I haved audited the JSInterpreter class in youtube-dl. Here are my
findings:
* You can crash it by doing an infinite loop: function loop(){loop();}
* It is NOT turing complete (because there is no 'if' or ability to
create 'if' by passing functions as values)
I believe that all the jsinterpreter can do is run a fixed call tree of
functions which pass numbers, characters and strings as arguments. And
apply a small set of built in functions on them like +, -, reverse,
slice, array indexing.
Originally youtube-dl used to reverse engineer a certain 'signature'
function from the youtube base.js file. This function had to be updated
more and more often, a primitive version of jsinterpreter was used by
the developers to do this quickly. Eventually they automated that
completely.
So this a little bit of a fuzzy issue. Here are a summary of the points
to weigh up:
* The javascript file is source-available but not libre.
* The javascript snippet used would be classified as trivial by
librejs[1] and not require license
* The "language" implemented can do small computations but is branchless
and sub-turing
* Youtube terms of service[2] say that you do not have permission
download youtube videos
[1]
https://www.gnu.org/software/librejs/manual/librejs.html#JavaScript-Detection
[2] https://www.youtube.com/static?template=terms
-----------------------------------------------------
Those are the technical details, Now here's my opinion:
Richard Stallman has stated (at FOSDEM 2016, I think) that it is ok to
use non-free software if it is to further the use of free-software: For
example using a non-free system to print out leaflets to advertise a
free software convention. Related link
<https://www.gnu.org/philosophy/is-ever-good-use-nonfree-program.en.html>
I think youtube-dl fits under a similar situation, there is a wealth of
enriching information on there including educational materials about
free software. It is wonderful when people upload them to mediagoblin
but not everything is there. Secondly, the youtube site seems to want
the user to be executing their (non-libre) js and youtube-dl is actually
avoiding this and working around it in a clever way - in fact it is not
even executing a turing complete language, it simply extracts the cipher
it needs to get around that. Of course this is not ideal, in a perfect
world you wouldn't want your programs to access or parse non-libre
javascript.
So, while youtube-dl is an invaluable tool.. it is not exactly clear to
me whether it can be considered free libre software.
* The source code is available and it is permissively licensed[4]
* The program munges nonfree javascript, allowing the user to accomplish
a task without executing it.
* The program is used to violate TOS, but software freedom 0 says we
have the right to use a program for any purpose.
[4] https://github.com/rg3/youtube-dl/blob/master/LICENSE
What would a completely libre version of youtube-dl look it? I think
that it would only work on sites whose TOS support downloading videos,
and only does so for videos which have some kind of creative
commons/free culture license.