3

I'll be quite to the point, is there any way to make Javascript a bit more concealed than it usually is or is Javascript always out and open if you look in the source code ?

This is about hiding proprietary algorithms that would dispense a service that does not exist yet (to my knowledge) on the market and is not really straightforward. I know that patenting is possible but let's leave this out of the question.

5
  • 1
    Is there a way to keep the algorithm on the server side? Even a partial split of algorithm steps between client and server will be sufficient to thwart reverse engineering. (On the other hand, don't underestimate the creativity of the world - it is not that difficult for another inventor to independently arrive at the same algorithm.)
    – rwong
    Jan 13, 2013 at 2:00
  • Obfuscation, FTW!
    – Jim G.
    Jan 13, 2013 at 2:13
  • Bah. The thing with obfuscation is that some people are experts and particularly those who love reverse engineering. It's just more fun to those guys.
    – ApplePie
    Jan 13, 2013 at 2:15
  • Related from SO: stackoverflow.com/questions/4189245/…
    – apsillers
    Jan 13, 2013 at 3:21
  • and: stackoverflow.com/questions/6159875/…
    – haylem
    Jan 14, 2013 at 11:06

1 Answer 1

12

Well you can "obfuscate" the code by removing all recognizable names that are not essential to the working of the code. (And minification is a good approximation to obfuscation.)

However, the fact remains that Javascript must be delivered (to the user's browser) as source code that is ultimately compilable and executable by the browser. That means that someone who controls the browser will always be able to reverse engineer any "secrets" embedded in the code ... and that includes secret algorithms.

(Incidentally, this applies to ALL methods of delivering algorithms. If you don't control the execution platform, any mechanism for protecting or hiding a secret algorithm can be broken ... given sufficient time and motivation.)


The solution is to not embed the algorithms. Keep them server side and have the browser make a call to the server to run them.

Alternatively, use a legal solution: require all users to sign a legally enforceable agreement that has "teeth" ... and enforce it vigorously! (WARNING: this won't make you popular with your users ...)

2
  • So ultimately I'd better take a little more time and develop my solution using mostly PHP and use only Javascript for the essential JS stuff. That's what I thought but I wanted to make sure. I'll just wait a bit before allowing check mark but it does seem like the answer I needed.
    – ApplePie
    Jan 13, 2013 at 2:09
  • 2
    Or you can run JavaScript on the server side. Jan 13, 2013 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.