7 ms·
What's the point of such heavy obfuscation? Are they afraid of someone cloning their frontend? At first glance it seems like a waste of performance...
by kayson 4y ago
What's the point of such heavy obfuscation? Are they afraid of someone cloning their frontend?
At first glance it seems like a waste of performance...
- TobyTheDog123 4y agoMost likely bot prevention & data security. There's not a huge performance hit, there's a portion that runs on page load and a smaller portion that runs on each HTTP request (which isn't too often).
- jeroenhd 4y agoBots just run copies of Chrome these days, you're not protecting anyone with this obfuscation if the bots you're targeting can just run your code and automate the UI. With the obfuscated fingerprinting demonstrated by the virtualized code, I reckon they're doing something more malicious.
- charcircuit 4y agoYou answered it yourself. They are trying to fingerprint bots and to avoid people figuring out how to beat the fingerprint they obfuscate the code.
- lwansbrough 4y agoIn the first post about this, it was revealed they're exfiltrating detailed metrics covertly by piggybacking on regular requests.
- sweetjuly 4y agoYes, but that's not the only thing running under the VM--the entire user client is in there. This is not proof that they're evil, in fact it's identical to an anti-boting technique that was just on the front page yesterday [1]. [1] https://news.ycombinator.com/item?id=34285747 https://news.ycombinator.com/item?id=34285747
- javier2 4y agoAt first I thought this looked kinda scary, but it makes more sense as bot prevention, and obfuscating as much as possible to hinder manipulation of data. Consider services that manipulate view stats or followers etc for payment. This ruins both tiktok, instagram and reddit revenue models.
- mach1ne 4y agoThey do heavy data collecting which is a PR hit if it's too obvious. Obfuscation could be a general policy driven by this.
- thaumasiotes 4y agoWouldn't you detect data collection by watching what gets sent, not by debugging the app?
- valleyer 4y agoWhat gets sent can be encrypted, and the cleartext version might only be accessible through debugging.
- mach1ne 4y agoThere was a Part 1 of this post I believe (it could have been by a different author). It revealed that TikTok sends fingerprinting data about your device during every get request, under an unseeming header, encrypted to look like a long random string.
- ayewo 4y agoYes, Part 1 [1] is by a different author and was linked to in the first sentence of TFA. 1: https://news.ycombinator.com/item?id=34109771 https://news.ycombinator.com/item?id=34109771
- deleted 4y ago[deleted]
- beepbooptheory 4y agoIs this not standard practice for sites/apps like these? Seems a little overboard, user agent fingerprinting is hardly a secret, and (unfortunately) not considered a dark pattern.
- est 4y agoYou'd be surprised to see China's underground content farms. They went great length to automate content generation by decrypt & exploit App's private APIs
- vladvasiliu 4y agoBy "app's private apis" do you mean "apps other than tiktok running on the same device"? Isn't that supposed to be prevented by the os via the permissions thing?
- est 4y agoI mean bot-controlled spamming, like uploading videos, like, fav using private API, dislike & report your competitor's videos etc. Lots of "studios" use these APIs as for-profit astro-turfing, sometimes spreading mis-informatin, with tons of fake accounts A layer of VM obfuscation helps, like a DRM or packer.
- prox 4y agoWasn’t there also an article on here that showed the sub farms, basically tons of usually girls in a factory floor with cubicles that were streaming for some coin. Not sure if it was China specific.
- thenthenthen 4y agoThis used to be, now its all automated, the devices used (phones) don't even have screens attached anymore, just mainboard+sim
- btown 4y agoAnd specifically, the idea is to make sure that any kind of effort at writing a bots-and-fraudulent-likes-as-a-service platform is such a moving target that it becomes uneconomical to maintain. It's never perfect, as efforts like the OP's attest, but the incremental advertiser trust (and brand trust from a valuation perspective, as we've seen with Twitter's bot problems!) from being ahead in this "arms race" is likely considered worth the cost of hiring obfuscating-compiler engineers.
- thrdbndndn 4y agoLots of web services obfuscates their front-end scripts by default, not really that uncommon.
- madeofpalk 4y agoThere's JS minification - renaming variables to single letters, eliminating dead code paths, minimising whitespace, etc - that's exceptionally common and will be the default for most frontend workflows. That is not really 'Obfuscation', at least to the degree that TikTok is doing.
- BlueTemplar 4y agoOf course it is : they are being bad actors by making it harder to read the code. Imagine someone did that in a codebase that you had to take over ! (And sure, there are degrees to this.)
- mathieuh 4y agoMinfication also reduces the size of the page, resulting in less network traffic. We used minification on government apps I've worked on before, despite the source being available on GitHub.
- fulafel 4y agoAfter gzip compression, the effect is considerably reduced.
- riskable 4y agoNot really. gzip doesn't know that it can eliminate enormous swaths of unused code paths. I've seen enormous code bases drop from multi-megabyte downloads (even using gzip compression) into mere kilobytes from minification strategies. It's because minification is far more intelligent than it's made out to be: Your code may pull in a dependency like lodash for a single function in a number of places. gzip would be able to notice that and reduce the total amount of data sent over the wire by de-duplicating and compressing lodash but minification would notice that you're only using a single function and only that function would end up being included in the minified source (and similarly de-duplicated).
- renonce 4y agoI think they are just reusing technologies commonly used in China on TikTok website so they don't write it twice. In China many frontend developers write code for WeChat mini program. WeChat mini program is just a typical HTML website with extra APIs and the restriction that code has to be uploaded for review before they are deployed, and `eval` (and anything else that allows executing string as script directly) is disallowed in order to prevent sneaking code past review. Many developers developed their own JavaScript VM and interpreter to bypass that restriction, and that same code happens to be reused on all HTML based platforms even outside WeChat.
- dna_polymerase 4y agoSo they won't let you do eval but don't mind a whole VM? This doesn't sound right, unless eval touches something deeper and might pose a security risk, while the VM runs inside the normal sandbox. Can you elaborate a bit, or hint at further resources? It sounds fascinating.
- postalrat 4y agoEval touches everything in scope where it's executed. The VM will only have access to what it is given.
- sebazzz 4y agoIt sounds a bit useless as the entire "window" variable is passed - which basically gives it access it anything.
- joshspankit 4y agoYeah, this smells like a tactic that will eventually get shut down for being in bad faith
- kaba0 4y agoI’m fairly sure that it is impossible to tell from arbitrary code whether it is an interpreter or not. This is just something inherent in Turing machines, they can emulate other Turing machines.
- 2OEH8eoCRo0 4y agoMaybe they're using stolen IP, copyrighted code, violating licenses, etc?