Hacker News Reader

Comment by timmclean | Hacker News Reader

That's a neat use of JavaScript Source Maps. Unfortunately, it looks like you would effectively need to make your non-minified codebase public. Any plans for ways to get around that?

View on HN

Your source code is not that special. Really. Do you really think you have some clever trick nobody else has considered, and that you can successfully hide it behind minification? Come on.

While timmclean's comment does indicate that he was thinking about keeping your codebase private; most people minify their code to cut down on filesizes... so his questions is still valid.

It isnt, the source maps are what is used to get it back to an unminified state

The question is, but it's answered with source maps. The concern that source maps allow anybody greater access to your code is not a valid one.

I just did some more reading on source maps. I thought they had far more information about the original source than they actually do. Thanks!

Maybe the source is not special or unique, but not everyone wants to give away their work. Eg you just spent 6 months developing a product feature and by coincidence your competitor also launches the same feature 2 weeks later :|

Of course minified code is also usable, however it makes things just that little bit more difficult for rip off artists.

I'm all for free and open software, but some aren't, and they're free to feel that way.

I don't think I have any tricks clever enough to help anyone who can easily read minified code :) I only want to prevent simple theft from copy/pasting of source code.

They list that they support source maps in the features:

http://www.html5rocks.com/en/tutorials/developertools/source...

Yes, I'm wondering if there's a way to keep the source maps private.

For what reason? It's not as if minifying your assets is a reliable form of security.

Exactly. Anyone determined enough can essentially reconstruct your non-minified code from the minified version.

"essentially reconstruct"? That's generous language. You have to somehow determine the use of all variables and functions and what proper names for them would be. Outside of DOM calls, the logic and application layer is close to incomprehensible. See also the javascript of any large webapp.

> You have to somehow determine the use of all variables and functions and what proper names for them would be.

True, but in the mean time you can amuse yourself with hilarious variable names:

http://media.admob.com/gmsg.js => http://paste.ubuntu.com/1205328/

Or you can be lucky enough to find unobfuscated versions anyway, regardless of source maps:

http://cdn.optimizely.com/js/673.js

.. well, it was working yesterday.

Milk, turnip, knife? That's funny. I might start coding like that by default.

I've seen the javascript of large webapps. That's why I said determined. You could reverse-engineer even the craziest logic if you wanted.

Not for the security of the application, but to protect intellectual property. It's much less tempting to "borrow" snippets of code when it's been minified.

There are two ways of associating a sourcemap with a file in the spec: 1) http header and 2) //@ sourceMappingURL comment in the destination file. You could expose the HTTP header only to to Rescue.js IPs, or alternatively they could conceivably provide an interface to make the map associations within the admin panel.

Ah. An interface in the admin panel sounds best, but that would probably add steps to a deployment process...

Reply on news.ycombinator.com