4 ms·

Yes, I'm wondering if there's a way to keep the source maps private.

by timmclean 14y ago

nilved 14y ago
For what reason? It's not as if minifying your assets is a reliable form of security.
- artursapek 14y ago
  Exactly. Anyone determined enough can essentially reconstruct your non-minified code from the minified version.
  - paulirish 14y ago
    "essentially reconstruct"? That's generous language. You have to somehow determine the use of all variables and functions and what proper names for them would be. Outside of DOM calls, the logic and application layer is close to incomprehensible. See also the javascript of any large webapp.
    - kanzure 14y ago
      > You have to somehow determine the use of all variables and functions and what proper names for them would be. True, but in the mean time you can amuse yourself with hilarious variable names: http://media.admob.com/gmsg.js http://media.admob.com/gmsg.js => http://paste.ubuntu.com/1205328/ http://paste.ubuntu.com/1205328/ Or you can be lucky enough to find unobfuscated versions anyway, regardless of source maps: http://cdn.optimizely.com/js/673.js http://cdn.optimizely.com/js/673.js .. well, it was working yesterday.
      - artursapek 14y ago
        Milk, turnip, knife? That's funny. I might start coding like that by default.
    - artursapek 14y ago
      I've seen the javascript of large webapps. That's why I said determined. You could reverse-engineer even the craziest logic if you wanted.
- timmclean 14y ago
  Not for the security of the application, but to protect intellectual property. It's much less tempting to "borrow" snippets of code when it's been minified.
paulirish 14y ago
There are two ways of associating a sourcemap with a file in the spec: 1) http header and 2) //@ sourceMappingURL comment in the destination file. You could expose the HTTP header only to to Rescue.js IPs, or alternatively they could conceivably provide an interface to make the map associations within the admin panel.
- timmclean 14y ago
  Ah. An interface in the admin panel sounds best, but that would probably add steps to a deployment process...

Yes, I'm wondering if there's a way to keep the source maps private.

nilved 14y ago

For what reason? It's not as if minifying your assets is a reliable form of security.

artursapek 14y ago
Exactly. Anyone determined enough can essentially reconstruct your non-minified code from the minified version.
- paulirish 14y ago
  "essentially reconstruct"? That's generous language. You have to somehow determine the use of all variables and functions and what proper names for them would be. Outside of DOM calls, the logic and application layer is close to incomprehensible. See also the javascript of any large webapp.
  - kanzure 14y ago
    > You have to somehow determine the use of all variables and functions and what proper names for them would be. True, but in the mean time you can amuse yourself with hilarious variable names: http://media.admob.com/gmsg.js http://media.admob.com/gmsg.js => http://paste.ubuntu.com/1205328/ http://paste.ubuntu.com/1205328/ Or you can be lucky enough to find unobfuscated versions anyway, regardless of source maps: http://cdn.optimizely.com/js/673.js http://cdn.optimizely.com/js/673.js .. well, it was working yesterday.
    - artursapek 14y ago
      Milk, turnip, knife? That's funny. I might start coding like that by default.
  - artursapek 14y ago
    I've seen the javascript of large webapps. That's why I said determined. You could reverse-engineer even the craziest logic if you wanted.
timmclean 14y ago
Not for the security of the application, but to protect intellectual property. It's much less tempting to "borrow" snippets of code when it's been minified.

paulirish 14y ago

There are two ways of associating a sourcemap with a file in the spec: 1) http header and 2) //@ sourceMappingURL comment in the destination file. You could expose the HTTP header only to to Rescue.js IPs, or alternatively they could conceivably provide an interface to make the map associations within the admin panel.

timmclean 14y ago
Ah. An interface in the admin panel sounds best, but that would probably add steps to a deployment process...