid the Pitfalls of the JavaScript Trap on Gmail
11–20 of 30 posts
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#12From the article: "Further, we've recently seen companies such as Research In Motion (makers of the Blackberry) advising customers to entirely disable JavaScript in the WebKit browser on its devices because of a security problem that was discovered. While free software JavaScript can have security problems too, this example illustrates that we have a real need to be able to see what the code we're running on our comp…
I think the rub here is not that they want to be able to see the script files, it's that they want the javascript behind GMail and other big apps to be released under a Free Software License.
They should instead be advocating users to move on to services which use the GPL. Good luck getting all these corporations to open up their source code just like that.
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#13From the article: "Further, we've recently seen companies such as Research In Motion (makers of the Blackberry) advising customers to entirely disable JavaScript in the WebKit browser on its devices because of a security problem that was discovered. While free software JavaScript can have security problems too, this example illustrates that we have a real need to be able to see what the code we're running on our comp…
I think it can be split into the issues of license-free JavaScript (those with no license attached), obfuscated JavaScript, and the lack of tools to modify JavaScript on the client side.
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#14The benefit to Google of the current mode is the ability to rapidly change the code pushed to your browser.
If there was a open source release of the gmail client code, it would force google into maintaining an API for that code for the foreseeable future, which would require additional effort.
The closest to this request that seems remotely likely is a client side API for gmail, so that browser plugins or third party services could extend it. I see a lot of cost to Google to actually release the code, and not a ton of benefit.
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#15Isn't the javascript at Gmail machine generated with GWT? Did I miss something?
The Gmail frontend is written in javascript using the closure library.
http://code.google.com/closure/
You can look at the (compiled version) of the code by looking at the scripts tab of the chrome web inspecter. They're there :)
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#16How weird. Their position here seems to be that proprietary software running on Google's servers generating html is ok, but proprietary javascript embedded in those pages is not ok. (because it runs in your browser?)
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#17Isn't the javascript at Gmail machine generated with GWT? Did I miss something?
[deleted]
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#18Isn't the javascript at Gmail machine generated with GWT? Did I miss something?
Javascript on Gmail predates GWT. It may be possible that they've moved it to GWT but I don't think so, it loads too fast for starters.
For GWT normally you have to import the libraries, and then you get a lot of gibberish that looks like its been run through an obfuscator. Then in the body you have a section where you basically say 'insert stuff here', and that is where all your controls get inserted (by the magic javascript). Gmail doesn't have either of those that I can see.
I had a look at the source of gmail, and it looks like a normal page (lots of standard html controls (which you wouldn't expect to see in GWT) plus some weird ass timezone javascript at the end of it. Which does look kind of obfuscated, but probably was just run through a variable-name-shortener.
What I don't see, is any other script or onclick= stuff. And that is kind of suspicious. There's a blank script tag in the header, maybe they have a javascript that runs (to add all that junk dynamically) and then somehow erases itself (a neat trick?) or they have some other way of hiding the javascript?
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#19Isn't the javascript at Gmail machine generated with GWT? Did I miss something?
The Gmail frontend is written in javascript using the closure library. http://code.google.com/closure/ You can look at the (compiled version) of the code by looking at the scripts tab of the chrome web inspecter. They're there :)
Where/how are they hiding the client side javascript?
Re: Avoid the Pitfalls of the JavaScript Trap on Gmail
#20How weird. Their position here seems to be that proprietary software running on Google's servers generating html is ok, but proprietary javascript embedded in those pages is not ok. (because it runs in your browser?)
>(because it runs in your browser?)
Yea, exactly.