The Foursquare Blog

movement: Yes, I was partly expecting this response. But I'm sure it's because my lawn is so pristine that you kids keep wanting to mess it up. :-)

Seriously though, I have no problem with Javascript as a language that people might want to use to get things done on the desktop. The problem is that, in almost all current implementations of Javascript, it is setup to run any random code from the internet that the user clicks on... or even code he doesn't click on, in some cases.

In order for me to consider using a web-enabled Gnome desktop, I need to be confident that I have the power to enforce this strict separation of church and state. My PC is the church, and the internet is the state. :-)

I need to be able to flip a setting that makes it impossible to run any javascript that comes from outside my machine, whether it be through email, the web, or various files left over in /tmp or .webgnome or /home/cdfrey/Desktop, and only run javascript that I've installed and authorized, such as through apt-get or /usr/local.

This is where my confidence in Gnome's security design falls apart, because history seems to show that it is always more tempting to enable the new shiny web than it is to lock it down securely.

company writes:

Note that I’m not talking about a web browser. I’m talking about a full featured framework that allows every application to display (partial) web pages, execute XHRs, upload photos to flickr, run user-downloaded scripts or otherwise integrate with the web. In fact, even the browser situation is worse than ever as GNOME is currently trying to switch to a different framework.

So how are we gonna marry GNOME with the web?

Maybe I'm an old foggie, yelling "get off my lawn!" here, but it is my opinion that this is the direction that caused a lot of Linux people to laugh at Microsoft.

I don't want the web everywhere on my desktop. I don't want my desktop married to the web, downloading and running scripts in the background for my convenience, or even by an accidental mouse click which is sure to happen. I don't even run javascript in my browser. Why would I want it anywhere near my web-connected desktop?

Remember back when it was impossible to get a virus via email? Then Microsoft came along, and made it default to automatically open your email in an Outlook subwindow and excute its HTML? I don't want my desktop to go in the same direction.

Perhaps you think that Gnome developers are smarter and they won't fall into the same traps that Microsoft developers did. Maybe Gnome developers are special? Perhaps. But I fear that the Linux desktop is making the same mistakes that Microsoft did, only more slowly.