4 ms·

As laudable as the goal of improving performance is, I hope this never takes off. Why? Because it will take about 5 minutes from 90% of the web to go from open,

by zmmmmm 11y ago

As laudable as the goal of improving performance is, I hope this never takes off. Why? Because it will take about 5 minutes from 90% of the web to go from open, transparent, easily reverse engineerable source code to essentially giant blobs of secret binary code. People will pay lip service to performance but 99% of the reason that web sites will implement this will be to cover up their code, keep secret their implementation techniques and technologies, hide poor code and poor security. I honestly think that one of the key ingredients to the success of the web is that just about any web page you can see, just about anyone with modest knowledge can trivially work out how it was done. It is only an accident of history that it worked out that way. But the effect has been to spread knowledge far and wide and it has greatly contributed to the success of web technologies. Furthermore, I can easily look at the source code for my bank web site or any web site I want to trust and get a good idea of how solid their implementation is. Yes I can't inspect the back end, but a whole slice of front-end security issues are easy for me to check for myself. This kind of scrutiny will get a good bit harder if web assembly becomes adopted.

asdfologist 11y ago
https://github.com/WebAssembly/design/blob/master/TextFormat.md https://github.com/WebAssembly/design/blob/master/TextFormat...
luhn 11y ago
> I honestly think that one of the key ingredients to the success of the web is that just about any web page you can see, just about anyone with modest knowledge can trivially work out how it was done. Not really. Almost all websites obfuscate/minify their Javascript now, making manually interpreting the code much less than "trivial." I think WebAssembly will be no worse to figure out than obfuscated Javascript.
- zmmmmm 11y ago
  I think it will be much worse. Minified Javascript is pretty easy to turn back into something moderately understandable just by "prettifying" it. I do this all the time. It works pretty well because it started as Javascript, so turning it back into Javascript has a relatively clean mapping. WebAssembly will have started as some other language or even as no language at all - there may be no mapping back to anything Javascript could represent. It will be much closer to disassembly of machine code, or Java byte code, which is possible but challenging enough that most ordinary developers never do it.
  - sciurus 11y ago
    True, but this is already happening with asm.js. Is webassembly any more objectionable than that? Instead of causing existing applications to further obfuscate their code, it seems to be bringing new types of applications to the browser.
  - netheril96 11y ago
    I think WebAssembly will be much closer to Java byte code than actual machine assembly. And Java byte code can be easily decompiled into readable Java code (at least as readable as minified Javascript).
  - dockimbel 11y ago
    A polyfill to Javascript is already planned. https://github.com/WebAssembly/design/blob/master/Polyfill.md https://github.com/WebAssembly/design/blob/master/Polyfill.m...
  - frame_perfect 11y ago
    That's exactly why we have the free software movement.
  - devsquid 11y ago
    its built into the spec of WASM for it to be able to be "prettified" as well. I imagine it'd do about as good of a job as current prettifying of minified JS. "The WebAssembly text format, which is designed to be read and written when using tools (e.g., assemblers, debuggers, profilers), is specified as a textual projection of a module's AST." This is apart of the MVP even. I think the authors of WASM actually agree with your opinions here and are working to a system that satisfies that concern. BTW taken from, https://github.com/WebAssembly/design/blob/master/MVP.md https://github.com/WebAssembly/design/blob/master/MVP.md
    - zmmmmm 11y ago
      > I think the authors of WASM actually agree with your opinions here and are working to a system that satisfies that concern That's very reassuring - I hope it works out that way.
13years 11y ago
Yet, isn't much of the web already unreadable due to minification of JS source?
- Mikushi 11y ago
  If you think minification does anything to prevent anyone from reading it you are mistaken. Is it harder? Yes. Impossible, not even close, just annoying. I've reversed engineer JS libraries with 20K LOC that were minified and uglified in less than a day, hardly what I consider a hurdle. Now, to have worked with asm.js recently, that's a whole different ball game. That is unreadable, at least without spending copious amounts of time on it and having a deep understanding of asm.js to be able to read it.
  - Touche 11y ago
    What do you get out of reading some random website's minified javascript?
    - tracker1 11y ago
      Sometimes it's just the curiuosity of "how did they do that?" In general, one doesn't go around looking at the code everywhere, but on more than one occassion I've looked into something to figure out how something was done, or why it's broken in my browser (much more common in early Firebird^b^b^b^bfox). On the one hand, I hope it gives a real build target for Rust and Go... on the other, I hope things don't get too obfuscated in practice.
  - 13years 11y ago
    When we are talking about browsing code for the purpose of leisure curiosity and learning, yes it is a real hurdle.
  - azakai 11y ago
    WebAssembly will be a lot more readable than asm.js - that's a specific goal, in fact. It is true that it will still be lower-level than JS. But it remains in a structured AST format which is easy to pretty-print. And many of the worst patterns you see a lot in asm.js just won't be there.
robbrown451 11y ago
I don't see how obfuscated javascript is a lot easier to reverse engineer than webassembly binaries will be. You really scrutinize your bank's javascript for security issues? Really? I have a hard time believing that.
yummybear 11y ago
Fair enough that it's very nice for a tiny portion of web users to be able to reverse engineer code, but WA might increase performance for 100% of web users.
xixixao 11y ago
I think the argument of "anyone can figure out how it's done" is moot (as pointed out by many). But there is a significant change here: with Javascript or even ASM I can always take parts of someone's code and use it for my purposes. This means that developers are forced to think about security and business models in a specific way. With WebAssembly, we might lose that, as you pointed out. And that is a real issue.
pjmlp 11y ago
You are assuming that web sites have any meaningfull code done in JavaScript. Many outside the HN web bubble are still plain HTML/CSS sites with almost everything done server side.
jitix 11y ago
IMHO there is nothing wrong with hiding the source code. Infact it will save a lot of time for developers who do UI 'builds' in order to obfuscate or minify their js code. Binary webpage code was long due.
manigandham 11y ago
We will instantly have tools to decompile this stuff so it will look just as good if not even better than what you get when formatting minified javascript today. In fact pick any language today that compiles output and you will find decompiling tools made for it, including the original compiled web stuff like Flash and Silverlight. I'd much rather the web get faster for everyone than save a few people some time when deconstructing.

by zmmmmm 11y ago

asdfologist 11y ago

https://github.com/WebAssembly/design/blob/master/TextFormat.md https://github.com/WebAssembly/design/blob/master/TextFormat...

luhn 11y ago

> I honestly think that one of the key ingredients to the success of the web is that just about any web page you can see, just about anyone with modest knowledge can trivially work out how it was done. Not really. Almost all websites obfuscate/minify their Javascript now, making manually interpreting the code much less than "trivial." I think WebAssembly will be no worse to figure out than obfuscated Javascript.

zmmmmm 11y ago
I think it will be much worse. Minified Javascript is pretty easy to turn back into something moderately understandable just by "prettifying" it. I do this all the time. It works pretty well because it started as Javascript, so turning it back into Javascript has a relatively clean mapping. WebAssembly will have started as some other language or even as no language at all - there may be no mapping back to anything Javascript could represent. It will be much closer to disassembly of machine code, or Java byte code, which is possible but challenging enough that most ordinary developers never do it.
- sciurus 11y ago
  True, but this is already happening with asm.js. Is webassembly any more objectionable than that? Instead of causing existing applications to further obfuscate their code, it seems to be bringing new types of applications to the browser.
- netheril96 11y ago
  I think WebAssembly will be much closer to Java byte code than actual machine assembly. And Java byte code can be easily decompiled into readable Java code (at least as readable as minified Javascript).
- dockimbel 11y ago
  A polyfill to Javascript is already planned. https://github.com/WebAssembly/design/blob/master/Polyfill.md https://github.com/WebAssembly/design/blob/master/Polyfill.m...
- frame_perfect 11y ago
  That's exactly why we have the free software movement.
- devsquid 11y ago
  its built into the spec of WASM for it to be able to be "prettified" as well. I imagine it'd do about as good of a job as current prettifying of minified JS. "The WebAssembly text format, which is designed to be read and written when using tools (e.g., assemblers, debuggers, profilers), is specified as a textual projection of a module's AST." This is apart of the MVP even. I think the authors of WASM actually agree with your opinions here and are working to a system that satisfies that concern. BTW taken from, https://github.com/WebAssembly/design/blob/master/MVP.md https://github.com/WebAssembly/design/blob/master/MVP.md
  - zmmmmm 11y ago
    > I think the authors of WASM actually agree with your opinions here and are working to a system that satisfies that concern That's very reassuring - I hope it works out that way.

13years 11y ago

Yet, isn't much of the web already unreadable due to minification of JS source?

Mikushi 11y ago
If you think minification does anything to prevent anyone from reading it you are mistaken. Is it harder? Yes. Impossible, not even close, just annoying. I've reversed engineer JS libraries with 20K LOC that were minified and uglified in less than a day, hardly what I consider a hurdle. Now, to have worked with asm.js recently, that's a whole different ball game. That is unreadable, at least without spending copious amounts of time on it and having a deep understanding of asm.js to be able to read it.
- Touche 11y ago
  What do you get out of reading some random website's minified javascript?
  - tracker1 11y ago
    Sometimes it's just the curiuosity of "how did they do that?" In general, one doesn't go around looking at the code everywhere, but on more than one occassion I've looked into something to figure out how something was done, or why it's broken in my browser (much more common in early Firebird^b^b^b^bfox). On the one hand, I hope it gives a real build target for Rust and Go... on the other, I hope things don't get too obfuscated in practice.
- 13years 11y ago
  When we are talking about browsing code for the purpose of leisure curiosity and learning, yes it is a real hurdle.
- azakai 11y ago
  WebAssembly will be a lot more readable than asm.js - that's a specific goal, in fact. It is true that it will still be lower-level than JS. But it remains in a structured AST format which is easy to pretty-print. And many of the worst patterns you see a lot in asm.js just won't be there.

robbrown451 11y ago

I don't see how obfuscated javascript is a lot easier to reverse engineer than webassembly binaries will be. You really scrutinize your bank's javascript for security issues? Really? I have a hard time believing that.

yummybear 11y ago

Fair enough that it's very nice for a tiny portion of web users to be able to reverse engineer code, but WA might increase performance for 100% of web users.

xixixao 11y ago

I think the argument of "anyone can figure out how it's done" is moot (as pointed out by many). But there is a significant change here: with Javascript or even ASM I can always take parts of someone's code and use it for my purposes. This means that developers are forced to think about security and business models in a specific way. With WebAssembly, we might lose that, as you pointed out. And that is a real issue.

pjmlp 11y ago

You are assuming that web sites have any meaningfull code done in JavaScript. Many outside the HN web bubble are still plain HTML/CSS sites with almost everything done server side.

jitix 11y ago

IMHO there is nothing wrong with hiding the source code. Infact it will save a lot of time for developers who do UI 'builds' in order to obfuscate or minify their js code. Binary webpage code was long due.

manigandham 11y ago

We will instantly have tools to decompile this stuff so it will look just as good if not even better than what you get when formatting minified javascript today. In fact pick any language today that compiles output and you will find decompiling tools made for it, including the original compiled web stuff like Flash and Silverlight. I'd much rather the web get faster for everyone than save a few people some time when deconstructing.