7 ms·

Is there a way to compile javascript in web-assembly, to protect the source code? IE, you'd have to convert the javascript to C, and then compile the C into we

Is there a way to compile javascript in web-assembly, to protect the source code? IE, you'd have to convert the javascript to C, and then compile the C into web-assembly, right? Does V8 have a method to convert JS to C?

slededit 9y ago
WASM doesn't have access to the DOM yet so it's unlikely your JS could would work anyways.
skybrian 9y ago
That's unlikely to be efficient and it wouldn't help much anyway. Running JavaScript through an optimizing compiler and minifier will obscure pretty much the same information. But either way, you can step through the code in your browser's debugger to see what it does.
- dangerbird2 9y ago
  Also, wasm is a fairly high-level bytecode, more comparable to jvm or llvm code than arm or x86 code. It's pretty easy to follow the logic of disassembled web assembly
justinpombrio 9y ago
If you just want to obfuscate your JavaScript, there's nothing to be gained by compiling to a different language. There are already plenty of JS->JS obfuscation libraries that work well.
_greim_ 9y ago
No. wasm needs to be able to interact with the DOM and other web APIs, which I understand isn't the case currently. Then you need hooks into GC. Although I guess nothing would stop you from embedding a JS runtime in your wasm blob, other than download size.
s-macke 9y ago
This repository compiles asm.js into webassembly [1]. Otherwise, you will have a hard time to convert your Javascript code. You have to implement a JIT compiler and GC too. Webassembly was never designed to be a replacement for JavaScript. And especially, it was never designed to protect your source code. A minimizer/obsfucator does a great job of making your JavaScript code unreadable. [1] https://github.com/WebAssembly/binaryen https://github.com/WebAssembly/binaryen
- baybal2 9y ago
  >And especially, it was never designed to protect your source code. I hardly get that, all and every major backer of WASM did effectively admit at some point that "ip protection" was the one and only reason they back it. The absence of a native dom interface or proper I/O implementation at this point means that WASM compiled code actually runs slower for everyday web apps than non-compiled code.
  - the_duke 9y ago
    > all and every major backer of WASM did effectively admit at some point that "ip protection" was the one and only reason they back it. I'm sure you wouldn't mind providing sources for this bold claim?
  - s-macke 9y ago
    I have looked at obsfucated JavaScript code as well as webassembly disassembly. I don't see much difference. What might obfuscate is the fact, that it comes without any libraries. You have to program like in C without any library support, which is more or less what you do with bare metal programming now.
icebraining 9y ago
Apparently http://enclosejs.com http://enclosejs.com can compile JS to regular binaries, but I don't know if there's any way of converting an ELF binary to wasm. You could always run a full emulator + kernel (using JSLinux) to run that binary :)
Schampu 9y ago
NW.js offers Javascript code protection [0] by allowing to distribute code in bytecode form. I just tested it yesterday and my code runs as fast as the original. [0] http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%20JavaScript%20Source%20Code/ http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%2...
kuschku 9y ago
> Is there a way to compile javascript in web-assembly, to protect the source code? This kind of obfuscation is harmful to the web, don’t do it. Also, any compsci student with a summer of free time can easily break it, so it’s useless, too. You’re just wasting your own time and the bandwidth and performance of your users. In fact, if you tell me what site you want to obfuscate your code on with WASM, I (an average compsci student) will spend my next summer reversing it, deobfuscating it, and publishing the results publicly (just to demonstrate you how useless your obfuscation is).
- danschumann 9y ago
  Is photoshop harmful to the web? Should they give away their source code? Their source code is what's valuable in their company. So, art programs kind of need source protection. I won't be making a web-version until this is the case. If you can crack NW.js source protection, let me know http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%20JavaScript%20Source%20Code/ http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%2...
  - kuschku 9y ago
    > Is photoshop harmful to the web? Photoshop isn't on the web, but I oppose closed source in principle. > Should they give away their source code? Ideally, yes. If you do it is still your decision, but you still should be aware that if you introduce truly new concepts, someone will clean-room reverse them, and publish them. > So, art programs kind of need source protection. The Krita project begs to differ. > I won't be making a web-version until this is the case. If you can crack NW.js source protection, let me know Then you shouldn't make any build where the business code runs on the client. Even native binaries can be reversed, their functionality analyzed, and copied. Which is how LibreOffice/OpenOffice originally discovered how to parse the Microsoft Office formats.
    - danschumann 9y ago
      It's possible, but not very ideal to have all the operations done on the server, and just serve interface stuff, maybe even as a streaming video, to the client. When people paint, they want it responsive, no stream lag, no server hiccups. I must allow people to install the software on their computer. I would still like to protect the work I've done, because I'm just one guy making software, and I don't have marketing money. What would stop big companies from taking my source and spending more on advertising? I need source protection.

slededit 9y ago

WASM doesn't have access to the DOM yet so it's unlikely your JS could would work anyways.

skybrian 9y ago

That's unlikely to be efficient and it wouldn't help much anyway. Running JavaScript through an optimizing compiler and minifier will obscure pretty much the same information. But either way, you can step through the code in your browser's debugger to see what it does.

dangerbird2 9y ago
Also, wasm is a fairly high-level bytecode, more comparable to jvm or llvm code than arm or x86 code. It's pretty easy to follow the logic of disassembled web assembly

justinpombrio 9y ago

If you just want to obfuscate your JavaScript, there's nothing to be gained by compiling to a different language. There are already plenty of JS->JS obfuscation libraries that work well.

_greim_ 9y ago

No. wasm needs to be able to interact with the DOM and other web APIs, which I understand isn't the case currently. Then you need hooks into GC. Although I guess nothing would stop you from embedding a JS runtime in your wasm blob, other than download size.

s-macke 9y ago

This repository compiles asm.js into webassembly [1]. Otherwise, you will have a hard time to convert your Javascript code. You have to implement a JIT compiler and GC too. Webassembly was never designed to be a replacement for JavaScript. And especially, it was never designed to protect your source code. A minimizer/obsfucator does a great job of making your JavaScript code unreadable. [1] https://github.com/WebAssembly/binaryen https://github.com/WebAssembly/binaryen

baybal2 9y ago
>And especially, it was never designed to protect your source code. I hardly get that, all and every major backer of WASM did effectively admit at some point that "ip protection" was the one and only reason they back it. The absence of a native dom interface or proper I/O implementation at this point means that WASM compiled code actually runs slower for everyday web apps than non-compiled code.
- the_duke 9y ago
  > all and every major backer of WASM did effectively admit at some point that "ip protection" was the one and only reason they back it. I'm sure you wouldn't mind providing sources for this bold claim?
- s-macke 9y ago
  I have looked at obsfucated JavaScript code as well as webassembly disassembly. I don't see much difference. What might obfuscate is the fact, that it comes without any libraries. You have to program like in C without any library support, which is more or less what you do with bare metal programming now.

icebraining 9y ago

Apparently http://enclosejs.com http://enclosejs.com can compile JS to regular binaries, but I don't know if there's any way of converting an ELF binary to wasm. You could always run a full emulator + kernel (using JSLinux) to run that binary :)

Schampu 9y ago

NW.js offers Javascript code protection [0] by allowing to distribute code in bytecode form. I just tested it yesterday and my code runs as fast as the original. [0] http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%20JavaScript%20Source%20Code/ http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%2...

kuschku 9y ago

> Is there a way to compile javascript in web-assembly, to protect the source code? This kind of obfuscation is harmful to the web, don’t do it. Also, any compsci student with a summer of free time can easily break it, so it’s useless, too. You’re just wasting your own time and the bandwidth and performance of your users. In fact, if you tell me what site you want to obfuscate your code on with WASM, I (an average compsci student) will spend my next summer reversing it, deobfuscating it, and publishing the results publicly (just to demonstrate you how useless your obfuscation is).

danschumann 9y ago
Is photoshop harmful to the web? Should they give away their source code? Their source code is what's valuable in their company. So, art programs kind of need source protection. I won't be making a web-version until this is the case. If you can crack NW.js source protection, let me know http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%20JavaScript%20Source%20Code/ http://docs.nwjs.io/en/latest/For%20Users/Advanced/Protect%2...
- kuschku 9y ago
  > Is photoshop harmful to the web? Photoshop isn't on the web, but I oppose closed source in principle. > Should they give away their source code? Ideally, yes. If you do it is still your decision, but you still should be aware that if you introduce truly new concepts, someone will clean-room reverse them, and publish them. > So, art programs kind of need source protection. The Krita project begs to differ. > I won't be making a web-version until this is the case. If you can crack NW.js source protection, let me know Then you shouldn't make any build where the business code runs on the client. Even native binaries can be reversed, their functionality analyzed, and copied. Which is how LibreOffice/OpenOffice originally discovered how to parse the Microsoft Office formats.
  - danschumann 9y ago
    It's possible, but not very ideal to have all the operations done on the server, and just serve interface stuff, maybe even as a streaming video, to the client. When people paint, they want it responsive, no stream lag, no server hiccups. I must allow people to install the software on their computer. I would still like to protect the work I've done, because I'm just one guy making software, and I don't have marketing money. What would stop big companies from taking my source and spending more on advertising? I need source protection.