51–52 of 52 posts
Earlier quoted context omitted.
JavaScript has it covered pretty well. http://www.jsfuck.com/
jsfuck is hardly obfuscation: remove the first 828 bytes (for "eval(") and the last 3 bytes (for ")()"), and then execute the remaining string, and that gives you the original source code.
Earlier quoted context omitted.
> Because the code is being executed on my machine, with my data, using my online identity. You chose to execute someone else's code by visiting their website. The mere act of voluntarily executing someone else's code doesn't entitle you to it's source. Feel free to not visit the site, and looking at the top Alexa sites, your insistence of code audit-ability would leave you with very few viable, high quality choices.…
> You chose to execute someone else's code by visiting their website. I block JS by default until I get at least a basic understanding what the site wants to do. So I explicitly choose not to execute their code before I have some reason to trust the site. > Untrue. It just so happened that the early web was a collection of static documents, and js was a hack to add some trivial functionality. And yet every browser ha…
But then the only difference is unobfuscated wasm vs unobfuscated javascript. In both cases an obfuscation can easily hide the scary bits anyway.