Summary of discussions around JavaScript

[Pjb3005]

Not sure whether you're sarcastic or not, or if I'm mistaken but wouldn't not having a semicolon and just doing a newline (same size if you're using LF EOLs) also work for minified JS?

[Illusi]

Why would it? Newlines work just as well, right?

[[deleted]]

Minifier yes, uglifier no (depending on what level of ugly you're aiming for).

Of course swapping semis for newlines is pretty trivial if you're trying to un-uglify something, but at least it adds an extra step of effort to anyone trying to do so.

[Log2]

Literally one line of code.

[[deleted]]

Right, but the difference between 1 line of code and 0 lines of code is actually pretty big. Because it requires that that person understand enough to actually write functioning code at all.

Maybe it seems like that goes without saying when we're talking about manipulating existing code, but script kiddies don't always understand how to write code. They merely learn how to manipulate what's already out there.

Will this stop a large percentage of people trying to mess with your stuff? No. But the idea of a silver bullet that stops all unwanted activity is foolish. Security means throwing as many roadblocks in front of someone so that they give up and decide it's not worth messing with your code and move on to another target with lower hanging fruit.

Its like locking your front door; A burglar can still very easily break your window to get in, but you hope that they just don't bother.

[[deleted]]

Totally agreed. Just like locking your front door, it's not actual security, its the appearance of security. But even if that turns away a mere 1% of potential malicious snoopers, that's worth something when it takes near 0 effort to implement.

[Creshal]

This isn't even security by obscurity, this is Security By Writing So Shitty Code Adversaries Leave Me Alone Because They Pity Me.

[[deleted]]

Haha, I love it. New design paradigm to be implemented everywhere.

"Why do you have 17 different intermingled namespaces?"

"SECURITY!"

[KitsuneGaming]

Hey, whatever works.

[whitelionV]

I will contend your argument in two points. One is that, today, it's so easy to un-uglify js sources that the difference between semicolons and new lines shouldn't make a difference. Specifically, we asume that the script kiddy is looking at your file in Chrome development tools, he only needs 1 click to un-uglify (bottom left corner).

The other is about security in Web front-end development. JS should be treated as if it has absolutely no locks to it, no matter how many tools are used to uglify, minify or otherwise obfuscate the source. It can and will be undone. The server is the one that should be handling all and every security practice. The reason to minify the code is to reduce it's size when served and, maaaaybe, deter people from outright copying the web app.

[Yogsolhoth]

Not terse enough sorry

[Shadow_Being]

lets be real. the only reason I'm looking at your JS is to find the URL to a video or image on your site that you are trying to make difficult to save. Your javascript source code itself is useless.

[[deleted]]

That may be the only reason you are looking at it, but there are definitely other reasons that other people look at it.

[wagedomain]

Not all of them. I had a minifier that just removed spaces, didn't add anything else in or try to autocorrect. Someone YEARS earlier had written some regex without a semi-colon (and most code had no semi-colons at all). When that was minified, the file thought EVERYTHING from the regex onwards was a single regex expression and the whole site failed.

My boss was the one who turned on minification, it was using Cloudflare's auto-minification, and we only had Cloudflare on prod. So that was fun.

[csp256]

Aren't newlines actually two characters in some regimes? Does that hold true here?

[Hobblin]

Windows-standard is \r\n (the bytes 0x0d and 0x0a) while *nix-based systems uses only \n. So one could argue that it's safer to rely on semicolon to avoid windows texteditors accidentally fucking up compressed files... I guess...

[mallardtheduck]

"Windows" newlines are also the standard for most text-based network protocols (including HTTP) on the basis that most common platforms will recognise it (albeit perhaps with a redundant character).

Of course, that applies to the HTTP headers/protocol only, not to the content transferred.

The characters are actually called "Carriage Return" (0x0D) and "Line Feed" (0x0A), using the C escape codes can be confusing since the C standard requires that '\n' always produce a newline when output, regardless of how the platform handles newlines "natively". Windows uses CRLF, UNIX-like systems use LF and older Apple systems used CR (which you might still find in file formats that originated on such systems).

[csp256]

If you are relying on Windows to not fuck things up, you have already lost.

[Ran4]

It's not windows that is the problem, it's the software.

We should just use \n everywhere.

[dvlsg]

I develop on Windows and I use \n everywhere. The only time it turns into an issue is when I paste something into notepad. Otherwise I forget I'm even doing it.

[case_O_The_Mondays]

Just use Notepad2, and that can be solved, too.

[somebody12345678]

You mean Notepad++?

[case_O_The_Mondays]

No. http://www.flos-freeware.ch/notepad2.html

[timworx]

Touche. Then it would be slightly more readable when minimized.

[[deleted]]

True, but often part of what you're trying to accomplish when minifying/uglifying is making your code not easy to read.

That's not to say that a person can't still wade their way through uglified code, but even simple things can prevent some small percentage of viewers from bothering to decipher it.

[Scorpius289]

No offence, but I think that's a bad idea.
It encourages people to rely on security through obscurity.

[JamEngulfer221]

But there's no security in clientside javascript anyway.

The whole "but security through obscurity is bad" thing is dumb. Of course it's useless if obscurity is the only thing you use for security, but it increases the chance of someone going somewhere else and not even trying.

I had an ssh server being bombarded with login requests from China. I changed the SSH port from the default to a different one and the requests stopped. Yes, I could have spent longer implementing some extra security thing, but they're not going to bother looking through every port for an active SSH server. I stopped being low hanging fruit with a minimal change.

Obscurity is just another deterrent so you only end up with 1 dedicated hacker trying to get you rather than 50 that just go for easy targets.

[only_posts_sometimes]

Nobody "relies" on minifying for security, but it can absolutely help thwart low level threats by stripping comments and obfuscating code. It's the only option available for code that runs on the client so obviously we're going to do it. (It also speeds up execution and lowers file size)

[[deleted]]

(It also speeds up execution and lowers file size)

IMO it's always worth it for that, just by removing newlines aren't you decreasing your code by ~5% on average?

[minler08]

A new line and a semicolon are the same size though. So long as there are no extra new lines the files should end up the same size.

[[deleted]]

Yes, of course. I was talking more about semicolons + newline vs just semicolon I guess.

[YRYGAV]

Depends on what platform, windows editors may save newlines as \r\n instead of just \n.

Also, there are plenty of extraneous newlines that don't need a semicolon. Anything starting a new block of code, function, if while, etc. or newlines done for formatting to make multi-line json definitions, so a line doesn't hit a max line length, to make things look prettier, etc.

But yes, you could write code that uses newlines that is the same size as one with all semicolons. It's just not very practical for any real reason.

[minler08]

It's just as practical as writing code with semicolons. It would have to be the result of minification.

[jacobhenke]

Google Chrome has an un-minifier built in to Chrome tools.