#1249 Several improvements to user freedom on JavaScript land
Merged by pingou. Opened by sergiodj.
sergiodj/pagure non-minified-js  into  master

Download 1249.patch

This commit basically excludes all minified JavaScript "source code"
from pagure, and replaces them by the corresponding, true source code
provided by the upstream projects. This has the obvious and enormous
benefit of actually respecting the Freedom that the user of pagure has
of studying the code that comes with the software, but it also has the
very important side effect of giving the user a chance to guarantee
that the JavaScript code ran by pagure is actually the one that came
from upstream.

The idea for this came from the Debian packaging of pagure, which has
to deal with the issues caused by the several minified JS code
bundled. Initially, I was just going to replace a few JS libraries,
but I decided to go ahead and fix everything. I have also reorganized
the structure of files a little bit, so that now we record (on the
file name) the version of the JS library we're using, but, with
symlinks, we do not depend on that version when loading the library
from the HTML pages.

Lastly, I went ahead and updated a few libraries with their latest
upstream release. Pagure was already using pretty recent code, so the
changes introduced by the updates should not be big.

Ahm, I forgot to mention that unfortunately I had no way to test this commit right now (it's late night here). I can do the testing tomorrow, but I would also gladly appreciate if someone could test it, of course :-).

I was wondering, would you consider including both min and not min versions of the file, using min in the browser and while including the non-min in the sources?

+1

this feature along with pingou's suggestion would make progress toward full librejs-compatibility where minified scripts are associated with their publicly available corresponding source counterparts via metadata

On Wednesday, August 31 2016, pagure@pagure.io wrote:

pingou commented on the pull-request: Several improvements to user freedom on JavaScript land that you are following:
``
I was wondering, would you consider including both min and not min versions of the file, using min in the browser and while including the non-min in the sources?

On Wednesday, August 31 2016, pagure@pagure.io wrote:

billauger commented on the pull-request: Several improvements to user freedom on JavaScript land that you are following:
``
+1

this feature along with pingou's suggestion would make progress toward
full
librejs-compatibility
where minified scripts are associated with their publicly available
corresponding source counterparts via metadata

To be completely honest, I am not a fan of minified JavaScript at all,
although I understand why they're popular.

Having said that, and if you guys really want the minified versions,
then I can certainly include them in the source. Also, thanks a lot to
billauger for bringing up the LibreJS compatibility! I will make sure
to mark the headers properly.

Cheers,

--
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
http://sergiodj.net/

@ryanlerch what is your take on minified JS?

there are very few reason why anyone minifies their JS

  • to save bandwidth server-side - if you serve the same files an enormous number of times per day then shaving off a few KB on your scripts can add up to a big savings - for lower-traffic hosts this is a lesser concern

  • to save bandwidth client-side - if your typical user-base is on very slow connections (and i mean like 56k dial-up) then shaving off a few KB on your scripts can speed up page-loads dramatically - this is hardly an issue for any host today

  • to obfuscate the source code - for scripts with free licenses this is not a concern

a rough estimate of a pagure page is about 1MB - nearly 500KB of that is jquery - for comparison the home page of youtube is about 5MB - so pagure is already quite lightweight in respect to other modern sites

IMHO - if reducing pagure bandwidth is a concern then the most effective way to accomplish that would be to jettison jquery

On Wednesday, August 31 2016, pagure@pagure.io wrote:

billauger commented on the pull-request: Several improvements to user freedom on JavaScript land that you are following:
``
there are very few reason why anyone minifies their JS

  • to save bandwidth server-side - if you serve the same files an
    enormous number of times per day then shaving off a few KB on your
    scripts can add up to a big savings - for lower-traffic hosts this is
    a lesser concern

Yeah, I guess pagure.io is the biggest instance so far, so I'd be
interested in knowing how much of an impact a non-minified JS would have
on it.

  • to save bandwidth client-side - if your typical user-base is on very
    slow connections (and i mean like 56k dial-up) then shaving off a few
    KB on your scripts can speed up page-loads dramatically - this is
    hardly an issue for any host today

I guess a user on a 3G connection from her cellphone wouldn't be very
happy with downloading a lot of JS... But then again, I guess pagure
already serves quite a lot of JS even if we consider the minified
versions.

a rough estimate of a pagure page is about 1MB - nearly 500KB of that
is jquery - for comparison the home page of youtube is about 5MB - so
pagure is already quite lightweight in respect to other modern sites

Cool, thanks for the interesting data.

IMHO - if reducing pagure bandwidth is a concern then the most effective way to accomplish that would be to jettison jquery

May I ask what is jettison? I am really not a JS guy, sorry.

Thanks,

--
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
http://sergiodj.net/

On Wednesday, August 31 2016, pagure@pagure.io wrote:

billauger commented on the pull-request: Several improvements to user freedom on JavaScript land that you are following:
``
jettison means eject - expunge - expel - throw away

so i suggested to not use any jquery - it is just a bloated crutch

Ohh, OK, sorry, I thought you were talking about some obscure technology
;-). It didn't occur to me that you were using the actual word :-P.

Anyway, about throwing away jquery, I was with the impression that the
web interface actually depended heavily on it. If that is not the case,
or if it can be easily replaced by another nicer solution, then I agree
that just not using it may be better.

--
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
http://sergiodj.net/

many web developers depend on it heavily - that is the problem - it is not so easily replaced once you are infected with it - but it is just a convenience and not at all necessary

most ppl use perhaps 2% of it but must include the entire thing for the minor conveniences it provides - generally speaking the best solution is to avoid using external dependencies whenever possible - to double the size of user page-loads simply to avoid writing your own code is not a good practice IMHO

Hi guys,

Any news on this one? BTW, I've just noticed that I forgot to include the open-iconic minified-CSS on the patch, so I'll do that later.

Thanks.

@sergiodj -

the developer asked you to add back in the minified scripts (presumably to give admins the option) - and then you suggested that you might additionally make them librejs-compatible - no new commits have been added to this PR since then and i would not expect the state of this discussion to change otherwise

On Saturday, September 03 2016, pagure@pagure.io wrote:

billauger commented on the pull-request: Several improvements to user freedom on JavaScript land that you are following:
``
@sergiodj -

the developer asked you to add back in the minified scripts
(presumably to give admins the option) - and then you suggested that
you might additionally make them librejs-compatible - no new commits
have been added to this PR since then and i would not expect the state
of this discussion to change otherwise

I was with the impression that the discussion of whether to include the
minified JS (or not) was still ongoing.

Anyway, I can add them (later today) and also make the JS compatible
with LibreJS.

I'll update the branch tonight.

Thanks,

--
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
http://sergiodj.net/

I was with the impression that the discussion of whether to include the minified JS (or not) was still ongoing.

It is, we're waiting on the input from @ryanlerch since he is our local UX expert and might have an opinion on this.
If he doesn't reply, I'll just assume he agrees with me :D

rebased

OK, I've force-updated the branch to include the minified JS scripts. Everything should be working as before. I've also took the time to fix some issues with other scripts/css that I had forgotten before (codemirror, open-icon, etc.). Now, everything should be properly versioned and with the corresponding full source code.

Unfortunately I do not have much time now to tackle the librejs task, so I'll leave it to later. I expect the current modifications to be a huge improvement over what we have on pagure now, and although I do want a librejs-compatible pagure in the future, I believe we can wait a little more for that.

Now that the minified JS issue is out of the way, I hope we can decide to merge this PR :-).

BTW, I still want to know @ryanlerch 's opinion on the minified JS issue! Maybe we can get rid of this evil thing once and for all :-P.

I have no real opinion on minified JS here, @pingou :) so go ahead!

Alright, so let's rebase and merge :)

rebased

Pull-Request has been merged by pingou

Metadata