I really like the approaches implemented in drupal.js. But I've been wondering--would we do better to use the now widely supported, and excellently designed, Prototype library (http://prototype.conio.net/ -- see documentation e.g. at http://www.sergiopereira.com/articles/prototype.js.html) instead? The advantages would be that we'd be using a well supported open source library, rather than our own (nice, but not used elsewhere) solution. Doing so would allow Drupal developers to use the ever-expanding range of Prototype-based libraries, including: moofx http://moofx.mad4milk.net/ behaviour http://bennolan.com/behaviour/ scriptaculous http://script.aculo.us We'd still need some custom drupal methods, but we could reduce them to a minimum. We could also draw on other open source CMS etc. softwares using Prototype, e.g, Ruby on Rails. Doing so would require some refactoring of our existing javascript (autoexpand, etc.), but really not so much. And we'd be able to take advantage of some great features and methods in Prototype and its related libraries. Prototype and its relatives are "MIT style" licensed, presumably GPL compatible, http://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses. Thoughts?
Hi, +1 on this; I really like programming with the prototype library. Regards, Konstantin Käfer 2005/11/15, Nedjo Rogers <nedjo@islandnet.com>:
I really like the approaches implemented in drupal.js.
But I've been wondering--would we do better to use the now widely supported, and excellently designed, Prototype library (http://prototype.conio.net/ -- see documentation e.g. at http://www.sergiopereira.com/articles/prototype.js.html) instead?
The advantages would be that we'd be using a well supported open source library, rather than our own (nice, but not used elsewhere) solution. Doing so would allow Drupal developers to use the ever-expanding range of Prototype-based libraries, including:
moofx http://moofx.mad4milk.net/ behaviour http://bennolan.com/behaviour/ scriptaculous http://script.aculo.us
We'd still need some custom drupal methods, but we could reduce them to a minimum.
We could also draw on other open source CMS etc. softwares using Prototype, e.g, Ruby on Rails.
Doing so would require some refactoring of our existing javascript (autoexpand, etc.), but really not so much. And we'd be able to take advantage of some great features and methods in Prototype and its related libraries.
Prototype and its relatives are "MIT style" licensed, presumably GPL compatible, http://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses.
Thoughts?
I have very small knowledge of Js so I cannot comment on the quality of prototype. However, standing on the shoulders of giants is always a good idea. Better then building your own tower to get that high :) So im all for this. Ber On Mon, 14 Nov 2005 20:05:08 -0800 Nedjo Rogers <nedjo@islandnet.com> wrote:
I really like the approaches implemented in drupal.js.
But I've been wondering--would we do better to use the now widely supported, and excellently designed, Prototype library (http://prototype.conio.net/ -- see documentation e.g. at http://www.sergiopereira.com/articles/prototype.js.html) instead?
The advantages would be that we'd be using a well supported open source library, rather than our own (nice, but not used elsewhere) solution. Doing so would allow Drupal developers to use the ever-expanding range of Prototype-based libraries, including:
moofx http://moofx.mad4milk.net/ behaviour http://bennolan.com/behaviour/ scriptaculous http://script.aculo.us
We'd still need some custom drupal methods, but we could reduce them to a minimum.
We could also draw on other open source CMS etc. softwares using Prototype, e.g, Ruby on Rails.
Doing so would require some refactoring of our existing javascript (autoexpand, etc.), but really not so much. And we'd be able to take advantage of some great features and methods in Prototype and its related libraries.
Prototype and its relatives are "MIT style" licensed, presumably GPL compatible, http://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses.
Thoughts?
-- Bèr Kessels Drupal services bler.webschuur.com www.webschuur.com ber@jabber.webschuur.com
On Tue, 15 Nov 2005 13:21:54 +0100, Ber Kessels <ber@webschuur.com> wrote:
I have very small knowledge of Js so I cannot comment on the quality of prototype.
However, standing on the shoulders of giants is always a good idea. Better then building your own tower to get that high :)
So im all for this.
Are we risking the possibility of running into problems like we did with the third-party xmlrpc library we used? I know this isn't PHP code, so there shouldn't be any exploits, but are there other issues we should keep in mind? -- Tim Altman
Are we risking the possibility of running into problems like we did with the third-party xmlrpc library we used? I know this isn't PHP code, so there shouldn't be any exploits, but are there other issues we should keep in mind?
This is what I was thinking too when I first read this thread. More specifically, we may have XSS vulnerabilities by third party javascript libraries. Don't get me wrong: this is not NIH (Not Invented Here), and I support taking the best tools from whereever they are. All I am saying is that it needs to be audited for such possibilities. We learned the hard way with xmlrpc.
We learned the hard way with xmlrpc.
Not really. Code that was written by us has had loads of vulnerabilities as well. One might argue that 3rd party code like prototype is likely safer since it has ben exposed to more eyeballs.
Moshe Weitzman wrote:
We learned the hard way with xmlrpc.
Not really. Code that was written by us has had loads of vulnerabilities as well. One might argue that 3rd party code like prototype is likely safer since it has ben exposed to more eyeballs.
Not necessarily more eyeballs than xmlrpc. Prototype is a one-man show, as far as the code development goes, just like xmlrpc was. I recently reviewed 5 different Javascript libraries for implementation of AJAX features. They were all over the map, which to me says that the best practice or common idioms have not been established yet. Would tying Drupal to just one of a variety of competing ideas on how to implement such a library at this point be a good idea? If so, prototype's code is at least brief (not heavy like some libraries I've seen) and clean appearing.
I definitely want to see some AJAX love for Drupal. 1. drupal.js is very good. 2. prototype.js is 45k. Then we're gonna want to add Rico or Scriptaculous on top of that. All of the other libraries with visual effects are pretty big as well. Thats probably too big to include on a page by default (if people are complaing about the size of the css file :) ) 3. xajax integrates very well with PHP. With just writing PHP it would allow us to have pages update via AJAX using php callbacks (it generates all the necessary javascript). I like that approach. We could extend what exists currently in drupal.js to add similar functionality. We could even simply switch to xajax or something with a similar concept. It would also remove knowledge of javascript as barrier to AJAX additions to Drupal. We can use the resources saved by not dealing with js directly to ensure that everything falls back nicely in the absence of JS. 4.Our xmlrpc system is still based on a 3rd part library. The 'Not invented here' syndrome isn't too bad in our community. I think all the jazzy js effects should be left as a contrib addition (at least for now), and that basic AJAX functionality, that can be easily used should be added to Drupal core. PS Visual effects can be very useful (not just snazz). Cinematic effects can be used as UI aids, and I think that a drag 'n drop position selector for blocks and book pages (rather than assigning weights) would just rock! On 11/15/05, Khalid B <kb@2bits.com> wrote:
Are we risking the possibility of running into problems like we did with the third-party xmlrpc library we used? I know this isn't PHP code, so there shouldn't be any exploits, but are there other issues we should keep in mind?
This is what I was thinking too when I first read this thread.
More specifically, we may have XSS vulnerabilities by third party javascript libraries.
Don't get me wrong: this is not NIH (Not Invented Here), and I support taking the best tools from whereever they are.
All I am saying is that it needs to be audited for such possibilities. We learned the hard way with xmlrpc.
-- Best regards, Herman Webley
4.Our xmlrpc system is still based on a 3rd part library. The 'Not invented here' syndrome isn't too bad in our community.
Yeah. The functionality of it is still mostly IXR but we are moving away day by day... So it is truly based but very soon it'll be just "loosely based on" :)
On Tue, Nov 15, 2005 at 01:41:30PM +0100, Tim Altman wrote:
On Tue, 15 Nov 2005 13:21:54 +0100, Ber Kessels <ber@webschuur.com> wrote:
I have very small knowledge of Js so I cannot comment on the quality of prototype.
However, standing on the shoulders of giants is always a good idea. Better then building your own tower to get that high :)
So im all for this.
Are we risking the possibility of running into problems like we did with the third-party xmlrpc library we used? I know this isn't PHP code, so there shouldn't be any exploits, but are there other issues we should keep in mind?
The biggest problem I've seen so far with JavaScript is leaking memory. -- Neil Drumm http://delocalizedham.com/
On Mon, 2005-11-14 at 20:05 -0800, Nedjo Rogers wrote:
I really like the approaches implemented in drupal.js.
But I've been wondering--would we do better to use the now widely supported, and excellently designed, Prototype library (http://prototype.conio.net/ -- see documentation e.g. at http://www.sergiopereira.com/articles/prototype.js.html) instead?
Prototype is good. Very good in fact. And there are a lot of good examples. Prototype + behaviours could make for a very interactive, userfriendly and designer friendly Drupal. +1
On Tue, Nov 15, 2005 at 12:34:42PM +0000, vlado wrote:
On Mon, 2005-11-14 at 20:05 -0800, Nedjo Rogers wrote:
I really like the approaches implemented in drupal.js.
But I've been wondering--would we do better to use the now widely supported, and excellently designed, Prototype library (http://prototype.conio.net/ -- see documentation e.g. at http://www.sergiopereira.com/articles/prototype.js.html) instead?
Prototype is good. Very good in fact. And there are a lot of good examples. Prototype + behaviours could make for a very interactive, userfriendly and designer friendly Drupal. +1
JavaScript != usability -- Neil Drumm http://delocalizedham.com/
I've done some work with Prototype, and have found it to be really well thought out. I would love to see Drupal standardise on this package for adding AJAX functionality. Prototypes inclusion in Rails also offers some guarantees that it will be around for a while, developed further, and maintained. +1 from me... ------------------- Colin Brumelle colin@bryght.com http://bryght.com http://mixedcontent.com Cell: 604.351.0547 Office: 604.682.2889 skype/jabber/aim: cbrumelle
prototype is not GPL, it is MIT. we only allow GPL. I think this is a big problem. Ber On Tue, 15 Nov 2005 15:23:23 -0800 Colin Brumelle <colin@bryght.com> wrote:
I've done some work with Prototype, and have found it to be really well thought out. I would love to see Drupal standardise on this package for adding AJAX functionality. Prototypes inclusion in Rails also offers some guarantees that it will be around for a while, developed further, and maintained.
+1 from me...
------------------- Colin Brumelle colin@bryght.com http://bryght.com http://mixedcontent.com Cell: 604.351.0547 Office: 604.682.2889 skype/jabber/aim: cbrumelle
-- Bèr Kessels Drupal services bler.webschuur.com www.webschuur.com ber@jabber.webschuur.com
I believe the two licenses are compatible. See: http://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses On 11/16/05, Ber Kessels <ber@webschuur.com> wrote:
prototype is not GPL, it is MIT. we only allow GPL. I think this is a big problem.
Ber
On Tue, 15 Nov 2005 15:23:23 -0800 Colin Brumelle <colin@bryght.com> wrote:
I've done some work with Prototype, and have found it to be really well thought out. I would love to see Drupal standardise on this package for adding AJAX functionality. Prototypes inclusion in Rails also offers some guarantees that it will be around for a while, developed further, and maintained.
+1 from me...
------------------- Colin Brumelle colin@bryght.com http://bryght.com http://mixedcontent.com Cell: 604.351.0547 Office: 604.682.2889 skype/jabber/aim: cbrumelle
-- Bèr Kessels Drupal services bler.webschuur.com <http://bler.webschuur.com> www.webschuur.com<http://www.webschuur.com> ber@jabber.webschuur.com
-- ------------------- Colin Brumelle colin@bryght.com http://bryght.com http://mixedcontent.com Cell: 604.351.0547 Office: 604.682.2889 skype/jabber/aim: cbrumelle
Hi, Even though they are compatible, the basic thing is that only GPL'ed software is allowed in drupal. This is not a compatibility issue, but more the philosophy of drupal. Gordon. On Wed, 2005-11-16 at 08:55 -0800, Colin Brumelle wrote:
I believe the two licenses are compatible. See: http://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses
On 11/16/05, Ber Kessels <ber@webschuur.com> wrote: prototype is not GPL, it is MIT. we only allow GPL. I think this is a big problem.
Ber
On Tue, 15 Nov 2005 15:23:23 -0800 Colin Brumelle <colin@bryght.com> wrote:
> I've done some work with Prototype, and have found it to be really well > thought out. I would love to see Drupal standardise on this package for > adding AJAX functionality. Prototypes inclusion in Rails also offers some > guarantees that it will be around for a while, developed further, and > maintained. > > +1 from me... > > ------------------- > Colin Brumelle > colin@bryght.com > http://bryght.com > http://mixedcontent.com > Cell: 604.351.0547 > Office: 604.682.2889 > skype/jabber/aim: cbrumelle >
-- Bèr Kessels Drupal services bler.webschuur.com www.webschuur.com ber@jabber.webschuur.com
-- ------------------- Colin Brumelle colin@bryght.com http://bryght.com http://mixedcontent.com Cell: 604.351.0547 Office: 604.682.2889 skype/jabber/aim: cbrumelle !DSPAM:437b6997218851329013704!
Um, I really don't want to start a license flame war here, but claiming that we shouldn't use code under a less restrictive license than the GPL even if it's legal because that author didn't choose the Holy GPL goes beyond arrogant to asinine. The Linux kernel uses BSD networking code quite happily, for instance, and not even Stallman has a problem with that. An MIT/BSD/esque library, included into Drupal and distributed with it, is distributed by Drupal under the GPL. It's 100% legal and 100% Free Software compliant. vrms would be perfectly happy with it. :-) I've not used Prototype so I cannot speak to its technical qualities, but from a legal/licensing standpoint there's really no legitimate dispute if it's MIT-esque licensed. On Wednesday 16 November 2005 03:13 pm, Gordon Heydon wrote:
Hi,
Even though they are compatible, the basic thing is that only GPL'ed software is allowed in drupal. This is not a compatibility issue, but more the philosophy of drupal.
Gordon.
On Wed, 2005-11-16 at 08:55 -0800, Colin Brumelle wrote:
I believe the two licenses are compatible. See: http://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses
On 11/16/05, Ber Kessels <ber@webschuur.com> wrote: prototype is not GPL, it is MIT. we only allow GPL. I think this is a big problem.
Ber
On Tue, 15 Nov 2005 15:23:23 -0800
Colin Brumelle <colin@bryght.com> wrote: > I've done some work with Prototype, and have found it to be
really well
> thought out. I would love to see Drupal standardise on this
package for
> adding AJAX functionality. Prototypes inclusion in Rails
also offers some
> guarantees that it will be around for a while, developed
further, and
> maintained. > > +1 from me...
-- Larry Garfield AIM: LOLG42 larry@garfieldtech.com ICQ: 6817012 "If nature has made any one thing less susceptible than all others of exclusive property, it is the action of the thinking power called an idea, which an individual may exclusively possess as long as he keeps it to himself; but the moment it is divulged, it forces itself into the possession of every one, and the receiver cannot dispossess himself of it." -- Thomas Jefferson
I don't think choosing to allow on GPL code in the Drupal project is any more arrogant or assine than choosing to select the GPL for the code we write. (I don't think of either as being arrogant or assine) More important might be the current CVS rule of no 3rd party software. GPL or not prototype would have to be downloaded from its upstream source. This obviously cannot work for a core javascript file. (The difference between prototype.js/drupal.js and the xmlrpc library is that the xmlrpc library was just used as a base (and as such our fork of the library isn't hosted anywhere else) while prototype would ideally follow the upstream source which would be the definitive source). On 11/16/05, Larry Garfield <larry@garfieldtech.com> wrote:
Um, I really don't want to start a license flame war here, but claiming that we shouldn't use code under a less restrictive license than the GPL even if it's legal because that author didn't choose the Holy GPL goes beyond arrogant to asinine. The Linux kernel uses BSD networking code quite happily, for instance, and not even Stallman has a problem with that.
An MIT/BSD/esque library, included into Drupal and distributed with it, is distributed by Drupal under the GPL. It's 100% legal and 100% Free Software compliant. vrms would be perfectly happy with it. :-)
I've not used Prototype so I cannot speak to its technical qualities, but from a legal/licensing standpoint there's really no legitimate dispute if it's MIT-esque licensed.
On Wednesday 16 November 2005 03:13 pm, Gordon Heydon wrote:
Hi,
Even though they are compatible, the basic thing is that only GPL'ed software is allowed in drupal. This is not a compatibility issue, but more the philosophy of drupal.
Gordon.
On Wed, 2005-11-16 at 08:55 -0800, Colin Brumelle wrote:
I believe the two licenses are compatible. See: http://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses
On 11/16/05, Ber Kessels <ber@webschuur.com> wrote: prototype is not GPL, it is MIT. we only allow GPL. I think this is a big problem.
Ber
On Tue, 15 Nov 2005 15:23:23 -0800
Colin Brumelle <colin@bryght.com> wrote: > I've done some work with Prototype, and have found it to be
really well
> thought out. I would love to see Drupal standardise on this
package for
> adding AJAX functionality. Prototypes inclusion in Rails
also offers some
> guarantees that it will be around for a while, developed
further, and
> maintained. > > +1 from me...
-- Larry Garfield AIM: LOLG42 larry@garfieldtech.com ICQ: 6817012
"If nature has made any one thing less susceptible than all others of exclusive property, it is the action of the thinking power called an idea, which an individual may exclusively possess as long as he keeps it to himself; but the moment it is divulged, it forces itself into the possession of every one, and the receiver cannot dispossess himself of it." -- Thomas Jefferson
-- Best regards, Herman Webley
(The difference between prototype.js/drupal.js and the xmlrpc library is that the xmlrpc library was just used as a base (and as such our fork of the library isn't hosted anywhere else)
No. The difference is that I asked Simon Willison (the original author) and he GPL'd the Drupal fork. Thanks Simon if you are ever reading this. Regards NK
On 11/17/05, Karoly Negyesi <karoly@negyesi.net> wrote:
(The difference between prototype.js/drupal.js and the xmlrpc library is that the xmlrpc library was just used as a base (and as such our fork of the library isn't hosted anywhere else)
No. The difference is that I asked Simon Willison (the original author) and he GPL'd the Drupal fork. Thanks Simon if you are ever reading this.
Regards
NK
/me stands corrected -- Best regards, Herman Webley
On 17-Nov-05, at 10:35 AM, Karoly Negyesi wrote:
(The difference between prototype.js/drupal.js and the xmlrpc library is that the xmlrpc library was just used as a base (and as such our fork of the library isn't hosted anywhere else)
No. The difference is that I asked Simon Willison (the original author) and he GPL'd the Drupal fork. Thanks Simon if you are ever reading this.
Great...luckily the MIT license is less restrictive than the GPL, so we could in fact GPL license "our" local copy. -- Boris Mann Vancouver 778-896-2747 San Francisco 415-367-3595 SKYPE borismann http://www.bryght.com
Some people have mentioned dojo, xajax, and possibly others. The choice would be something worth discussing, but in principle I am in favour of adding a well-maintained library. See: http://wiki.osafoundation.org/bin/view/Projects/AjaxLibraries Tim: Javascript libraries can not introduce any new threats I can think of. The only chance is if the user can write some malicious javascript on your site - which we avoid already anyway. -- David Carrington
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 15 Nov 2005, at 2:57 PM, David Carrington wrote:
See: http://wiki.osafoundation.org/bin/view/Projects/AjaxLibraries
It must be kismet. This was on digg today : http://edevil.wordpress.com/2005/11/14/javascript-libraries-roundup/ - -- Adrian Rossouw Drupal developer and Bryght Guy http://drupal.org | http://bryght.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (Darwin) iD8DBQFDeeIUgegMqdGlkasRAnAYAJ0ULHpOb8wTIG2FZbvmHU1Rqhb1LACfShqw VVecBd9b+71aBbwU4keorZo= =GwrY -----END PGP SIGNATURE-----
Prototype does indeed seem to be a very light, clean, and extensible library: but nonetheless, it is nowhere near as light as drupal.js. Quick comparison: Drupal.js: 281 lines, 6.21KB Prototype.js: 1039 lines, 27.29KB I am confident of the quality and the benefits of the prototype library. But we really need to consider whether or not these benefits can justify quadrupling the size of our base JS file. According to websiteoptimization.com, web sites should be aiming for a to have 8KB or less of JS on any given page. This will not be possible with prototype. Jaza.
At 11:34 AM +1100 16/11/05, Jeremy Epstein wrote:
Prototype does indeed seem to be a very light, clean, and extensible library: but nonetheless, it is nowhere near as light as drupal.js. Quick comparison:
Drupal.js: 281 lines, 6.21KB Prototype.js: 1039 lines, 27.29KB
All the Drupal .js files combines come to 18 kB. Is it possible to strip prototype down a bit? There are a lot of comments in the file that wouldn't be needed in a live site. What about separating it into function-related files and just sending the bits the page needs? ...R.
participants (19)
-
Adrian Rossouw -
Ber Kessels -
Boris Mann -
Chris Johnson -
Colin Brumelle -
David Carrington -
Gordon Heydon -
Herman Webley -
Jeremy Epstein -
Karoly Negyesi -
Khalid B -
Konstantin Käfer -
Larry Garfield -
Moshe Weitzman -
Nedjo Rogers -
neil＠civicspacelabs.org -
Richard Archer -
Tim Altman -
vlado