HTML5 browser-based media player: plays your mp3′s & works offline

Ah, I see, then this will be the first open-sourced cloud music player. :D

Yes you may have a valid point but dropbox has no such clause in their TOS

Every security issue you listed about this page applies to every program. Let’s take a look at them.

“One, a web page is a doorway to the internet port 80, in and out…”

Same as a music player program running on your computer. Rhythmbox can (and does) read and send traffic over port 80. No difference.

“..and being a program it has access to your data on the computer since you willfully give the rights to folders.”

Same as a music player program running on your computer. Rhythmbox has access to your data because you willfully give it rights to your entire file system.

“Who says one day the updated code coming from the HTML5 site is not filled with analytics and other ~improvements~ deemed necessary by them”

Same as a music player program running on your computer. Who says that the updated code for Rhythmbox is not filled with analytics and other ~improvements~ deemed necessary by them?

Let me make this clear: there is NO DIFFERENCE between an HTML5 application running locally on your computer and a compiled application running locally on your computer. You are perceiving a difference which doesn’t really exist because the application runs in your browser, and browsers are traditionally used to interact with the internet.

Let’s put it a different way. A browser does two critical things: downloads HTML pages from the internet, and interprets those HTML pages in a human readable manor. If you are running a page that you’ve saved locally, then you’ve removed the “download the page from the internet” part of the equation, and now your browser is just interpreting HTML code for you. There’s no fundamental difference between a browser interpreting HTML code and the JVM interpreting Java bytecode.

To answer to your comment just below.

“Same as a music player program running on your computer. Rhythmbox can (and does) read and send traffic over port 80. No difference.”

Yes there is a difference in as you have a choice to allow or not access to the web. This is not true with the HTML5 music player, since people will default to their bookmark.

“Same as a music player program running on your computer. Who says that the updated code for Rhythmbox is not filled with analytics and other ~improvements~ deemed necessary by them?”

Ok this needs a bit of background:

You know about back doors by Microsoft for the government, emails that cant be deleted again the same company, they have been caught and many other companies and gov, they keep repeating in different ways to undermine projects and people just for the sake of having the market. In Africa they were caught paying politician under the table to co opt open sourced projects. That is not counting Europe. This is representative of business and seems to be seen as the accepted way, as if it made any sense. Oh yes our dear FBI covertly paid a software engineer to have a back door in ssl a few years back. They are not our friends or here to help us.

A trust issue. Open sourced projects have something that business is not about. Cooperation! Big word but means much compared to the other model. Nothing is perfect but between the our choices I think i would trust OO before COM or GOV.

“Let me make this clear: there is NO DIFFERENCE between an HTML5 application running locally on your computer and a compiled application running locally on your computer. You are perceiving a difference which doesn’t really exist because the application runs in your browser, and browsers are traditionally used to interact with the internet.”

Yes big difference, see above and since the code is as dynamic as a web page there is no real peer review. As you or anybody else on a regular basis will NOT run it from a locally saved file and most people dont know how to do this.

HTML5 is not as robust for security, as i said, for the fact it is not peered reviewed as other locally installed programs.

The intended use is not as you say, to use locally it is intended to be used online. This argument is mute!

Answer to answer to answer.

“The fact that this application is written in HTML has nothing to do with it being peer reviewed. This application could just as easily have been written by GNOME and been peer reviewed before being put up on a site somewhere. Nothing would change except the authors and the code-writing process, and then all your concerns would be gone. Again, HTML has nothing to do with it. Stop calling HTML insecure.”

Your first line is totally true. These are the codes which have the least peer review! Second line, who knows who wrote it? When i download a locally run program i choose it!! Where it comes from by whom it was made, and of course if it exists as open source, which is 99%. When faults are found it is subjected to inspection and reported !!
By choosing HTML, you forfeit that step which in my mind is what makes it more insecure.

Moot not mute !!

As the developer of this, I guess I’ll take a stab at defending my non-evilness.

HTML isn’t usually peer reviewed by virtue of being restricted to a sandbox. This sandbox has almost never been broken, and web applications always have to adhere to specific rules regarding functionality.

Could I theoretically update this app to take your music collection and upload it somewhere so that I could gather evidence for the FBI and expose your private torrent collection? Yeah, I probably could. But unlike normal cloud media players, there isn’t any infrastructure set up for me to easily or transparently do that.

By virtue of being a very simple proof of concept, this application which only weighs in at around 400 lines of code. It’s probably been looked at and examined thoroughly than any open source desktop media player. So in that sense, you could say that it is, indeed peer-reviewed.

Web apps can only do basic HTTP GET/POST/PUT/etc requests on servers and require special headers in order to do it on other domains. It’s hosted on *.github.com which only hosts static files (as far as I’m aware), so it needs special configuration on another server if I were to be evil and tried to harvest data.

Cool, Antimatter15 I appreciate you giving a personal touch to this.

The discussion had a momentum of it’s own and much of it was not, but some, about a dev doing it’s own thing!

This demonstrates the difference to a large entity which have boards and… You feel proud of what you did and i’m all for that. Your reputation is on the line. Not some unattainable class action suit. I am sure you see yourself differently than a large corporation! You by your own admittance will not use code for malice, believe or not I have more confidence in you at this point than any other source of HTML5. You made it personal! Very cool! Try to be personal with Microsoft!
It is not the size of the app which is important but how it came to be.
—So in that sense, you could say that it is, indeed peer-reviewed.—
Yes your app at this point I checked it out, this version, and I can vouch for it myself. But the system for HTML(5) review is deficient none the less compared to open source culture.
Should there be a review process for this particular code. Yes I think so, that’s why I feel the missing link to this new way of handling personal data is very young that still needs growing in a world of information exchange not always abiding by the “rules”.
Two thumbs UP!!