3 ms·

Lots of web services obfuscates their front-end scripts by default, not really that uncommon.

madeofpalk 4y ago
There's JS minification - renaming variables to single letters, eliminating dead code paths, minimising whitespace, etc - that's exceptionally common and will be the default for most frontend workflows. That is not really 'Obfuscation', at least to the degree that TikTok is doing.
- BlueTemplar 4y ago
  Of course it is : they are being bad actors by making it harder to read the code. Imagine someone did that in a codebase that you had to take over ! (And sure, there are degrees to this.)
  - mathieuh 4y ago
    Minfication also reduces the size of the page, resulting in less network traffic. We used minification on government apps I've worked on before, despite the source being available on GitHub.
    - fulafel 4y ago
      After gzip compression, the effect is considerably reduced.
      - riskable 4y ago
        Not really. gzip doesn't know that it can eliminate enormous swaths of unused code paths. I've seen enormous code bases drop from multi-megabyte downloads (even using gzip compression) into mere kilobytes from minification strategies. It's because minification is far more intelligent than it's made out to be: Your code may pull in a dependency like lodash for a single function in a number of places. gzip would be able to notice that and reduce the total amount of data sent over the wire by de-duplicating and compressing lodash but minification would notice that you're only using a single function and only that function would end up being included in the minified source (and similarly de-duplicated).
        ape4 4y ago
        Besides removing unused code paths gzip is usually better https://css-tricks.com/the-difference-between-minification-and-gzipping/ https://css-tricks.com/the-difference-between-minification-a...
        fulafel 4y ago
        If we broadly include tree shaking (aka dead code elimination) in minification, then yes. They are often considered distinct transformations.
        jsmith45 4y ago
        At least in webpack, tree shaking and minimization are distinct, but BOTH include dead code elimination. For webpack tree shaking is the removal the declarations of exported values that are never imported. Further, imported values that were used used in functions such exported can be removed (although removing the last import from a file entirely requires knowing the imported file has no side effects). Separately to that the minimizer (terser) has its own dead code elimination process, that performs more in depth analysis. Terser cannot do the tree shaking part itself because of how webpack structures modules that Webpack was unable to concatenate, and because code slitting might make that live in a different file. But if webpack can eliminate unused exports and ensure that split files only access each other via exports, then terser can handleremaining dead code elimination within each module.
  - madeofpalk 4y ago
    > Imagine someone did that in a codebase that you had to take over ! This is typically done at build time, so there's no or little impact to developers writing code. Minification is the frontend equivilent to compiling code. We typically don't think of building a Go program as 'obfuscating' it when compiling it down to machine code even though the resulting artefact is harder to read than the original source code.
- c0balt 4y ago
  I think the gap between "minimizing" and (un)intentionally "obfuscating" is quite simple: "Sourcemaps". Usually available from all common tools, like Webpack, terser, ..., and the intermediate solution for preserving accuracy.
ZephyrBlu 4y ago
That's obfuscating the code. What TikTok is doing is obfuscating the execution which is very uncommon.
- water8 4y ago
  So basically, you need to figure out the encryption key protected by the VM in order to decrypt the request and response messages that you can observe through the operating system? Is that correct?

There's JS minification - renaming variables to single letters, eliminating dead code paths, minimising whitespace, etc - that's exceptionally common and will be the default for most frontend workflows. That is not really 'Obfuscation', at least to the degree that TikTok is doing.

BlueTemplar 4y ago
Of course it is : they are being bad actors by making it harder to read the code. Imagine someone did that in a codebase that you had to take over ! (And sure, there are degrees to this.)
- mathieuh 4y ago
  Minfication also reduces the size of the page, resulting in less network traffic. We used minification on government apps I've worked on before, despite the source being available on GitHub.
  - fulafel 4y ago
    After gzip compression, the effect is considerably reduced.
    - riskable 4y ago
      Not really. gzip doesn't know that it can eliminate enormous swaths of unused code paths. I've seen enormous code bases drop from multi-megabyte downloads (even using gzip compression) into mere kilobytes from minification strategies. It's because minification is far more intelligent than it's made out to be: Your code may pull in a dependency like lodash for a single function in a number of places. gzip would be able to notice that and reduce the total amount of data sent over the wire by de-duplicating and compressing lodash but minification would notice that you're only using a single function and only that function would end up being included in the minified source (and similarly de-duplicated).
      - ape4 4y ago
        Besides removing unused code paths gzip is usually better https://css-tricks.com/the-difference-between-minification-and-gzipping/ https://css-tricks.com/the-difference-between-minification-a...
      - fulafel 4y ago
        If we broadly include tree shaking (aka dead code elimination) in minification, then yes. They are often considered distinct transformations.
        jsmith45 4y ago
        At least in webpack, tree shaking and minimization are distinct, but BOTH include dead code elimination. For webpack tree shaking is the removal the declarations of exported values that are never imported. Further, imported values that were used used in functions such exported can be removed (although removing the last import from a file entirely requires knowing the imported file has no side effects). Separately to that the minimizer (terser) has its own dead code elimination process, that performs more in depth analysis. Terser cannot do the tree shaking part itself because of how webpack structures modules that Webpack was unable to concatenate, and because code slitting might make that live in a different file. But if webpack can eliminate unused exports and ensure that split files only access each other via exports, then terser can handleremaining dead code elimination within each module.
- madeofpalk 4y ago
  > Imagine someone did that in a codebase that you had to take over ! This is typically done at build time, so there's no or little impact to developers writing code. Minification is the frontend equivilent to compiling code. We typically don't think of building a Go program as 'obfuscating' it when compiling it down to machine code even though the resulting artefact is harder to read than the original source code.
c0balt 4y ago
I think the gap between "minimizing" and (un)intentionally "obfuscating" is quite simple: "Sourcemaps". Usually available from all common tools, like Webpack, terser, ..., and the intermediate solution for preserving accuracy.

ZephyrBlu 4y ago

That's obfuscating the code. What TikTok is doing is obfuscating the execution which is very uncommon.

water8 4y ago
So basically, you need to figure out the encryption key protected by the VM in order to decrypt the request and response messages that you can observe through the operating system? Is that correct?