Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript Obfuscation Techniques by Example

trickster.dev

Post reply on HN
Print view View original

21–30 of 75 posts

Re: JavaScript Obfuscation Techniques by Example

#21

Post by edflsafoiewq »

iratewizard wrote: post #19
whatshisface wrote: post #5

Earlier quoted context omitted.

Business people demand it to protect intellectual property without realizing the ease of reversing it / wanting to say they're doing something to protect IP that their own superior will not realize doesn't help. It is making the best of an impossible situation, the paradox of sending your code to every single customer for them to run it while also wishing nobody could see it. The more aggressive they make patent law…

With how mediocre most developers today are, obfuscation is enough.

Can't tell if you mean they can't deobfuscate, or that their code isn't worth the effort of deobfuscating.

Re: JavaScript Obfuscation Techniques by Example

#23

Post by kitten_mittens_ »

cabirum wrote: post #7
muhehe wrote: post #4

Why obfuscate, when you can just follow modern trends and use webpack (or similar) which gives you completely unreadable shit.

"Modern"? Webpack/code bundlers is quite an ancient tech by now. Regard it as an intermediate representation (IR) of your code, a stage between your readable source code and browser bytecode/jit. The "shit" is still readable since webpack also generates source maps.

Do you mean ancient like something has replaced it? Or old enough to be in widespread use?

Re: JavaScript Obfuscation Techniques by Example

#25

Post by Kiro »

peanut_worm wrote: post #16

If you obfuscate client side javascript that is being served in a browser you should get banned from the internet

Why would serving it in the browser or not matter? It's like saying all code should be open source, which is a valid opinion but I don't see why writing JavaScript and serving it in the browser would be any different. It's not like I automatically agree on making my code fully available just because I happen to target the web.

Sure, you can de-obfuscate JS but you can also reverse engineer other software.

Re: JavaScript Obfuscation Techniques by Example

#27

Post by aussieshibe »

peanut_worm wrote: post #16

If you obfuscate client side javascript that is being served in a browser you should get banned from the internet

I'm curious. Could you explain why you feel this way?

I can understand the desire to be able to vet code that a website wants to run on your device. I don't see why that preference should create an imperative for websites to either accommodate you or be banned from the internet.

Re: JavaScript Obfuscation Techniques by Example

#28

Post by abirch »

etamponi wrote: post #8

Sorry for the slightly offtopic question: this page caused Chrome on my mobile phone to freeze completely. I had to reboot my phone, and even after that, I had to figure out a way to close the tab without opening Chrome. Did it happen to someone else?

Although I won't ship you my phone, it worked on 103.0.5060.71 chrome on Android

Re: JavaScript Obfuscation Techniques by Example

#29

Post by melissalobos »

Animats wrote: post #26

You want to see obfusication? Check out FreeSlots.com. Look at view source on one of the slot machines.[1] Can anyone decode this and figure out the odds generator? [1] view-source: https://www.freeslots.com/slot515.min.js?v=84

To answer your question, yes. Someone absolutely can decode that and figure out the odds. If they couldn't then there would be less obfuscation used. A browser ABSOLUTELY has to be able to run the javascript. Anyone dedicated enough can de-compile that javascript to a program. Is it easy? No, but people do it all the time.

I have had to deal with client that thought they could keep some bit of code secret on a browser before. I have had to explain many many times that anything the browser can do a human can do. So if a browser can run the code, at some point a human can too.

Re: JavaScript Obfuscation Techniques by Example

#30

Post by throwntoday »

melissalobos wrote: post #29
Animats wrote: post #26

You want to see obfusication? Check out FreeSlots.com. Look at view source on one of the slot machines.[1] Can anyone decode this and figure out the odds generator? [1] view-source: https://www.freeslots.com/slot515.min.js?v=84

To answer your question, yes. Someone absolutely can decode that and figure out the odds. If they couldn't then there would be less obfuscation used. A browser ABSOLUTELY has to be able to run the javascript. Anyone dedicated enough can de-compile that javascript to a program. Is it easy? No, but people do it all the time. I have had to deal with client that thought they could keep some bit of code secret on a browse…

I think what the parent meant was, can someone looking at it decode what is going on. Not asking whether it is possible in general.
Post reply on HN