4 ms·

I started this issue a long time ago, and it's been frozen since: https://github.com/electron/electron/issues/3041 https://github.com/electron/electron/issues/3

I started this issue a long time ago, and it's been frozen since: https://github.com/electron/electron/issues/3041 https://github.com/electron/electron/issues/3041 Maybe now we can have actual source code protection?

merkaloid 10y ago
if you want to protect your source code, don't use Javascript.
- fnord123 10y ago
  I guess "source code protection" is for distributing plugins for Atom without distributing the source so the code isn't accessible. So I would call this "source code concealing". In any event, this could be done with WASM.
  - penagwin 10y ago
    I actually needed this with it's framework electron. Unfortunately I haven't yet found a method of compiling coffeescript (or javascript) with WASM. I'm just asking for concealing against my licensing code from being in a text file.
- MichaelGG 10y ago
  >don't distribute your programs That's what it really comes down to. From what I can see, it's mostly an emotional response. I'd be surprised if code/binary obfuscation is a net win in general. I've had to disabuse developers of this idea. One distributed binaries that weren't quite valid but ran on the CLR, though not Mono. A 10 line script was enough to remove the invalid sequences. What did the developer gain in this case? An extra build step, undoubtedly more than one bug, and in the end, no "protection".
  - penagwin 10y ago
    I agree with the idea that anything can be reverse engineered. However electron by default has plain text javascript code. I'd like to prevent people from editing plain text (!!!) to evade my licensing check!
    - porpoisemonkey 10y ago
      For what it's worth I agree with the Electron dev's decision to close the ticket. They don't seem to have the same use case as you and are under no obligation to support it. There's also the unstated issue of ongoing support for the feature. If they put in code obfuscation they'll be obligated to make sure that it provides adequate protections to avoid a deluge of "someone hacked my obfuscated code" type tickets. What constitutes "adequate protections" will have to be updated over time as more advanced techniques are discovered for reversing out the code. Combined with the performance drops that were clearly outlined by the Electron devs it would seem like a code obfuscation feature could be a really big waste of time.
    - MichaelGG 10y ago
      Perhaps try hosting a page with a crack or serial for your product and see if there's significant usage in the first place? My guess is people are more worried about this than it warrants. A user of professional tools opting to edit the source code of a tool every time it updates seems like they might not be a paying customer in the first place.
- penagwin 10y ago
  I like javascript. It makes development faster. I'd like to prevent people from editing plain text (!!!) to evade my licensing check!
phn 10y ago
Is compiling to WebAssembly an option to you? Better than relying on memory snapshots.
- penagwin 10y ago
  I haven't heard of a method of compiling Coffeescript or Javascript with WebAssembly? Have I missed something? Really I just want my licensing code to not be in a text file so people can't just load up notepad to evade it.
michaelmrose 10y ago
Why do you consider it valuable to give people an application and make it harder to debug when it crashes or misbehaves?
- penagwin 10y ago
  Because the end user shouldn't have any debug access, only the developer. Errors should be handled in application. In worst case (total exit of process from an error) Most people don't have error handling anyway. (And I don't want the only tool required to evade the license check to be notepad + asar)

merkaloid 10y ago

if you want to protect your source code, don't use Javascript.

fnord123 10y ago
I guess "source code protection" is for distributing plugins for Atom without distributing the source so the code isn't accessible. So I would call this "source code concealing". In any event, this could be done with WASM.
- penagwin 10y ago
  I actually needed this with it's framework electron. Unfortunately I haven't yet found a method of compiling coffeescript (or javascript) with WASM. I'm just asking for concealing against my licensing code from being in a text file.
MichaelGG 10y ago
>don't distribute your programs That's what it really comes down to. From what I can see, it's mostly an emotional response. I'd be surprised if code/binary obfuscation is a net win in general. I've had to disabuse developers of this idea. One distributed binaries that weren't quite valid but ran on the CLR, though not Mono. A 10 line script was enough to remove the invalid sequences. What did the developer gain in this case? An extra build step, undoubtedly more than one bug, and in the end, no "protection".
- penagwin 10y ago
  I agree with the idea that anything can be reverse engineered. However electron by default has plain text javascript code. I'd like to prevent people from editing plain text (!!!) to evade my licensing check!
  - porpoisemonkey 10y ago
    For what it's worth I agree with the Electron dev's decision to close the ticket. They don't seem to have the same use case as you and are under no obligation to support it. There's also the unstated issue of ongoing support for the feature. If they put in code obfuscation they'll be obligated to make sure that it provides adequate protections to avoid a deluge of "someone hacked my obfuscated code" type tickets. What constitutes "adequate protections" will have to be updated over time as more advanced techniques are discovered for reversing out the code. Combined with the performance drops that were clearly outlined by the Electron devs it would seem like a code obfuscation feature could be a really big waste of time.
  - MichaelGG 10y ago
    Perhaps try hosting a page with a crack or serial for your product and see if there's significant usage in the first place? My guess is people are more worried about this than it warrants. A user of professional tools opting to edit the source code of a tool every time it updates seems like they might not be a paying customer in the first place.
penagwin 10y ago
I like javascript. It makes development faster. I'd like to prevent people from editing plain text (!!!) to evade my licensing check!

phn 10y ago

Is compiling to WebAssembly an option to you? Better than relying on memory snapshots.

penagwin 10y ago
I haven't heard of a method of compiling Coffeescript or Javascript with WebAssembly? Have I missed something? Really I just want my licensing code to not be in a text file so people can't just load up notepad to evade it.

michaelmrose 10y ago

Why do you consider it valuable to give people an application and make it harder to debug when it crashes or misbehaves?

penagwin 10y ago
Because the end user shouldn't have any debug access, only the developer. Errors should be handled in application. In worst case (total exit of process from an error) Most people don't have error handling anyway. (And I don't want the only tool required to evade the license check to be notepad + asar)