> I don't know of legitimate websites that obfuscate their JS. (Minification doesn't count.) What exactly is the difference between obfuscation and minimizatio

> I don't know of legitimate websites that obfuscate their JS. (Minification doesn't count.) What exactly is the difference between obfuscation and minimization? Could you write a program to tell the difference between a JS file that's been benevolently minified versus maliciously obfuscated? For that matter, how do humans tell the difference between minification and obfuscation? I think that, if you define "obfuscation" as "transforming source code into a less readable form," then most automatic program transformations -- especially those specifically intended to reduce the size of the resulting code -- will also be obfuscations. Of course, if only malware authors would make their products comply with RFC 3514, these problems would go away; security sandboxes and antimalware programs could simply and effectively filter based on the intent of a program's author, rather than static or dynamic analysis of the program's code [1]. [1] http://tools.ietf.org/html/rfc3514 http://tools.ietf.org/html/rfc3514