New answers tagged source-code
4
First, if your system's security depends on your source code being unknown to an attacker, you're doing it wrong. Read about security through obscurity and the Kerckhoffs's principle. It's easier to protect small secrets (such as a cryptography key) than big ones, and also easier to recover from an eventual breach.
Second, if at any moment of its operation ...
5
what I use for this is burp suite. It has a "find comments" feature (documentation here) which can be used for this.
That said I'm not sure exactly how it works and so whether it'll find all comments including more obscure languages, but still a useful feature.
6
Well, it's not really a tool, but it'll get you started. This RegEx matches many kinds of comments (# comments, HTML comments, JavaScript comments, and VBScript comments).
(<!--(.*?)-->)|(/\*([^*]|[\r\n]|(\*+([^*/]|[\r\n])))*\*+/)|(//.*)|(^'.*$)|(^#.*$)
And here's a demo
Note: Be sure to set the g and m flags
Update: I thought it'd be a good idea ...
1
Of course this is a baseless fear.
Javascript is only one part of a larger ecosystem, much more important is brand, site usability, site integrity, responsiveness and network effects.
Yeah, javascript minimisation, optimisation is good to do, but not because of these purposes.
If a competitor steals you code, you can go legal on their tails, and kill ...
6
I think the operative word in the question is "afraid." The aversion is based on fear, not fact. The reality is, the threat model isn't particularly realistic. Commercial web software development companies nearly universally use JavaScript these days, obfuscated or otherwise, and I challenge you to find me even a single example of one that's had it's JS ...
3
You seem to already know that obfuscation isn't actual protection, so I'm not gonna lecture you on security by obscurity.
What makes sense is this: Put your competitive code on the server to protect it, then obfuscate client-side code as much as you want. Granted, it won't give you much security but it'll definitely deter kiddies snooping around, and it'll ...
2
No. Obfuscating Javascript usually makes no sense whatsoever. Always assume that any logic you place on the client side can easily be obtained by a determined enough attack no matter how you obfuscate it.
Your "important" logic should be stored server side.
5
Ignoring for a moment the wisdom of manipulating the source code, ask yourself how this watermark should work. You need to have different files for every developer. This means some automated code transformation that doesn't change the meaning of the code, yet isn't reversible. Oh, and it shouldn't make the code difficult to maintain. At the end of the day, ...
4
Before this gets out of hand with the edits and the comments, I wanted to say this.
This is not a hypothetical situation. Almost all software companies face this problem, and it all boils down to a trust issue. This topic has been extensively discussed on other StackExchange sites, most of the answers can be summarized in:
1- Hire people you trust.
...
2
If you give someone code to run on their own computer, there is always the possibility that they will do something with it that you didn't want or expect. If you've given them the source code, you've made that easier for them. If you absolutely must give people the actual code, and you don't want them to play with it, here are two possibilities gleaned from ...
4
Virtual machine, but real CPU. Regardless of how you elect to see it, the code for your server still runs on the machine of the supposed attacker. Similarly, disk encryption of any kind would not help either, even if you personally typed the password yourself upon boot: at some point, the data is still decrypted, on the attacker's machine.
Virtual machines ...
Top 50 recent answers are included
