6 ms·

I am curious about the possibility of this leading to source code protection in Electron. The Electron team declined to support source code protection, judging

I am curious about the possibility of this leading to source code protection in Electron. The Electron team declined to support source code protection, judging it too difficult to implement. [0] NW.js supports the feature but with severe limitations that the Electron team understandably did not want to replicate. [1] Roger Wang of NW.js fame recently tweeted that the NW.js implementation is about to get a whole lot better due to this new compiler landing in V8. [2] Could this new development in V8 put source code protection back on the table for Electron? I posted this question to the official Electron discussion forums too a few days back, but I'd be curious to hear more input on the topic, thus posting it here as well. [3] [0]: https://github.com/electron/electron/issues/3041 https://github.com/electron/electron/issues/3041 [1]: https://github.com/nwjs/nw.js/wiki/protect-javascript-source-code-with-v8-snapshot https://github.com/nwjs/nw.js/wiki/protect-javascript-source... [2]: https://twitter.com/wwr/status/831691865850130432 https://twitter.com/wwr/status/831691865850130432 [3]: https://discuss.atom.io/t/source-code-protection-via-new-v8-compiler/39533 https://discuss.atom.io/t/source-code-protection-via-new-v8-...

bastawhiz 10y ago
You'll always be able to decompile electron (and other JS) apps. As the problem becomes more common, better tools will be available and any "protection" will be moot. Source code protection amounts to bad DRM, and I should hope it doesn't need to explained on HN the ways DRM doesn't work.
- kethinov 10y ago
  My understanding is that the proposals being bandied about to do source code protection involve compiling the JS code into binary, so it's analogous to the protection offered by writing native code rather than mere minification/obfuscation or JIT bytecode stuff. Obviously no compilation process offers 100% protection, but it would be enough for most people's purposes if it occupied a space that was more secure (or more obfuscated) than Java, but less so than, say, C++.
  - penagwin 10y ago
    Disclaimer: I started that github issue for source code protection with Electron. To add to this since other people will come commenting, yes I know that if somebody REALLY wants to they can get to the code (although I'd argue that Denuvo worked for a while). However there is a huge difference between having hard to read code that needs to be decompiled and unobfuscated to code that is in plain text! Any script kiddy can modify any electron application (The code is in freaking text files!).
    - kuschku 10y ago
      > Any script kiddy can modify any electron application (The code is in freaking text files!). And what's so bad about that? The copyright law of the EU even was written with the intention that someday everyone would have the source code to everything, and everyone — even your grandparents — could modify any application, because the source would be in freaking text files!
      - theprotocol 10y ago
        Every project has different requirements. It's not for you to say whether something is good or not for others. I don't mean to sound like a prick, but while I personally love open source, I tire of the evangelism of its virtues.
        kuschku 10y ago
        So, you’re advocating that you should be able to sell products that are impossible to repair, impossible to modify, with 0 days warranty period, and then expect people to accept that? I’m sorry, but there’s a reason we don’t allow that for physical things either. > Every project has different requirements. That might be. But that doesn’t change the problem I mentioned above.
        theprotocol 10y ago
        Yes, you should be able to create any kind of product you want as long as it's within the law. You're not the authority on what constitutes a problem. It's certainly debatable and far from settled, contrary to the definitive character of your indignation. And it's far more nuanced than your ungenerous characterization of it - this is part product, part intellectual property. What's great is you are free to exercise your philosophy in your products, and if you're right, then that will make your products superior. I don't feel the need to utterly destroy my ideological "enemies" to the point that I need closed source software to die, just because I believe in open source. Nor can I claim to have an indisputable moral high ground that just goes without saying.
saurik 10y ago
I don't understand why this change would have anything at all to do with source code obfuscation. Can you explain why this is related? Are you hoping the new architecture exposes some kind of intermediate representation to the front end which would be stable enough for something like Electron to serialize?
- kethinov 10y ago
  See the tweet from Roger Wang. He implied that Ignition and Turbofan will dramatically improve the source code protection feature already present in NW.js by removing the need for many of the painful compromises that make it work today. My main question is whether or not it is likely the Electron team will agree with this assessment and consider supporting the feature as well.
sedachv 10y ago
Source code protection is a horrible idea and antithesis to what has made JavaScript work so far. Source-code-only is the future of software distribution. One of my long-term goals involves building a new dynamic language runtime - the plan is no ABI and AGPL licensing to only allow Free Software to use the runtime.

bastawhiz 10y ago

You'll always be able to decompile electron (and other JS) apps. As the problem becomes more common, better tools will be available and any "protection" will be moot. Source code protection amounts to bad DRM, and I should hope it doesn't need to explained on HN the ways DRM doesn't work.

kethinov 10y ago
My understanding is that the proposals being bandied about to do source code protection involve compiling the JS code into binary, so it's analogous to the protection offered by writing native code rather than mere minification/obfuscation or JIT bytecode stuff. Obviously no compilation process offers 100% protection, but it would be enough for most people's purposes if it occupied a space that was more secure (or more obfuscated) than Java, but less so than, say, C++.
- penagwin 10y ago
  Disclaimer: I started that github issue for source code protection with Electron. To add to this since other people will come commenting, yes I know that if somebody REALLY wants to they can get to the code (although I'd argue that Denuvo worked for a while). However there is a huge difference between having hard to read code that needs to be decompiled and unobfuscated to code that is in plain text! Any script kiddy can modify any electron application (The code is in freaking text files!).
  - kuschku 10y ago
    > Any script kiddy can modify any electron application (The code is in freaking text files!). And what's so bad about that? The copyright law of the EU even was written with the intention that someday everyone would have the source code to everything, and everyone — even your grandparents — could modify any application, because the source would be in freaking text files!
    - theprotocol 10y ago
      Every project has different requirements. It's not for you to say whether something is good or not for others. I don't mean to sound like a prick, but while I personally love open source, I tire of the evangelism of its virtues.
      - kuschku 10y ago
        So, you’re advocating that you should be able to sell products that are impossible to repair, impossible to modify, with 0 days warranty period, and then expect people to accept that? I’m sorry, but there’s a reason we don’t allow that for physical things either. > Every project has different requirements. That might be. But that doesn’t change the problem I mentioned above.
        theprotocol 10y ago
        Yes, you should be able to create any kind of product you want as long as it's within the law. You're not the authority on what constitutes a problem. It's certainly debatable and far from settled, contrary to the definitive character of your indignation. And it's far more nuanced than your ungenerous characterization of it - this is part product, part intellectual property. What's great is you are free to exercise your philosophy in your products, and if you're right, then that will make your products superior. I don't feel the need to utterly destroy my ideological "enemies" to the point that I need closed source software to die, just because I believe in open source. Nor can I claim to have an indisputable moral high ground that just goes without saying.

saurik 10y ago

I don't understand why this change would have anything at all to do with source code obfuscation. Can you explain why this is related? Are you hoping the new architecture exposes some kind of intermediate representation to the front end which would be stable enough for something like Electron to serialize?

kethinov 10y ago
See the tweet from Roger Wang. He implied that Ignition and Turbofan will dramatically improve the source code protection feature already present in NW.js by removing the need for many of the painful compromises that make it work today. My main question is whether or not it is likely the Electron team will agree with this assessment and consider supporting the feature as well.

sedachv 10y ago

Source code protection is a horrible idea and antithesis to what has made JavaScript work so far. Source-code-only is the future of software distribution. One of my long-term goals involves building a new dynamic language runtime - the plan is no ABI and AGPL licensing to only allow Free Software to use the runtime.