5 ms·

Here's my big concern: If my entire app is client-based JavaScript, wouldn't that make cloning my app as simple as copying all of the JavaScript and other asset

by smoody 15y ago

Here's my big concern: If my entire app is client-based JavaScript, wouldn't that make cloning my app as simple as copying all of the JavaScript and other asset files and then associating them with another firebase account -- perhaps modifying them some so they dont't get banned? It seems like it lowers the barrier to competition a bit too much for me.

pron 15y ago
You could say that just about any software development platform. If it makes building software easier, it makes competition easier. And if building apps is easier, it really doesn't matter what stack your app uses - it's going to get easier to "clone", so you may as well use whatever platform gives you the best results. Other than that, you could either make your business, rather than your technology, more competitive, or make your technology ever more sophisticated than what "commodity" development tools allow.
- nick_urban 15y ago
  It's not that client-side applications are easier to reverse-engineer. If the application is all client-side, it can literally just be downloaded and reused by a would-be competitor.
  - aidenn0 15y ago
    which violates your copyright. Microsoft Word is entirely client-side so it too can literally just be downloaded and reused by a would-be competitor.
    - pilom 15y ago
      Downloading Microsoft Word does not include all the source code in addition to the application.
      - aidenn0 15y ago
        Neither does obfuscated and minified javascript.
        tnorthcutt 15y ago
        Yes, it does. Where do you think the source code is?
        sjs 15y ago
        It may not be at the same level as disassembling binary code w/ IDA or what have you, but un-minifying or un-obfuscating JavaScript is not a trivial exercise by any means. (If I were in a nitpicking mood I would also point out that the source is what is fed into the minifier or obfuscator, not what comes out.)
        rralian 15y ago
        un-minifying javascript is very trivial. you just copy and paste it into an online javascript beautifier. you won't get the original un-obfuscated source with original comments, but you'll get readable javasript that you can easily parse visually.
        chrisohara 15y ago
        as I said above, de-obfuscating a large javascript app that's been obfuscated/minified by proprietary tools is virtually impossible to decode. Try running some of google's code - gmail, docs, take your pick - through your beautifier ;)
        rralian 15y ago
        I don't know if anybody uses proprietary tools to minify and obfuscate their javascript. We all use the same minification tools, with different features selected. Seems like most people use YUI compressor, or one of the others listed here http://compressorrater.thruhere.net/ http://compressorrater.thruhere.net/. I assume Google is using their closure tools (which I've never played with myself). It's a lot easier to reverse-engineer the site than to build it from scratch yourself. You won't get all the comments, and some of the names of functions and variables and whatnot may lose their semantic meaning in favor of shorter names. But yes, it is trivial to unminify the source and work through it. If it's 10k+ lines of code, that's never trivial to understand and get it all in your head, but the concern is absolutely valid. If you think minifying/obfuscating is securing your code intellectual property, you're fooling yourself. It's like security through obscurity... it's not really offering you any protection.
    - deleted 15y ago
      [deleted]
  - chrisohara 15y ago
    have you ever looked at code obfuscated by proprietary tools? By your logic it's easy to reverse-engineer and copy Gmail - good luck with that
    - endtime 15y ago
      Are you saying you don't think Gmail has a backend...?
      - chrisohara 15y ago
        Of course it has a backend, but so do the Firebase apps that this entire thread is talking about. Referring to a JS app as "client-side" doesn't imply that there's no backend logic. My point is that you can't just de-obfuscate a primarily client-side JS app and replace the Firebase (or whatever) endpoints. Proprietary obfuscation is more than just variable name munging and minification..
        endtime 15y ago
        The Gmail backend isn't available in the same way as the Firebase backend.
deleted 15y ago
[deleted]
felixchan 15y ago
I think you're thinking a little too short-term here. It seems like a jump in technology that could completely change the way people build apps.
- BHSPitMonkey 15y ago
  You should work in their marketing department.
- jchrisa 15y ago
  Glad to see interest in the idea. It's not much different from what people have been doing with projects like http://couchapp.org http://couchapp.org or http://unhosted.org/ http://unhosted.org/ for some time. Once you have a basic HTTP database API, you can do most of an app in client-side JS. Security is the hardest part to get right. In CouchDB we've tried to follow the web security model when it makes sense (single origin policy, oauth, etc). CORS and WebSocket are both changing the web model, so it's not surprising to see the idea of a simple data API catching on as the web gets more power. Can't wait to see where this goes.
courtewing 15y ago
I think that is a valid concern, but it doesn't really apply to all apps. As one example, for a lot of businesses, the value is not so much in the app itself but in the data the app interacts with. In those cases, giving your competitors the source code to your app does mean they could copy anything they want from your app, but that doesn't do them much good if the real value is in the data.
dclowd9901 15y ago
I keep wondering this myself. On my resident JS-only app, the only thing that I can think of that's keeping someone from ripping off my code and duping the site is that nobody cares enough to try.
- holzp 15y ago
  Or using your paid repository to story their own app data. The authentication credentials are running on the client. I'm wondering how I keep a troll from writing a billion things to my firebase.

by smoody 15y ago

pron 15y ago

You could say that just about any software development platform. If it makes building software easier, it makes competition easier. And if building apps is easier, it really doesn't matter what stack your app uses - it's going to get easier to "clone", so you may as well use whatever platform gives you the best results. Other than that, you could either make your business, rather than your technology, more competitive, or make your technology ever more sophisticated than what "commodity" development tools allow.

nick_urban 15y ago
It's not that client-side applications are easier to reverse-engineer. If the application is all client-side, it can literally just be downloaded and reused by a would-be competitor.
- aidenn0 15y ago
  which violates your copyright. Microsoft Word is entirely client-side so it too can literally just be downloaded and reused by a would-be competitor.
  - pilom 15y ago
    Downloading Microsoft Word does not include all the source code in addition to the application.
    - aidenn0 15y ago
      Neither does obfuscated and minified javascript.
      - tnorthcutt 15y ago
        Yes, it does. Where do you think the source code is?
        sjs 15y ago
        It may not be at the same level as disassembling binary code w/ IDA or what have you, but un-minifying or un-obfuscating JavaScript is not a trivial exercise by any means. (If I were in a nitpicking mood I would also point out that the source is what is fed into the minifier or obfuscator, not what comes out.)
        rralian 15y ago
        un-minifying javascript is very trivial. you just copy and paste it into an online javascript beautifier. you won't get the original un-obfuscated source with original comments, but you'll get readable javasript that you can easily parse visually.
        chrisohara 15y ago
        as I said above, de-obfuscating a large javascript app that's been obfuscated/minified by proprietary tools is virtually impossible to decode. Try running some of google's code - gmail, docs, take your pick - through your beautifier ;)
        rralian 15y ago
        I don't know if anybody uses proprietary tools to minify and obfuscate their javascript. We all use the same minification tools, with different features selected. Seems like most people use YUI compressor, or one of the others listed here http://compressorrater.thruhere.net/ http://compressorrater.thruhere.net/. I assume Google is using their closure tools (which I've never played with myself). It's a lot easier to reverse-engineer the site than to build it from scratch yourself. You won't get all the comments, and some of the names of functions and variables and whatnot may lose their semantic meaning in favor of shorter names. But yes, it is trivial to unminify the source and work through it. If it's 10k+ lines of code, that's never trivial to understand and get it all in your head, but the concern is absolutely valid. If you think minifying/obfuscating is securing your code intellectual property, you're fooling yourself. It's like security through obscurity... it's not really offering you any protection.
  - deleted 15y ago
    [deleted]
- chrisohara 15y ago
  have you ever looked at code obfuscated by proprietary tools? By your logic it's easy to reverse-engineer and copy Gmail - good luck with that
  - endtime 15y ago
    Are you saying you don't think Gmail has a backend...?
    - chrisohara 15y ago
      Of course it has a backend, but so do the Firebase apps that this entire thread is talking about. Referring to a JS app as "client-side" doesn't imply that there's no backend logic. My point is that you can't just de-obfuscate a primarily client-side JS app and replace the Firebase (or whatever) endpoints. Proprietary obfuscation is more than just variable name munging and minification..
      - endtime 15y ago
        The Gmail backend isn't available in the same way as the Firebase backend.

deleted 15y ago

[deleted]

felixchan 15y ago

I think you're thinking a little too short-term here. It seems like a jump in technology that could completely change the way people build apps.

BHSPitMonkey 15y ago
You should work in their marketing department.
jchrisa 15y ago
Glad to see interest in the idea. It's not much different from what people have been doing with projects like http://couchapp.org http://couchapp.org or http://unhosted.org/ http://unhosted.org/ for some time. Once you have a basic HTTP database API, you can do most of an app in client-side JS. Security is the hardest part to get right. In CouchDB we've tried to follow the web security model when it makes sense (single origin policy, oauth, etc). CORS and WebSocket are both changing the web model, so it's not surprising to see the idea of a simple data API catching on as the web gets more power. Can't wait to see where this goes.

courtewing 15y ago

I think that is a valid concern, but it doesn't really apply to all apps. As one example, for a lot of businesses, the value is not so much in the app itself but in the data the app interacts with. In those cases, giving your competitors the source code to your app does mean they could copy anything they want from your app, but that doesn't do them much good if the real value is in the data.

dclowd9901 15y ago

I keep wondering this myself. On my resident JS-only app, the only thing that I can think of that's keeping someone from ripping off my code and duping the site is that nobody cares enough to try.

holzp 15y ago
Or using your paid repository to story their own app data. The authentication credentials are running on the client. I'm wondering how I keep a troll from writing a billion things to my firebase.