7 ms·

It's not that client-side applications are easier to reverse-engineer. If the application is all client-side, it can literally just be downloaded and reused by

It's not that client-side applications are easier to reverse-engineer. If the application is all client-side, it can literally just be downloaded and reused by a would-be competitor.

aidenn0 15y ago
which violates your copyright. Microsoft Word is entirely client-side so it too can literally just be downloaded and reused by a would-be competitor.
- pilom 15y ago
  Downloading Microsoft Word does not include all the source code in addition to the application.
  - aidenn0 15y ago
    Neither does obfuscated and minified javascript.
    - tnorthcutt 15y ago
      Yes, it does. Where do you think the source code is?
      - sjs 15y ago
        It may not be at the same level as disassembling binary code w/ IDA or what have you, but un-minifying or un-obfuscating JavaScript is not a trivial exercise by any means. (If I were in a nitpicking mood I would also point out that the source is what is fed into the minifier or obfuscator, not what comes out.)
        rralian 15y ago
        un-minifying javascript is very trivial. you just copy and paste it into an online javascript beautifier. you won't get the original un-obfuscated source with original comments, but you'll get readable javasript that you can easily parse visually.
        chrisohara 15y ago
        as I said above, de-obfuscating a large javascript app that's been obfuscated/minified by proprietary tools is virtually impossible to decode. Try running some of google's code - gmail, docs, take your pick - through your beautifier ;)
        rralian 15y ago
        I don't know if anybody uses proprietary tools to minify and obfuscate their javascript. We all use the same minification tools, with different features selected. Seems like most people use YUI compressor, or one of the others listed here http://compressorrater.thruhere.net/ http://compressorrater.thruhere.net/. I assume Google is using their closure tools (which I've never played with myself). It's a lot easier to reverse-engineer the site than to build it from scratch yourself. You won't get all the comments, and some of the names of functions and variables and whatnot may lose their semantic meaning in favor of shorter names. But yes, it is trivial to unminify the source and work through it. If it's 10k+ lines of code, that's never trivial to understand and get it all in your head, but the concern is absolutely valid. If you think minifying/obfuscating is securing your code intellectual property, you're fooling yourself. It's like security through obscurity... it's not really offering you any protection.
        sjs 15y ago
        That doesn't sound right to me. People will rewrite code that already exists as open source because they don't want to take the time to understand someone else's code. But you're saying that some will reverse engineer a JS app from minified code rather than just rewrite it. Are there any examples of this actually happening? I'm a curious guy and have deciphered small-ish amounts of minified and/or obfuscated JS before. It is absolutely not trivial. Especially if it's obfuscated.
- deleted 15y ago
  [deleted]
chrisohara 15y ago
have you ever looked at code obfuscated by proprietary tools? By your logic it's easy to reverse-engineer and copy Gmail - good luck with that
- endtime 15y ago
  Are you saying you don't think Gmail has a backend...?
  - chrisohara 15y ago
    Of course it has a backend, but so do the Firebase apps that this entire thread is talking about. Referring to a JS app as "client-side" doesn't imply that there's no backend logic. My point is that you can't just de-obfuscate a primarily client-side JS app and replace the Firebase (or whatever) endpoints. Proprietary obfuscation is more than just variable name munging and minification..
    - endtime 15y ago
      The Gmail backend isn't available in the same way as the Firebase backend.

It's not that client-side applications are easier to reverse-engineer. If the application is all client-side, it can literally just be downloaded and reused by a would-be competitor.

aidenn0 15y ago

which violates your copyright. Microsoft Word is entirely client-side so it too can literally just be downloaded and reused by a would-be competitor.

pilom 15y ago
Downloading Microsoft Word does not include all the source code in addition to the application.
- aidenn0 15y ago
  Neither does obfuscated and minified javascript.
  - tnorthcutt 15y ago
    Yes, it does. Where do you think the source code is?
    - sjs 15y ago
      It may not be at the same level as disassembling binary code w/ IDA or what have you, but un-minifying or un-obfuscating JavaScript is not a trivial exercise by any means. (If I were in a nitpicking mood I would also point out that the source is what is fed into the minifier or obfuscator, not what comes out.)
      - rralian 15y ago
        un-minifying javascript is very trivial. you just copy and paste it into an online javascript beautifier. you won't get the original un-obfuscated source with original comments, but you'll get readable javasript that you can easily parse visually.
        chrisohara 15y ago
        as I said above, de-obfuscating a large javascript app that's been obfuscated/minified by proprietary tools is virtually impossible to decode. Try running some of google's code - gmail, docs, take your pick - through your beautifier ;)
        rralian 15y ago
        I don't know if anybody uses proprietary tools to minify and obfuscate their javascript. We all use the same minification tools, with different features selected. Seems like most people use YUI compressor, or one of the others listed here http://compressorrater.thruhere.net/ http://compressorrater.thruhere.net/. I assume Google is using their closure tools (which I've never played with myself). It's a lot easier to reverse-engineer the site than to build it from scratch yourself. You won't get all the comments, and some of the names of functions and variables and whatnot may lose their semantic meaning in favor of shorter names. But yes, it is trivial to unminify the source and work through it. If it's 10k+ lines of code, that's never trivial to understand and get it all in your head, but the concern is absolutely valid. If you think minifying/obfuscating is securing your code intellectual property, you're fooling yourself. It's like security through obscurity... it's not really offering you any protection.
        sjs 15y ago
        That doesn't sound right to me. People will rewrite code that already exists as open source because they don't want to take the time to understand someone else's code. But you're saying that some will reverse engineer a JS app from minified code rather than just rewrite it. Are there any examples of this actually happening? I'm a curious guy and have deciphered small-ish amounts of minified and/or obfuscated JS before. It is absolutely not trivial. Especially if it's obfuscated.
deleted 15y ago
[deleted]

chrisohara 15y ago

have you ever looked at code obfuscated by proprietary tools? By your logic it's easy to reverse-engineer and copy Gmail - good luck with that

endtime 15y ago
Are you saying you don't think Gmail has a backend...?
- chrisohara 15y ago
  Of course it has a backend, but so do the Firebase apps that this entire thread is talking about. Referring to a JS app as "client-side" doesn't imply that there's no backend logic. My point is that you can't just de-obfuscate a primarily client-side JS app and replace the Firebase (or whatever) endpoints. Proprietary obfuscation is more than just variable name munging and minification..
  - endtime 15y ago
    The Gmail backend isn't available in the same way as the Firebase backend.