Hacker News Reader

Comment by jmickey | Hacker News Reader

Am I the only one who thinks there actually is quite a difference between minified & obfuscated javascript vs bytecode?

Minification & obfuscation can only do so much without changing the logic of the script. Sure, spaces are removed, variable and function names make no sense, but most of the logic is still there just as the developer intended.

If we look at compiled Java/C++/Any high level language code, how the application logic is presented is substantially different from the original logic of the application. Making it so much harder to understand how the application works.

View on HN

I disagree. Obfuscation is essentially the same as a separate compilation and can do as little or as much to distort the original logic as compiling to a lower level language.

E.g. an obfuscator could make all method calls into one identical named overload, while a compiler could emit appropriately named subroutines. The compiler preserves the logic better in this case.

Minimization is something different, but minimizers do not attempt obfuscation, it is more of a side effect of their goal.

Not much of a difference if you're running your JS code through Googles closure (https://developers.google.com/closure/), this basically does a complete re-compilation of your JS, removing dead code, unused variables, and lots of other optimizations, and in the end spits out a big ASCII blob that could just as well be byte code. It has nothing in common with the original source code.

And then you throw JSNice at it, give it to a college student, wait a weekend, and have a nicely readable source version.

Source: Am college student, for fun I disassemble websites, including the funny VM Google built for ReCaptcha.

Additionally, I wonder what the EU thinks about this, as anyone who has the ability to use a software has the right to take it apart, inspect it, and learn from it. This right can not be signed away with contracts (making the "Do not decompile" clause invalid) and is violated by all these closed source web projects.

Tbh, I should probably just decompile, deobfuscate and refactor the Google Inbox client source, and publish it on GitHub over summer break, just to show Google how useless and annoying their obfuscation is.

I don't think so. There's a plan for a text representation of WebAssembly to show when you view source. That should be pretty similar to obfuscated JS

java bytecode can be decompiled to a very high level source code, unless explicit measures are added to actually obfuscate it.

Reply on news.ycombinator.com