The WWWorst App Store
The WWWorst App Store - GNU Project





Picture the most abusive app store.

Programs in it are meant to run on your own computer.

However, you have to be online to run them.

Every time you start them, they contact the app store.

If there is an updated version, it's installed automatically, no
questions asked.  You'd rather run the earlier version?  Tough.

If the app store decides you're no longer welcome, the program won't 
start any more.

If the app store servers are offline, or if you are, it won't start
either.


Programs in this app store must also hold your data in the app store's
servers.

If the program won't start, you can't get to the data on the servers
any more.

You may have downloaded backups of your data, but you'd have to figure
out how to decode them without the program.


Sounds like a nightmare?  It is.  But it's also very real.

Well-known app stores are approaching this level of nastiness.

But they are just catching up with the real thing.

The most abusive app store is the business-driven perversion of the
old user-empowering distributed hypertext system called “the Web.”

Users have been encouraged to adopt “web apps” for much of their
computing, paving the way for other app stores to follow suit.


“Web apps” are most often distributed as JavaScript (though Java and
Flash have served similar purposes), automatically installed and
executed on your browser.

But the problem is not that they're in JavaScript, or that it's your
browser that runs them.  It's that:


you don't have control over what the program does;
you don't have control over when you can run it;
you don't have control over your own data.


The app store owner takes all that control away from you, thereby
gaining control over you.

You lose when the JavaScript code is nonfree software.

https://www.gnu.org/philosophy/javascript-trap.html

But you also lose when it is (nominally) free software!


When the app / web site has so much control over what runs on
your computer, the effect “is equivalent to using a nonfree program
with surveillance features and a universal back door.” 

https://www.gnu.org/philosophy/network-services-arent-free-or-nonfree.html 


https://www.gnu.org/philosophy/who-does-that-server-really-serve.html 

The owner gets all the freedom, and you, the user, get none.

That's not a self-respectful way to do your computing.

It invades your privacy, it keeps you and your data hostage, it takes
away your agency and your freedom when it comes to your digital life.



The web used to be a wonderful way to share information.

Web apps and mandatory JavaScript have turned it into the worst app
store.

It is time to separate the WWWonderful from the WWWorst practices.

Here are some ways to help:


request web sites that require JavaScript execution to offer either:
  
  alternate means of access to information they publish, or
  alternate means of delivery for their apps;
  


promote free browser extensions that control JavaScript execution;
https://www.gnu.org/software/librejs/

beware of apps that are mere front ends for SaaSS;

https://www.gnu.org/philosophy/who-does-that-server-really-serve.html

demand software you use to be delivered in freedom-respecting ways;

promote hypertext systems that do not grant servers control over users.

https://en.wikipedia.org/wiki/Gemini_(protocol)

https://en.wikipedia.org/wiki/Gopher_(protocol)


More generally:


as a self-respecting user, reject the abusive practices whenever you can;

https://gnu.org/philosophy/saying-no-even-once.html

discourage automatic execution of downloaded code;

https://www.fsfla.org/blogs/lxo/pub/who-is-afraid-of-spectre-and-meltdown.en.html

as a network service operator, set a user-respecting example;

https://www.gnu.org/philosophy/network-services-arent-free-or-nonfree.html

spread awareness of the problem, and advice on solving and avoiding it.

https://www.gnu.org/help/help-javascript.html


Now, if you wish your site to give its users a taste of how the
WWWorst app store feels to us, add to web pages you control the
following JavaScriptlet:


document.body.textContent = 'Please disable JavaScript to view this site.'

If you wish, make “disable JavaScript” a link to this article.



Thanks to Richard Stallman for the inspiration to write about this
issue, and for the encouragement to publish it.

2021-04-01 update:  thanks to KE0VVT for letting me know that
textContent can't have links; you need innerHTML for that.
