The WWWorst App Store
Alexandre Oliva
Published on the GNU Project's web site to share virtually at LibrePlanet 2021.
Picture the most abusive app store.
Programs in it are meant to run on your own computer.
However, you have to be online to run them.
Every time you start them, they contact the app store.
If there is an updated version, it's installed automatically, no questions asked. You'd rather run the earlier version? Tough.
If the app store decides you're no longer welcome, the program won't start any more.
If the app store servers are offline, or if you are, it won't start either.
Programs in this app store must also hold your data in the app store's servers.
If the program won't start, you can't get to the data on the servers any more.
You may have downloaded backups of your data, but you'd have to figure out how to decode them without the program.
Sounds like a nightmare? It is. But it's also very real.
Well-known app stores are approaching this level of nastiness.
But they are just catching up with the real thing.
The most abusive app store is the business-driven perversion of the old user-empowering distributed hypertext system called "the Web".
Users have been encouraged to adopt "web apps" for much of their computing, paving the way for other app stores to follow suit.
"Web apps" are most often distributed as JavaScript (though Java and Flash have served similar purposes), automatically installed and executed on your browser.
But the problem is not that they're in JavaScript, or that it's your browser that runs them. It's that:
- you don't have control over what the program does;
- you don't have control over when you can run it;
- you don't have control over your own data.
The app store owner takes all that control away from you, thereby gaining control over you.
You lose when the JavaScript code is nonfree software.
https://www.gnu.org/philosophy/javascript-trap.html
But you also lose when it is (nominally) free software!
When the app / web site has so much control over what runs on
your computer, the effect "is equivalent to using a nonfree program
with surveillance features and a universal back door."
https://www.gnu.org/philosophy/network-services-arent-free-or-nonfree.html
https://www.gnu.org/philosophy/who-does-that-server-really-serve.html
The owner gets all the freedom, and you, the user, get none.
That's not a self-respectful way to do your computing.
It invades your privacy, it keeps you and your data hostage, it takes away your agency and your freedom when it comes to your digital life.
The web used to be a wonderful way to share information.
Web apps and mandatory JavaScript have turned it into the worst app store.
It is time to separate the WWWonderful from the WWWorst practices.
Here are some ways to help:
- request web sites that require JavaScript execution to offer either:
- alternate means of access to information they publish, or
- alternate means of delivery for their apps;
- promote free browser extensions that control JavaScript execution;
https://www.gnu.org/software/librejs/ - beware of apps that are mere front ends for SaaSS;
https://www.gnu.org/philosophy/who-does-that-server-really-serve.html - demand software you use to be delivered in freedom-respecting ways;
- promote hypertext systems that do not grant servers control over users.
https://en.wikipedia.org/wiki/Gemini_(protocol)
https://en.wikipedia.org/wiki/Gopher_(protocol)
More generally:
- as a self-respecting user, reject the abusive practices whenever you can;
https://gnu.org/philosophy/saying-no-even-once.html - discourage automatic execution of downloaded code;
https://www.fsfla.org/blogs/lxo/pub/who-is-afraid-of-spectre-and-meltdown.en.html - as a network service operator, set a user-respecting example;
https://www.gnu.org/philosophy/network-services-arent-free-or-nonfree.html - spread awareness of the problem, and advice on solving and avoiding it.
https://www.gnu.org/help/help-javascript.html
Now, if you wish your site to give its users a taste of how the WWWorst app store feels to us, add to web pages you control the following JavaScriptlet:
document.body.textContent = 'Please disable JavaScript to view this site.'
If you wish, make "disable JavaScript" a link to this article.
Thanks to Richard Stallman for the inspiration to write about this issue, and for the encouragement to publish it.
2021-04-01 update: thanks to KE0VVT for letting me know that textContent can't have links, you need innerHTML for that.
Copyright 2021 Alexandre Oliva
Permission is granted to make and distribute verbatim copies of this entire document worldwide without royalty, provided the copyright notice, the document's official URL, and this permission notice are preserved.