From 4f49b16079b27d7ce633619e4cddfdf2bffbc952 Mon Sep 17 00:00:00 2001 From: cashmere Date: Fri, 4 Sep 2026 09:05:24 +0200 Subject: initial commit --- www/javascript.md | 642 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 642 insertions(+) create mode 100644 www/javascript.md (limited to 'www/javascript.md') diff --git a/www/javascript.md b/www/javascript.md new file mode 100644 index 0000000..512837d --- /dev/null +++ b/www/javascript.md @@ -0,0 +1,642 @@ +# Use of JavaScript in Fossil + +## Philosophy & Policy + +The Fossil development project’s policy is to use JavaScript where it +helps make its web UI better, but to offer graceful fallbacks wherever +practical. The intent is that the UI be usable with JavaScript +entirely disabled. In almost all places where Fossil uses JavaScript, +it is an enhancement to provided functionality, and there is always +another way to accomplish a given end without using JavaScript. + +This is not to say that Fossil’s fall-backs for such cases are always as +elegant and functional as a no-JS purist might wish. That is simply +because [the vast majority of web users leave JavaScript unconditionally +enabled](#stats), and of the small minority of those that do not, a +large chunk use some kind of [conditional blocking](#block) instead, +rather than disable JavaScript entirely. +Fossil’s active developers do not deviate from that +norm enough that we have many no-JS purists among us, so the no-JS case +doesn’t get as much attention as some might want. We do [accept code +contributions][cg], and we are philosophically in favor of graceful +fall-backs, so you are welcome to appoint yourself the position of no-JS +czar for the Fossil project! + +Evil is in actions, not in objects: we do not believe JavaScript *can* +be evil. It is an active technology, but the actions that matter here +are those of writing the code and checking it into the Fossil project +repository. None of the JavaScript code in Fossil is evil, a fact we +enforce by being careful about who we give check-in rights on the +repository to and by policing what code does get contributed. The Fossil +project does not accept non-trivial outside contributions. + +We think it’s better to ask not whether Fossil requires JavaScript but +whether Fossil uses JavaScript *well*, so that [you can decide](#block) +to block or allow Fossil’s use of JavaScript. + +The Fossil developers want to see the project thrive, and we achieve +that best by making it usable and friendly to a wider audience than the +minority of static web app purists. Modern users generally expect a +smoother experience than was available with 1990s style HTTP +POST-and-response `
` based interaction. We also increase the set +of potential Fossil developers if we do not restrict them to such +antiquated methods. + +JavaScript is not perfect, but it's what we have, so we will use it +where we find it advantageous. + +[cg]: ./contribute.wiki + + +## Arguments Against JavaScript & Our Rebuttals + +There are many common arguments against the use of JavaScript. Rather than +rehash these same arguments on the [forum][ffor], we distill the common +ones we’ve heard before and give our stock answers to them here: + +1. “**It increases the size of the page download.**” + + The heaviest such pages served by Fossil only have about 15 kB of + compressed JavaScript. (You have to go out of your way to get Fossil + to serve uncompressed pages.) This is negligible, even over very + slow data connections. If you are still somehow on a 56 kbit/sec + analog telephone modem, this extra script code would download in + a few seconds. + + Most JavaScript-based Fossil pages use less code than that. + + Atop that, Fossil sends HTTP headers to the browser that allow it + to perform aggressive caching so that typical page loads will skip + re-loading this content on subsequent loads. These features are + currently optional: you must either set the + [`fossil server --jsmode bundle` option][fsrv] or the corresponding + `jsmode` control line + in your [`fossil cgi`][fcgi] script when setting up your + [Fossil server][fshome]. That done, Fossil’s JavaScript files will + load almost instantly from the browser’s cache after the initial + page load, rather than be re-transferred over the network. + + Between the improved caching and the fact that it’s quicker to + transfer a partial Ajax page load than reload the entire page, the + aggregate cost of such pages is typically *lower* than the older + methods based on HTTP POST with a full server round-trip. You can + expect to recover the cost of the initial page load in 1-2 + round-trips. If we were to double the amount of JavaScript code in + Fossil, the payoff time would increase to 2-4 round-trips. + +2. “**JavaScript is slow.**” + + It *was*, before September 2008. Google's introduction of [their V8 + JavaScript engine][v8] taught the world that JavaScript need not be + slow. This competitive pressure caused the other common JavaScript + interpreters to either improve or be replaced by one of the engines + that did improve to approach V8’s speed. + + Nowadays JavaScript is, as a rule, astoundingly fast. As the world + continues to move more and more to web-based applications and + services, JavaScript engine developers have ample motivation to keep + their engines fast and competitive. + + Ajax partial page updates are faster than + the no-JS alternative, a full HTTP POST round-trip to submit new + data to the remote server, retrieve an entire new HTML document, + and re-render the whole thing client-side. + +3. “**Third-party JavaScript cannot be trusted.**” + + Fossil does not use any third-party JavaScript libraries, not even + very common ones like jQuery. Every bit of JavaScript served by the + stock version of Fossil was written specifically for the Fossil + project and is stored [in its code repository][fsrc]. + + Therefore, if you want to hack on the JavaScript code served by + Fossil and mechanisms like [skin editing][cskin] don’t suffice for your + purposes, you can hack on the JavaScript in your local instance + directly, just as you can hack on its C, SQL, and Tcl code. Fossil + is free and open source software, under [a single license][2cbsd]. + +4. “**JavaScript and cookies are used to snoop on web users.**” + + There is no tracking or other snooping technology in Fossil other than + that necessary for basic security, such as IP address logging on + check-ins. (This is in part why we have no [comprehensive user + statistics](#stats)!) + + Fossil attempts to set two cookies on all web clients: a login session + cookie and a display preferences cookie. These cookies are restricted to + the Fossil instance, so even this limited data cannot leak between + Fossil instances or into other web sites. + +5. “**JavaScript is fundamentally insecure.**” + + JavaScript is certainly sometimes used for nefarious ends, but if we + wish to have more features in Fossil, the alternative is to add more + code to the Fossil binary, [most likely in C][fslpl], a language + implicated in [over 4× more security vulnerabilities][whmsl]. + + Therefore, does it not make sense to place approximately four times + as much trust in Fossil’s JavaScript code as in its C code? + + The question is not whether JavaScript is itself evil, it is whether + its *authors* are evil. *Every byte* of JavaScript code used within + the Fossil UI is: + + * ...written by the Fossil developers, vetted by their peers. + + * ...[open source][flic] and [available][fsrc] to be inspected, + audited, and changed by its users. + + * ...compiled directly into the `fossil` binary in a + non-obfuscated form during the build process, so there are no + third-party servers delivering mysterious, obfuscated JavaScript + code blobs to the user. + + Local administrators can [modify the repository’s skin][cskin] to + inject additional JavaScript code into pages served by their Fossil + server. A typical case is to add a syntax highlighter like + [Prism.js][pjs] or [highlightjs][hljs] to the local repository. At + that point, your trust concern is not with Fossil’s use of + JavaScript, but with your trust in that repository’s administrator. + + Fossil's [default content security policy][dcsp] (CSP) + prohibits execution of JavaScript code which is delivered from + anywhere but the Fossil server which delivers the page. A local + administrator can change this CSP, but again this comes down to a + matter of trust with the administrator, not with Fossil itself. + +6. “**Cross-browser compatibility is poor.**” + + It most certainly was in the first decade or so of JavaScript’s + lifetime, resulting in the creation of powerful libraries like + jQuery to patch over the incompatibilities. Over time, the need for + such libraries has dropped as browser vendors have fixed the + incompatibilities. Cross-browser JavaScript compatibility issues + which affect web developers are, by and large, a thing of the past. + +7. “**Fossil UI works fine today without JavaScript. Why break it?**” + + While this is true today, and we have no philosophical objection to + it remaining true, we do not intend to limit ourselves to only those + features that can be created without JavaScript. The mere + availability of alternatives is not a good justification for holding + back on notable improvements when they're within easy reach. + + The no-JS case is a [minority position](#stats), so those that want + Fossil to have no-JS alternatives and graceful fallbacks will need + to get involved with the development if they want this state of + affairs to continue. + +8. “**A large number of users run without JavaScript enabled.**” + + That’s not what web audience measurements say: + + * [What percentage of browsers with javascript disabled?][s1] + * [How many people are missing out on JavaScript enhancement?][s2] + * [Just how many web users really disable cookies or JavaScript?][s3] + + Our sense of this data is that only about 0.2% of web users had + JavaScript disabled while participating in these studies. + + The Fossil user community is not typical of the wider web, but if we + were able to comprehensively survey our users, we’d expect to find + an interesting dichotomy. Because Fossil is targeted at software + developers, who in turn are more likely to be power-users, we’d + expect to find Fossil users to be more in favor of some amount of + JavaScript blocking than the average web user. Yet, we’d also expect + to find that our user base has a disproportionately high number who + run [powerful conditional blocking plugins](#block) in their + browsers, rather than block JavaScript entirely. We suspect that + between these two forces, the number of no-JS purists among Fossil’s + user base is still a tiny minority. + +9. “**I block JavaScript entirely in my browser. That breaks Fossil.**” + + First, see our philosophy statements above. Briefly, we intend that + there always be some other way to get any given result without using + JavaScript, developer interest willing. + + But second, it doesn’t have to be all-or-nothing. We recommend that + those interested in blocking problematic uses of JavaScript use + tools like [NoScript][ns] or [uBlock Origin][ubo] to *selectively* + block JavaScript so the rest of the web can use the technology + productively, as it was intended. + + There are doubtless other useful tools of this sort. We recommend + these two only from our limited experience, not out of any wish to + exclude other tools. + + The primary difference between these two for our purposes is that + NoScript lets you select scripts to run on a page on a case-by-case + basis, whereas uBlock Origin delegates those choices to a group of + motivated volunteers who maintain allow/block lists to control all + of this; you can then override UBO’s stock rules as needed. + +10. “**My browser doesn’t even *have* a JavaScript interpreter.**” + + The Fossil open source project has no full-time developers, and only + a few of these part-timers are responsible for the bulk of the code + in Fossil. If you want Fossil to support such niche use cases, then + you will have to [get involved with its development][cg]: it’s + *your* uncommon itch. + +11. “**Fossil’s JavaScript code isn’t compatible with my browser.**” + + The Fossil project’s developers aim to remain compatible with + the largest portions of the client-side browser base. We use only + standards-defined JavaScript features which are known to work in the + overwhelmingly vast majority of browsers going back approximately 5 + years, at minimum, as documented by [Can I Use...?][ciu] We avoid use of + features added to the language more recently or those which are still in + flux in standards committees. + + We set this threshold based on the amount of time it typically takes for + new standards to propagate through the installed base. + + As of this writing, this means we are only using features defined in + [ECMAScript 2015][es2015], colloquially called “JavaScript 6.” That + is a sufficiently rich standard that it more than suffices for our + purposes, and it is [widely deployed][es6dep]. The biggest single + outlier remaining is MSIE 11, and [even Microsoft is moving their + own products off of it][ie11x]. + +[2cbsd]: https://fossil-scm.org/home/doc/trunk/COPYRIGHT-BSD2.txt +[ciu]: https://caniuse.com/ +[cskin]: ./customskin.md +[dcsp]: ./defcsp.md +[es2015]: https://ecma-international.org/ecma-262/6.0/ +[es6dep]: https://caniuse.com/#feat=es6 +[fcgi]: /help/cgi +[ffor]: https://fossil-scm.org/forum/ +[flic]: /doc/trunk/COPYRIGHT-BSD2.txt +[fshome]: /doc/trunk/www/server/ +[fslpl]: /doc/trunk/www/fossil-v-git.wiki#portable +[fsrc]: https://fossil-scm.org/home/file/src +[fsrv]: /help/server +[hljs]: https://fossil-scm.org/forum/forumpost/9150bc22ca +[ie11x]: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 +[ns]: https://noscript.net/ +[pjs]: https://fossil-scm.org/forum/forumpost/1198651c6d +[s1]: https://blockmetry.com/blog/javascript-disabled +[s2]: https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/ +[s3]: https://w3techs.com/technologies/overview/client_side_language/all +[ubo]: https://github.com/gorhill/uBlock/ +[v8]: https://en.wikipedia.org/wiki/V8_(JavaScript_engine) +[whmsl]: https://www.whitesourcesoftware.com/most-secure-programming-languages/ + + +---- + +## Places Where Fossil’s Web UI Uses JavaScript + +This section documents the areas where Fossil currently uses JavaScript +and what it does when these uses are blocked. It also gives common +workarounds where necessary. + + +### Timeline Graph + +Fossil’s [web timeline][wt] uses JavaScript to render the graph +connecting the visible check-ins to each other, so you can visualize +parent/child relationships, merge actions, etc. We’re not sure it’s even +possible to render this in static HTML, even with the aid of SVG, due to +the vagaries of web layout among browser engines, screen sizes, etc. + +Fossil also uses JavaScript to handle clicks on the graph nodes to allow +diffs between versions, to display tooltips showing local context, etc. + +_Graceful Fallback:_ When JavaScript is disabled, this column of the +timeline simply collapses to zero width. All of the information you can +get from the timeline can be retrieved from Fossil in other ways not +using JavaScript: the “`fossil timeline`” command, the “`fossil info`” +command, by clicking around within the web UI, etc. + +_Potential Workaround:_ The timeline could be enhanced with `