7
\$\begingroup\$

I had posted an "obfuscated rickroll in Greasemonkey" challenge, which I have deleted in response to Mike Bethany's comment that answers to the question would be of primary use to "spammers." In general, I feel that a primary issue is that of obfuscated JavaScript, so I would like the community's input.

Why should we allow obfuscated JavaScript? JavaScript is a programming language like any other, and code obfuscation is a valid and on-topic challenge on this site. Would we not allow obfuscated Python, Lua, or C#?

Why should we not allow obfuscated JavaScript? JavaScript is essential to many web browser security exploits. It is already hard enough for antivirus software and firewalls to detect malicious payloads obfuscated using common, simple techniques; we shouldn't make it any harder by describing any "new" ways to obfuscate JavaScript code.

Which has more merit?

\$\endgroup\$
  • 13
    \$\begingroup\$ We shouldn't allow C either, it can access our hard disk! \$\endgroup\$ – user11 Feb 4 '11 at 16:12
28
\$\begingroup\$

I don't believe in security by obscurity.

If the only way (we think) we keep web browsing safe is by "not disclosing" ways to make obfuscated JS, I dare say the black hats are quite a few steps ahead of us.

So, in my personal opinion, you should reopen your question. :-)

\$\endgroup\$
13
\$\begingroup\$

isn't the point of code golf to solve in a few characters as possible?

If so, isn't obfuscation part of the game?

\$\endgroup\$
  • 1
    \$\begingroup\$ The original name of this proposal was "Code Golf & Programming Puzzle ". \$\endgroup\$ – HoLyVieR Feb 8 '11 at 22:09
  • \$\begingroup\$ @HoLyVieR so you are saying that it is also about puzzles? so? can you expand on your point? \$\endgroup\$ – cbrulak Feb 8 '11 at 22:47
  • \$\begingroup\$ Nevermind, I misread what you said. \$\endgroup\$ – HoLyVieR Feb 9 '11 at 3:54
6
\$\begingroup\$

If you can run in a sand box, either one of your own or one someone else maintains on the internet, the question of malicious code becomes less of an issue (note I generally don't run anything from this site until I have a vague idea what it is up to).

\$\endgroup\$
  • \$\begingroup\$ The JavaScript sandbox is not impenetrable, as new security exploits are regularly discovered. In fact, Mozilla just released an update to Firefox to patch some holes. mozilla.org/security/announce \$\endgroup\$ – PleaseStand Mar 2 '11 at 21:48
  • \$\begingroup\$ @idealmachine: Of course. You're not going to be able to run unknown code with no risk. \$\endgroup\$ – dmckee Mar 2 '11 at 22:29
3
\$\begingroup\$

I think we should allow it. You can always run the code through jsBeautifier, which unobfuscates the code.

\$\endgroup\$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .