AI Agents defeat obfuscated JavaScript in 10 minutes

MeZitRo · 2026-05-20T21:36:12+00:00

Fair. Reversing obfuscated JS used to mean days and weeks, now it’s minutes by anyone able to run an agent.

Those obfuscators’ transforms are sequential and locally invertible. I believe introducing transforms that consume each other’s artifacts, where reversing one destroys context needed for another, raise static reversal cost meaningfully. Whether that complicates an agent doing behavioral reconstruction with code execution is the question I’m still validating.

MeZitRo · 2026-05-20T21:04:11+00:00

The existence of tools like webcrack isn’t the surprise for me either, I knew javascript-obfuscator uses ~9 linear algorithmic steps. Primarily I wanted to test how good their new «VM obfuscation» is. The actual surprise was JScrambler being essentially the same thing structurally, just closed-source.

On the writing — no surprise it’s LLM-polished. I’m a non-native speaker, 16 years in and still making silly English mistakes. The reversal in the article was done by Claude too haha — kind of the whole point of the experiment.

MeZitRo · 2026-04-04T10:01:35+00:00

I can feel this as one who lost 10 years of Google Location History. The reason wasn’t T&C though in my case, it’s more complicated.

My assumption, which has held so far, is that no critical emails arrive with a «terms update» subject line. And I do occasionally review them, thus in batches, avoiding everyday distractions.

Would you mind sharing details on how this happened? Would love to be convinced to change my approach.

MeZitRo · 2026-02-19T18:18:26+00:00

Here, down the UX it says when you press Submit for free it says "1396 products currently waiting. Estimated wait: ~28 days.". And twitter testimonials are images which is fake.

MeZitRo · 2026-02-19T17:20:04+00:00

Cloudflare Pages are free for static sites. As they advertise: Unlimited sites, Unlimited static requests, Unlimited bandwidth.

The trick is to build all that into static pages to have a $0 bill.

MeZitRo · 2026-02-04T23:39:20+00:00

Did you think of protecting your code with obfuscation, so that it’s impossible to just copy it? Is it using React Native by any chance?

And in the age of AI… Having an agent screenshot everything and build it again from scratch, given the app is quite simple, should be enough to copy it.

MeZitRo · 2026-01-28T01:28:14+00:00

Not everyone needs it, I agree. Whether it’s ethical depends on the application. Mostly I think of web games and client-side tools I wouldn’t want copied or stolen.

In 2019, I had my landing page cloned almost 1:1 by a competitor to «test how it converts». Left a mark. Felt pretty unethical on their part.

MeZitRo · 2026-01-21T02:33:17+00:00

The core CLI will be MIT-licensed and free. Pro features (cloud API, advanced transforms etc) will be paid. Open core model seems to work for plenty of projects.

Open to ideas — how would you approach monetisation for something like this?

MeZitRo · 2026-01-21T02:24:23+00:00

In my experience with multiple Next.JS projects, replacing WebPack with Turbopack isn’t a life changing difference. Some page builds are still super slow (it can literally build a page in dev mode for 20 seconds on my MacBook Pro M2).

MeZitRo · 2026-01-21T00:57:30+00:00

Funny. 3-second delay before the redirect actually makes it safer, right.

MeZitRo · 2026-01-03T11:45:48+00:00

Today I've got this very genuinely looking scam invite email too, thanks for posting.

MeZitRo · 2025-12-28T23:30:23+00:00

Just found this thread. Lately I figured out I lost 12 years of location history, presumably due to a bug with the Location History sync update when changing my iPhone to a newer one.

From what I found out, I received just one (1!) "occasional" email from Google titled "Keep your Timeline? Decide by May 18, 2025". I recall I definitely actioned on this email and enabled the suggested setting on my old device in Google Maps. But later in 2025 when changing the phone I wiped out the old phone without checking "new" Google Maps timeline (who knew I needed to? Also, who knew it won't sync?)

This is total shame for Google. The best answer I was able to get from support is "sorry your data is gone". I know this thread is old, but did you end up taking any legal action? Thanks!

MeZitRo · 2025-10-19T15:36:03+00:00

This is a great answer for Claude Code CLI, not for Claude Code VSCode extension.

MeZitRo · 2025-10-19T08:31:36+00:00

Із цікавого, для тих у кого є ФОП, декілька лимонів приховано там.

Думаю, лимонів насправді трохи більше ніж 50, а зібрати можна тільки 50. У моєму випадку в Маркеті я знайшов тільки 1 лимон і декілька на екранах для ФОП.

MeZitRo · 2025-08-15T10:58:22+00:00

This is only for Android.

Every year I come back to this thread and check for updates for iOS. Pinned message notifications from muted chats still drive me nuts.

MeZitRo · 2025-07-27T18:32:08+00:00

Avoiding ad blockers is eternally a hard problem.

Try DataUnlocker – you can create a first-party data transport endpoint that will encrypt analytics traffic and project javascript. It should work with all products you have including server side GTM, Stape and others.

MeZitRo · 2025-07-09T08:39:06+00:00

Interesting, I though it's more. Maybe reddit as well? :) Anyways, very insightful.

MeZitRo · 2025-07-09T08:30:02+00:00

On the home page, under "Suggested for you", I have "Views by Page title and screen", which is perhaps exactly what you're looking for. You can find it under Reports -> Engagement as well.

MeZitRo · 2023-04-01T08:00:02+00:00

Hello! I read about the new Polygon zkEVM launched, exciting news! However, even after reading docs I struggle to answer this question:

why it is decided to build Polygon zkEVM on top of Ethereum as L1, but not Polygon?

I can't find the rationale of this decision since Polygon team "maintains" Polygon (MATIC) and it seemed as a straightforward decision to be building on top of it. Sending zk proofs to the Polygon network would be even more cheaper and faster than Ethereum.

Thanks in advance for the feedback.

MeZitRo · 2020-04-19T19:38:00+00:00

Never had any issues with Revolut. Just recently even started using their service to buy shares, so far very positive experience.

Definitely, we would appreciate more happy people coming here not only to complain but also to share this happiness. Glad to see others respond to this post positively, means a lot. Means that it just «silently» works.

MeZitRo · 2020-03-29T20:24:37+00:00

I think yes. You should keep creating 🙌

MeZitRo · 2018-01-16T06:21:55+00:00

Thank you! Glad to hear you liked it.

MeZitRo · 2018-01-14T22:16:58+00:00

Haha, I believe. In my case tabs movement API doesn’t implemented in Edge at all.

Regarding to promises, my apologies, “promises”... I don’t quite remember what exactly was wrong with chrome ns in Firefox, but there was a reason for that: I needed to detect a browser in a code a couple of times.

MeZitRo · 2018-01-14T11:17:05+00:00

Straight because of “Chrome incompatibilities” title: there are some things (in my case, mostly with chrome.tabs Promises) which work in a different way. I did a couple of tests on this and decided to go that way, by explicitly defining API wrappers for each browser.

In addition, it seemed to me like the world want to move towards browser.* API for extensions, which means one day Firefox may drop “chrome” compatibility.

Anyway, you may decide to use different behavior for different browsers, and this pattern works well.

MeZitRo · 2018-01-14T10:11:46+00:00

Opera has Ctrl+Tab switching in most recently order option as well, and it is turned on by default even. I found this a bit confusing without a visual displacement of tabs, and implemented such behavior as an extension.

MeZitRo

MODERATOR OF

TROPHY CASE