Group:JavaScript Developers Task-Force/Reddit JavaScript Analysis

NOTE: The formatting looks wrong on this page because it is written in markdown to comply with the FSF's internal publication workflow. Please keep it like this. It makes sense if you view the source of the page in the editing interface.

1. Changes that need to be made for reddit's essential functions to work with LibreJS enabled

The majority of the scripts necessary for Reddit to function properly for the average user are, fortunately, free software. However, not all files are labelled as such. Additional efforts are also needed to ensure that LibreJS recognizes the distributed files as free.

Below, "source file" refers to the unminified source code in the Reddit repository.

1. 1. Comments Page, et. al.
      1. reddit-init.en.js

• The outer try/catch is added by r2/r2/lib/js.py:425

  * Its license is irrelevant because the JavaScript is trivial

• lib/json2.js

  * It is in the public domain

• lib/underscore-1.4.4.js

  * Expat

• lib/store.js

  * Expat

• lib/jed.js

  * Some modifications made by reddit, as noted within the file
  * WTFPL
  * *Zak verified that the license is indeed free.*

• base.js

  * The source file contains no license
  * **FIX:** Add license to source file

• preload.js

  * The source file contains no license
  * **FIX:** Add license to source file

• logging.js

  * The source file contains no license
  * **FIX:** Add license to source file

• uibase.js

  * The source file contains no license
  * **FIX:** Add license to source file

• i18n.js

  * The source file contains no license
  * **FIX:** Add license to source file

• utils.js

  * The source file contains no license
  * **FIX:** Add license to source file

• analytics.js

  * The source file contains no license
  * **FIX:** Add license to source file

• jquery.reddit.js

  * The source file contains no license
  * **FIX:** Add license to source file

• reddit.js

  * The source file contains no license
  * **FIX:** Add license to source file

• spotlight.js

  * The source file contains no license
  * **FIX:** Add license to source file

• adzerk

  * This code is not included in the repository; it is also proprietary
  * **FIX:** This should be loaded in a separate JavaScript file, or delimited
    in such a way that LibreJS will be able to disable it effectively.
  * Tools like NoScript can be used to prevent scripts from loading on the
    adzerk domain, but NoScript cannot prevent the proprietary JS contained
    within the minified file itself from loading (unless the entire minified
    file is disallowed).
  * Loads from:
     * az.turbobytes.net if https
     * otherwise static.adzerk.net
  * Creates an iframe that loads additional content:
        * In the case of non-https: http://static.adzerk.net/reddit/ads-load.html?bust2
           * Includes jQuery
           * Includes http://secure.adzerk.net/ados.js?q=43
              * No license; presumably proprietary.
     * http://static.adzerk.net/reddit/ads.html?sr=linux&bust2#http://www.reddit.com
  * Sets up messaging hooks for cross-origin communication
     * See https://developer.mozilla.org/en-US/docs/Web/API/Window.postMessage if unfamiliar
  * All the above also ends up in these being loaded:
     * http://engine.adzerk.net/ados?t=1389329534461&request={%22Placements%22:[{%22A%22:5146,%22S%22:24950,%22D%22:%22main%22,%22AT%22:5},{%22A%22:5146,%22S%22:24950,%22D%22:%22sponsorship%22,%22AT%22:8}],%22Keywords%22:%22linux%22,%22Referrer%22:%22http%3A%2F%2Fwww.reddit.com%2Fr%2Flinux%2Fcomments%2F1ubbz4%2Ffsf_ask_reddit_to_upvote_user_freedom_by_serving%2F%22,%22IsAsync%22:true,%22WriteResults%22:true}
     * http://static.adzrk.net/Extensions/adFeedback.js

1. 1. 1. reddit.en.js

Similar to above; ordered concatenation and subsequent minification:

• templates.js

  * The source file contains no license
  * **FIX:** Add license to source file

• ui.js

  * The source file contains no license
  * **FIX:** Add license to source file

• login.js

  * The source file contains no license
  * **FIX:** Add license to source file

• flair.js

  * The source file contains no license
  * **FIX:** Add license to source file

• interestbar.js

  * The source file contains no license
  * **FIX:** Add license to source file

• visited.js

  * The source file contains no license
  * **FIX:** Add license to source file

• wiki.js

  * The source file contains no license
  * **FIX:** Add license to source file

• apps.js

  * The source file contains no license
  * **FIX:** Add license to source file

• gold.js

  * The source file contains no license
  * **FIX:** Add license to source file

• multi.js

   * The source file contains no license
  * **FIX:** Add license to source file

• recommender.js

  * The source file contains no license
  * **FIX:** Add license to source file

• JSON generated from r2/r2/lib/permissions.py

  * License irrelevant; it is data. The Python file is under the Common Public Attribution License

• Unknown r.config.cursed; not in the repository!

  * The JavaScript is small and it looks like it's just intended to be a fun toy
     * It randomly positions elements that you mouse over, it looks like
     * But regardless, it's non-free JS
  * **FIX:** Add to the repository with license information

• Ends with a trivial line that does not appear to be in the repository

  * Simply adds an i18n message; code is 104 chars and would look no different if not minified
  * **FIX:** Add to the repository with license information

1. Changes that would be good to make, but which are not necessary for the site's essential functions to work with LibreJS on

This is not comprehensive, but would be an excellent start.

1. 1. Privacy Policy

• policies.js

  * Used on http://www.reddit.com/help/useragreement
  * The source file contains no license
  * **FIX:** Add license to source file

1. 1. Preferences

• jquery.js

  * Used on https://ssl.reddit.com/prefs/
  * Already includes this header (just need to make LibreJS-compatible): /*! jQuery v1.7.2 jquery.com | jquery.org/license */
  * **FIX:** Make aforementioned header LibreJS-compatible

1. 1. ajax.googleapis.com/**/*.js

• We obviously cannot add license headers to these files

  * **FIX:** Use a separate page to describe licenses (Web Labels)

1. 1. Blog

The blog is a particular concern---it uses a great deal of JavaScript, but seems to work fine without JavaScript enabled.

1. 1. 1. s.ytimg.com/yts/jsbin/*.js

• www-embed-player.js

  * Proprietary YouTube JavaScript
  * Used for embedded video player
  * **FIX:** Perhaps they could use an HTML5 player with free codecs instead,
    since YouTube serves up HTML5-compatible content for many videos

1. 1. 1. www.youtube.com/embed/*

• Used on blog.reddit.com

 * **FIX:** They can provide us with the source code, or commit it to the repository

• Various embed stuff for iframes; includes above JS
• Contains non-free JavaScript used as configuration for above YouTube include

  * That said, it's primarily data; it may be trivial

• Loads http://www.google.com/js/bg/J3oN4k55bATX3riG5_bT7XUBXDr4fHU0iSqBW5OwyBU.js

  * Some Google anti-spam thing
  * Proprietary JS
  * **FIX:** Same as above---use HTML5 video player with free codecs, if possible

1. 1. 1. https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Fwww.blogger.com#rpctoken=378573301&forcesecure=1

• Loads ssl.gstatic.com/accounts/o/1618667077-postmessagerelay.js

  * Proprietary JS
  * **FIX:** Remove.

1. 1. 1. http://www.google-analytics.com/ga.js

• Proprietary JS
• **FIX:** Remove.

1. 1. 1. www.blogger.com/static/v1

• jsbin/3672639782-lbx.js

  * 582kB of proprietary JS

• widgets/3561504294-widgets.js

  * 85kB more proprietary JS

• Loads over half a dozen more smaller scripts from apis.google.com on top of that
• **FIX:** Remove.

1. 1. 1. https://apis.google.com/js/plusone.js

• The notorious Google+ +1 button!

  * Can track users

• **FIX:** Remove; they can always share the link on their own

1. 1. 1. reddit.com

• static/button.js

  * Combined, minified file
  * lib/jquery.cookie.js
     * Dual Expat/GPL
  * jquery.reddit.js
     * The source file contains no license
     * **FIX:** Add license to source file
  * blogbutton.js
     * The source file contains no license
     * **FIX:** Add license to source file

1. 1. About
      1. redditstatic.com

• about.js; concatenated, minified:

  * Custom modernizer configuration
     * See http://modernizr.com/download/
     * Expat license (http://modernizr.com/license)
     * Does not exist in repository!
     * **FIX:** Add to repository with license information

• (minified blob)

  * Not in the repository!
  * Might be part of Modernizr; looks to modify the Date object for consistency
  * No license and might be proprietary
  * **FIX:** Add to repository with license information

• (minified blobs)

  * Not in the repository!
  * Some trivial hooks and stuff, on top of what's listed below (which is non-trivial and extensive)
  * The following Backbone views/models:
     * SlideShowView
        * AboutSlideshowView
     * TimelineEvent
     * TimelineEventView
     * TimelineView
        * AboutTimelineView
     * GridView
        * PeopleGridView
     * AboutSlideshowView
     * TeamRouter
     * DropdownView
     * TeamMember
     * SortableCollection
     * PersonDetailsPopup
     * PersonView
     * Postcard
     * PostcardCollection
     * PostcardRouter
     * PostcardOverlayView
        * PostcardInfoView
        * PostcardRedditView
        * PostcardCloseView
     * PostcardZoomView
     * PostcardView
     * PostcardGridView
  * No license and is therefore proprietary
  * **FIX:** Add to repository with license information