Ask HN: Do you protect your client-side JavaScript? Why or why not?
3 comments
I don't think there's much point in obfuscation. If it's a large amount of code then minification and concatenation helps with download size, but for small files I don't bother.
Thanks for the feedback.
Minification and obfuscation solve different problems. Minification is about download size (and somewhat parse/exec speed). Obfuscation is about making code harder to reverse-engineer, patch or copy.
The question is: do you have anything worth protecting? For a simple marketing website, probably not. But if you're shipping:
- A browser game (think of copycats & anti-cheat front end code) - Feature flags that reveal your roadmap - Pricing/discount logic in product companies competitors could copy - Client-side validation algorithms (easily explained by LLMs) - Proprietary algorithms (trading, scoring, matching)
...then "anyone can read your source" becomes a concern.
Does any of that apply to what you build?
Minification and obfuscation solve different problems. Minification is about download size (and somewhat parse/exec speed). Obfuscation is about making code harder to reverse-engineer, patch or copy.
The question is: do you have anything worth protecting? For a simple marketing website, probably not. But if you're shipping:
- A browser game (think of copycats & anti-cheat front end code) - Feature flags that reveal your roadmap - Pricing/discount logic in product companies competitors could copy - Client-side validation algorithms (easily explained by LLMs) - Proprietary algorithms (trading, scoring, matching)
...then "anyone can read your source" becomes a concern.
Does any of that apply to what you build?
The reason: every web app ships source code to the browser — always been analyzable, copyable, patchable. Now with AI able to explain minified code in seconds, I'm wondering if attitudes are shifting.
If you own any web apps or games, do you genuinely care about protecting client-side code? If not, why? If yes, what do you use — or why don't existing tools work for you?
(Context: I'm building www.afterpack.dev — but genuinely want to understand if this is a problem people actually have or if it's rather a very niche problem)