4 ms·

Nice to see that interns seem to choose the topic they'd like to work on and feel like making really useful work! Pretty skeptical of the code obfuscator part.

Nice to see that interns seem to choose the topic they'd like to work on and feel like making really useful work! Pretty skeptical of the code obfuscator part. Even written from scratch this will not prevent people to deobfuscate it in the end.

esrauch 15y ago
It's not possible to reconstruct variable names that are replaced with arbitrary strings.
- thezilch 15y ago
  It would be possible to infer function and variable names, given enough thought.
- yid 15y ago
  You seem to have not heard of the field of software reverse-engineering. If you think obfuscated JS is hard to understand, keep in mind that people like DVD Jon typically reverse-engineer algorithms out of optimized assembly.
  - esrauch 15y ago
    You are completely making assumptions about who I am and what my comment means outside of what is literally there in the text of it. I never said you can't get algorithms out of obfuscated source, I said you can't get variable names. A lot of JS code ends up getting deployed with references to future planned unreleased features. Fairly simple code obfuscation works completely to hide that form of leak. See the leak about Facebook's future integration with some music service that came out from a javascript string without there literally being any functionality to go along with it, among a number of Google+ feature leaks that came out similarly. Obviously you can infer what the variable name might be, but you can't get the original variable name back. Was a variable count or counter? Index or i? In reality I just thought that "Even written from scratch this will not prevent people to deobfuscate it in the end" is exceptionally silly; it's implying that existing deobfuscators use knowledge of the obfuscators in their process of reversing it. They clearly do not, and an obfuscator written from scratch is almost certainly strictly inferior to existing solutions. I decided not to attack someone for being slightly naive and just mention something that is legitimately protected by obfuscation. Apparently that is the wrong thing to do on HN and I need to be snarky to avoid people assuming that I'm a moron.
- davidsiems 15y ago
  You don't need variable names to understand what the code is doing, it's just harder without them. Try going to google.com with chrome, opening the developer console, going to scripts right clicking and selecting 'de-obfuscate source'.
  - esrauch 15y ago
    I never intended to imply that you could not determine what the code is doing. I simply stated that you could not get the variable names back, I'm not sure why several people felt the need to inform me that "x therefore y" is false when all I said was x.

esrauch 15y ago

It's not possible to reconstruct variable names that are replaced with arbitrary strings.

thezilch 15y ago
It would be possible to infer function and variable names, given enough thought.
yid 15y ago
You seem to have not heard of the field of software reverse-engineering. If you think obfuscated JS is hard to understand, keep in mind that people like DVD Jon typically reverse-engineer algorithms out of optimized assembly.
- esrauch 15y ago
  You are completely making assumptions about who I am and what my comment means outside of what is literally there in the text of it. I never said you can't get algorithms out of obfuscated source, I said you can't get variable names. A lot of JS code ends up getting deployed with references to future planned unreleased features. Fairly simple code obfuscation works completely to hide that form of leak. See the leak about Facebook's future integration with some music service that came out from a javascript string without there literally being any functionality to go along with it, among a number of Google+ feature leaks that came out similarly. Obviously you can infer what the variable name might be, but you can't get the original variable name back. Was a variable count or counter? Index or i? In reality I just thought that "Even written from scratch this will not prevent people to deobfuscate it in the end" is exceptionally silly; it's implying that existing deobfuscators use knowledge of the obfuscators in their process of reversing it. They clearly do not, and an obfuscator written from scratch is almost certainly strictly inferior to existing solutions. I decided not to attack someone for being slightly naive and just mention something that is legitimately protected by obfuscation. Apparently that is the wrong thing to do on HN and I need to be snarky to avoid people assuming that I'm a moron.
davidsiems 15y ago
You don't need variable names to understand what the code is doing, it's just harder without them. Try going to google.com with chrome, opening the developer console, going to scripts right clicking and selecting 'de-obfuscate source'.
- esrauch 15y ago
  I never intended to imply that you could not determine what the code is doing. I simply stated that you could not get the variable names back, I'm not sure why several people felt the need to inform me that "x therefore y" is false when all I said was x.