A technique for hiding your JavaScript code • Hacker News Board

Re: A technique for hiding your JavaScript code

#21

Post by sp332 » Mon, Jul 30, 2012, 1:47 PM UTC

barefoot wrote: post #17

maebert wrote: post #2

Bonus points for not just creating an image, but hiding the code steganographically in an existing image (ie only using the LSB of each pixel to hide code)!

Comments should make it fairly straightforward to accomplish: function foo() { /* ...characters for image data... / bar(); / ...more image data... */ The asterisks are not showing up but you get the idea. It checks out with the comments part of the javascript spec as well: http://ecma-international.org/ecma-262/5.1/#sec-7.4 ...as the text inside the comment can be any unicode code unit except for an asterisk (For sou…

If you want asterisks to show up, * put a space on both sides.

  If you want to do something *f*a*n*c*y* put two spaces
  at the front of the line, it will show up verbatim
  including line breaks.

Re: A technique for hiding your JavaScript code

#22

Post by sisk » Mon, Jul 30, 2012, 2:26 PM UTC

This is the exact same process used by http://hid.im to encode a torrent file into a PNG (not for obfuscation, mind you).

Re: A technique for hiding your JavaScript code

#23

Post by darkstalker » Mon, Jul 30, 2012, 2:34 PM UTC

This might be useful as a way to reduce your code size using the image's compression algorithm

Re: A technique for hiding your JavaScript code

#24

Post by mistercow » Mon, Jul 30, 2012, 2:36 PM UTC

>My JS code is an array of characters, a character has an ASCII code which lies in the range from 0 to 255

Your JS code may happen to be ASCII only, but in the context of ECMAScript, a character is actually a Unicode code unit.

Re: A technique for hiding your JavaScript code

#25

Post by amitparikh » Mon, Jul 30, 2012, 2:40 PM UTC

darkstalker wrote: post #23

This might be useful as a way to reduce your code size using the image's compression algorithm

Maybe, but obviously we would need loss-less compression. And the current web standards like gzip are optimized and perfectly suited for "text-like" loss-less compression, so it seems a little pointless to apply any image-optimized loss-less compression.

Re: A technique for hiding your JavaScript code

#26

Post by mistercow » Mon, Jul 30, 2012, 2:45 PM UTC

darkstalker wrote: post #23

This might be useful as a way to reduce your code size using the image's compression algorithm

Modern servers and browsers support the DEFLATE algorithm for compressing over HTTP, which is the same algorithm as PNG. The only difference is that PNG preprocesses with a predictor to exploit row-to-row correlations in an image. Since the assumptions of that predictor are less likely to be sound with JavaScript code than with practical image data, and since lossless compression is a zero-sum game, PNG will perform worse than plain old DEFLATE on average for JS code.

Re: A technique for hiding your JavaScript code

#27

Post by RoryH » Mon, Jul 30, 2012, 3:15 PM UTC

If you are willing to use HTML5 'magic', could you not stream the JS down via a web socket and then execute it? That would prevent most of the conventional HTTP intercepts from having access to the code.

Re: A technique for hiding your JavaScript code

#28

Post by freditup » Mon, Jul 30, 2012, 3:26 PM UTC

tagawa wrote: post #15

MatthewPhillips wrote: post #12

Earlier quoted context omitted.

"Developer tools" is the new View Source. Browsers should really just redirect View Source to the live DOM view of their developer tools, that's what most people want from it.

Maybe, but there's still a lot of value in being able to see pre-rendered code so I wouldn't go as far as a redirect. Somehow combining the two could be a good option.

I like having them both personally. I'll normally use the page inspector for most things, but I like to see the raw HTML I'm producing from a web app too, along with the CSS and JS tags, etc.

Re: A technique for hiding your JavaScript code

#29

Post by leephillips » Mon, Jul 30, 2012, 3:41 PM UTC

noarchy wrote: post #19

If someone is clever enough to hide their JavaScript like this, then they hopefully know that it isn't foolproof. In other words, don't rely on obfuscating your code for anything related to security (as an example).

Did you read to the bottom? He knows it doesn't really hide the code. He's just having fun and slowing down the lowest level of code-stealers.

Re: A technique for hiding your JavaScript code

#30

Post by misterbwong » Mon, Jul 30, 2012, 4:21 PM UTC

tagawa wrote: post #8

I can't help but feel saddened that we learned how to code using View Source (indeed, it's a big factor in the web's success) and now we're trying to prevent others doing the same. Also, this seems like a surprisingly naive generalisation to me: "... a first measurement for preventing evil business guys from stealing your code – developers who can figure the code out are (mostly) kind enough not to steal it."

The author has replied with the edit:

ADD: Jeez, don’t get me wrong, I’m not really trying to hide my code from anyone, I actually love writing open source software, it was just a fun idea to do this experiment :)