5 ms·

This is insane. How much time did they put in to this pointless obfuscation, and then why would they go and document it all?

jonknee 8y ago
I would guess "management", probably under the name of Homeland Security. It seems to be some spaghetti code of loops/callbacks written by a frustrated jQuery developer. Here are some more fun tidbits: > /MasterZoom is the sum of the zoom levels from the routes_list.json file. That is the index in the routesList.v.json -> arr array where we have the public key stored. IF THE ROUTES_LIST CHANGES, REMEMBER TO CHANGE THE INDEX TO BE CORRECT / > /Salt Value - the element is at the 8th position. So we can essentially pick any number from 0-100 (length of the s array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 8. Salt has a length of 8 / > /Initialization Vector Value - the element is at the 32th position. So we can essentially pick any number from 0-100 (length of the IV array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 32 - IV has a length of 32 / And my favorite: > masterSegment - length of data to be extracted from the encrypted response - 55 is just a fake //FAKE VARIABLES to throw off people hahahahaha
- AdamJacobMuller 8y ago
  "Homeland Security"... and i'm on another list. Great.
kingbirdy 8y ago
I'd imagine it's something like company policy says it has to obfuscated, but the guy actually programming the site realizes it's pointless and fellow hackers could make good use of the data.
gsnedders 8y ago
Alternatively, all the comments were meant to be stripped out in some build stage.
chris0x00 8y ago
IANAL and things may have changed, but it was my understanding that having a copy protection mechanism, even a simple one, gives them better claim to DMCA protection of their content should someone do something they'd like to discourage. "Your honor they read our source code and stole our private key to break the encryption of our protected data" sounds better than "they downloaded the data we gave them"
- jonknee 8y ago
  It's all pretty ridiculous considering it's a government owned corporation. They should not be obfuscating anything.
kirykl 8y ago
Maybe it’s another layer of misdirection
reustle 8y ago
While everyone here is thinking Amtrak implemented the copy protection, this map was actually built using CartoDB. I honestly just think it's something it includes by default. https://carto.com/ https://carto.com/
- gregsadetsky 8y ago
  The mapping engine is CartoDB, but I (seriously) doubt that this copy protection was implemented by them. They're much more serious & better at writing good code. You can also see that the encrypted data stream is coming from https://maps.amtrak.com/services/MapDataService/trains/getTrainsData https://maps.amtrak.com/services/MapDataService/trains/getTr... which is an Amtrak-hosted backend service. If you look at the top comment in https://www.amtrak.com/services/maps.trainlocation.html https://www.amtrak.com/services/maps.trainlocation.html you'll see the name of the consultant that probably worked on this.

jonknee 8y ago

I would guess "management", probably under the name of Homeland Security. It seems to be some spaghetti code of loops/callbacks written by a frustrated jQuery developer. Here are some more fun tidbits: > /MasterZoom is the sum of the zoom levels from the routes_list.json file. That is the index in the routesList.v.json -> arr array where we have the public key stored. IF THE ROUTES_LIST CHANGES, REMEMBER TO CHANGE THE INDEX TO BE CORRECT / > /Salt Value - the element is at the 8th position. So we can essentially pick any number from 0-100 (length of the s array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 8. Salt has a length of 8 / > /Initialization Vector Value - the element is at the 32th position. So we can essentially pick any number from 0-100 (length of the IV array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 32 - IV has a length of 32 / And my favorite: > masterSegment - length of data to be extracted from the encrypted response - 55 is just a fake //FAKE VARIABLES to throw off people hahahahaha

AdamJacobMuller 8y ago
"Homeland Security"... and i'm on another list. Great.

kingbirdy 8y ago

I'd imagine it's something like company policy says it has to obfuscated, but the guy actually programming the site realizes it's pointless and fellow hackers could make good use of the data.

gsnedders 8y ago

Alternatively, all the comments were meant to be stripped out in some build stage.

chris0x00 8y ago

IANAL and things may have changed, but it was my understanding that having a copy protection mechanism, even a simple one, gives them better claim to DMCA protection of their content should someone do something they'd like to discourage. "Your honor they read our source code and stole our private key to break the encryption of our protected data" sounds better than "they downloaded the data we gave them"

jonknee 8y ago
It's all pretty ridiculous considering it's a government owned corporation. They should not be obfuscating anything.

kirykl 8y ago

Maybe it’s another layer of misdirection

reustle 8y ago

While everyone here is thinking Amtrak implemented the copy protection, this map was actually built using CartoDB. I honestly just think it's something it includes by default. https://carto.com/ https://carto.com/

gregsadetsky 8y ago
The mapping engine is CartoDB, but I (seriously) doubt that this copy protection was implemented by them. They're much more serious & better at writing good code. You can also see that the encrypted data stream is coming from https://maps.amtrak.com/services/MapDataService/trains/getTrainsData https://maps.amtrak.com/services/MapDataService/trains/getTr... which is an Amtrak-hosted backend service. If you look at the top comment in https://www.amtrak.com/services/maps.trainlocation.html https://www.amtrak.com/services/maps.trainlocation.html you'll see the name of the consultant that probably worked on this.