Hacker News Reader

Comment by Qwertie | Hacker News Reader

Seems to be a proprietary application so app privacy went out the window already.

Privacy is a spectrum. You can choose to be at one end of it, but not everyone shares your opinion. As a local app your data has a different legal status, and you actually have a lot of control over the execution compared to a web service. For instance, with outgoing firewall rules you could ensure that this is only talking to your email server.

It's still better than it would be if it was a normal web app hosted on his server.

Or, at least, it has the potential to be better.

You can audit the code of every Electron app, so why are you acting like it's full of spyware that you'll never be able to have privacy with?

Ever heard of minimized JavaScript[0]?

[0]: https://github.com/google/closure-compiler

Minified js isn't particularly hard to reverse engineer compared to tools that are geared towards actual obfuscation, and regardless, you don't even need to look at the code if all you care about is privacy. A look at the dev console's network tab should tell you all you need to know.

I've done obfuscated Javascript on a CTF. Only a few hundred lines and I can tell you, it's way easier to just write it new from scratch, especially if you have a product that you like and can just copy.

I’ve reversed and broken real-life products written in JS, Java, WebAssembly and native code.

Minified JS and obfuscated Java (DexGuard or ProGuard) are almost identical in complexity, you can restore the actual datatypes still, and you can even restore the rough outlines of where control structures were.

Obfuscated WebAssembly, NaCl or native code is much worse to work with, and often data structures and control structures are gone entirely.

I'd be very interested about your findings decompiling wasm. Do you have a blog, by chance?

From parent's HN profile:

Janne Koschinski, CompSci student. https://github.com/justJanne

Current maintainer of QuasselDroid https://quasseldroid.info/ https://github.com/sandsmark/QuasselDroid

I don’t maintain a blog currently, sorry. And if I had one I doubt I’d be able to write interesting articles about this topic.

Generally I share such info on IRC, and then it gets just forgotten over time.

Reply on news.ycombinator.com