Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript Obfuscation Techniques by Example

trickster.dev

Post reply on HN
Print view View original

11–20 of 75 posts

Re: JavaScript Obfuscation Techniques by Example

#11

Post by uwuemu »

etamponi wrote: post #8

Sorry for the slightly offtopic question: this page caused Chrome on my mobile phone to freeze completely. I had to reboot my phone, and even after that, I had to figure out a way to close the tab without opening Chrome. Did it happen to someone else?

Nope, but I can see the jsfuck example doing something like that as it kinda weirdly lagged on mine (android 12, chrome 103).

Re: JavaScript Obfuscation Techniques by Example

#12

Post by uwuemu »

Before someone asks why would you obfuscate, here's common use case: There's plenty of paid/proprietary Electron apps these days and they're not just websites, some of them do some heavy lifting under the hood and people want to protect that better than what Electron offers out of the box (read: nothing).

Re: JavaScript Obfuscation Techniques by Example

#13

Post by moritzwarhier »

muhehe wrote: post #4

Why obfuscate, when you can just follow modern trends and use webpack (or similar) which gives you completely unreadable shit.

That's because Webpack includes a minifier (Terser) by default when running in production mode (I think since version 5, which went a lot in the direction of convention-over-configuration). It is easy to disable if you want to.

Terser transforms non-global identifiers lexically and does some simple substitutions.

Normally you want to bundle modules with their dependencies anyway, maybe transpile code... Then why not minify?

Et voila, some completely unreadable shit.

Re: JavaScript Obfuscation Techniques by Example

#18

Post by jeroenhd »

etamponi wrote: post #8

Sorry for the slightly offtopic question: this page caused Chrome on my mobile phone to freeze completely. I had to reboot my phone, and even after that, I had to figure out a way to close the tab without opening Chrome. Did it happen to someone else?

Yes, actually. Works perfectly fine on Firefox but on both Chrome and Bromite it causes the browser to crash. My phone just let me kill the app after a few seconds but there's definitely something weird going on here.

Interesting, I have Bromite set up to disable JIT by default, so if it's because it weird JS, it's a bug in both the JIT engine and in the interpreter.

Edit: I doubt it's JS related because this site doesn't seem to use JS (unless there's some UA sniffing going on). I'm guessing this is a Chrome bug, hopefully not an exploitable one!

Android 11, Chrome 103.

Re: JavaScript Obfuscation Techniques by Example

#19

Post by iratewizard »

whatshisface wrote: post #5
ffhhj wrote: post #3

Why obfuscating JS when there is WASM?

Business people demand it to protect intellectual property without realizing the ease of reversing it / wanting to say they're doing something to protect IP that their own superior will not realize doesn't help. It is making the best of an impossible situation, the paradox of sending your code to every single customer for them to run it while also wishing nobody could see it. The more aggressive they make patent law…

With how mediocre most developers today are, obfuscation is enough.
Post reply on HN