non-free file; privacy breach

[onlyjob]

File doc-src/plugin/templates/default/layout/html/footer.erb contains Copyright 1996-2012 Adobe, Inc. All Rights Reserved. without grant of license hence it appears to be proprietary.

Please remove this file or clarify its license with copyright holder.

Also there are "privacy breach" concerns due to references to (unsafe) 3rd party resources.

Thanks.

[jeskew]

That comment refers to the javascript file included on the next line. This is a standard practice for properly attributing included JS files that may or may not include an in-line attribution.

[onlyjob]

Scope of the comment is very ambiguous. It is not clear at all where it applies (to included file above the comment or below it or to the whole footer.erb...

[jasdel]

Hi @onlyjob like @jeskew mentioned the comment refers to the content under the comment which is a standard practice attributing third party content. <!-- End SiteCatalyst code version: H.25.2. --> on line 30 denotes where the attributed content terminates.

The linked third party script is not included with the SDK, and is a runtime dependency of the generated API documentation available at http://docs.aws.amazon.com/sdk-for-go/api/

Please contact us directly, and reference this github issue, at aws-security@amazon.com with any additional information about your concerns of privacy breach and unsafeness of the third party library.

[onlyjob]

Thanks, @jasdel. As for https://media.amazonwebservices.com/js/sitecatalyst/s_code.min.js, it is minified obfuscated code which is very hard to review and nearly impossible to modify. There are general concerns about safety of such code because of difficulties to review it. Lately it was demonstrated how minification itself can be exploited to produce an attack vector. Finally minification is generally unnecessary and even harmful -- here you can read some arguments against minification: https://wiki.debian.org/onlyjob/no-minification.

Finally from open source software prospective it is a bad practice to rely upon or use proprietary components even if they are not a part of SDK.

[jasdel]

Hi @onlyjob, thanks for the feedback. I'm going to close this issue since the third party library is attributed, and not used within the SDK. But only within the SDK's API documentation which is also external to the SDK.

[onlyjob]

But it is part of the SDK as the file in question ships with SDK.
Attribution is nice but it does not make non-free any less evil.
Naturally I had to drop fragment of this file from Debian package and I wish that wouldn't be necessary... :(

[jasdel]

@onlyjob, I'm not sure I understand the issue that would prevent including the SDK in a Debian package. The third party js file is not included within the SDK's repository. It is only referenced in a html template file, which is not used by the SDK it self and only used as a template to generate API documentation.