Comment by zmmmmm | Hacker News Reader

Comment by zmmmmm | Hacker News Reader

As laudable as the goal of improving performance is, I hope this never takes off. Why? Because it will take about 5 minutes from 90% of the web to go from open, transparent, easily reverse engineerable source code to essentially giant blobs of secret binary code. People will pay lip service to performance but 99% of the reason that web sites will implement this will be to cover up their code, keep secret their implementation techniques and technologies, hide poor code and poor security.

I honestly think that one of the key ingredients to the success of the web is that just about any web page you can see, just about anyone with modest knowledge can trivially work out how it was done. It is only an accident of history that it worked out that way. But the effect has been to spread knowledge far and wide and it has greatly contributed to the success of web technologies. Furthermore, I can easily look at the source code for my bank web site or any web site I want to trust and get a good idea of how solid their implementation is. Yes I can't inspect the back end, but a whole slice of front-end security issues are easy for me to check for myself. This kind of scrutiny will get a good bit harder if web assembly becomes adopted.

> I honestly think that one of the key ingredients to the success of the web is that just about any web page you can see, just about anyone with modest knowledge can trivially work out how it was done.

Not really. Almost all websites obfuscate/minify their Javascript now, making manually interpreting the code much less than "trivial." I think WebAssembly will be no worse to figure out than obfuscated Javascript.

I think it will be much worse.

Minified Javascript is pretty easy to turn back into something moderately understandable just by "prettifying" it. I do this all the time. It works pretty well because it started as Javascript, so turning it back into Javascript has a relatively clean mapping. WebAssembly will have started as some other language or even as no language at all - there may be no mapping back to anything Javascript could represent. It will be much closer to disassembly of machine code, or Java byte code, which is possible but challenging enough that most ordinary developers never do it.

True, but this is already happening with asm.js. Is webassembly any more objectionable than that? Instead of causing existing applications to further obfuscate their code, it seems to be bringing new types of applications to the browser.

I think WebAssembly will be much closer to Java byte code than actual machine assembly. And Java byte code can be easily decompiled into readable Java code (at least as readable as minified Javascript).

A polyfill to Javascript is already planned.

https://github.com/WebAssembly/design/blob/master/Polyfill.m...

That's exactly why we have the free software movement.

its built into the spec of WASM for it to be able to be "prettified" as well. I imagine it'd do about as good of a job as current prettifying of minified JS.

"The WebAssembly text format, which is designed to be read and written when using tools (e.g., assemblers, debuggers, profilers), is specified as a textual projection of a module's AST."

This is apart of the MVP even. I think the authors of WASM actually agree with your opinions here and are working to a system that satisfies that concern.

BTW taken from, https://github.com/WebAssembly/design/blob/master/MVP.md

> I think the authors of WASM actually agree with your opinions here and are working to a system that satisfies that concern

That's very reassuring - I hope it works out that way.

I don't see how obfuscated javascript is a lot easier to reverse engineer than webassembly binaries will be. You really scrutinize your bank's javascript for security issues? Really? I have a hard time believing that.

https://github.com/WebAssembly/design/blob/master/TextFormat...

I think the argument of "anyone can figure out how it's done" is moot (as pointed out by many). But there is a significant change here: with Javascript or even ASM I can always take parts of someone's code and use it for my purposes. This means that developers are forced to think about security and business models in a specific way. With WebAssembly, we might lose that, as you pointed out. And that is a real issue.

Yet, isn't much of the web already unreadable due to minification of JS source?

If you think minification does anything to prevent anyone from reading it you are mistaken. Is it harder? Yes. Impossible, not even close, just annoying. I've reversed engineer JS libraries with 20K LOC that were minified and uglified in less than a day, hardly what I consider a hurdle.

Now, to have worked with asm.js recently, that's a whole different ball game. That is unreadable, at least without spending copious amounts of time on it and having a deep understanding of asm.js to be able to read it.

What do you get out of reading some random website's minified javascript?

Sometimes it's just the curiuosity of "how did they do that?" In general, one doesn't go around looking at the code everywhere, but on more than one occassion I've looked into something to figure out how something was done, or why it's broken in my browser (much more common in early Firebird^b^b^b^bfox).

On the one hand, I hope it gives a real build target for Rust and Go... on the other, I hope things don't get too obfuscated in practice.

When we are talking about browsing code for the purpose of leisure curiosity and learning, yes it is a real hurdle.

WebAssembly will be a lot more readable than asm.js - that's a specific goal, in fact.

It is true that it will still be lower-level than JS. But it remains in a structured AST format which is easy to pretty-print. And many of the worst patterns you see a lot in asm.js just won't be there.

Aren't there many JS beautification tools that can un-minify JS? It won't unshorten variable names, but the code should still be fairly readable.

IMHO there is nothing wrong with hiding the source code. Infact it will save a lot of time for developers who do UI 'builds' in order to obfuscate or minify their js code. Binary webpage code was long due.

We will instantly have tools to decompile this stuff so it will look just as good if not even better than what you get when formatting minified javascript today.

In fact pick any language today that compiles output and you will find decompiling tools made for it, including the original compiled web stuff like Flash and Silverlight.

I'd much rather the web get faster for everyone than save a few people some time when deconstructing.

Fair enough that it's very nice for a tiny portion of web users to be able to reverse engineer code, but WA might increase performance for 100% of web users.

You are assuming that web sites have any meaningfull code done in JavaScript.

Many outside the HN web bubble are still plain HTML/CSS sites with almost everything done server side.

Reply on news.ycombinator.com