Obscure/Protect Javascript Source Code in Windows 8 Apps - javascript

As you might know, in Windows 8 (Metro/RT/WinJS) apps, when they are acquired from the windows app store and installed to a local computer, all the original source code javascript files are clearly viewable in the windows filesystem.
As such, is there some way that I can obscure, hide, or protect the javascript code so as to avoid the possibility of it being stolen and used to make a new app?
At the very least, I'd like it to be a bit harder than for someone to just open the folder and read the code in it's original state....
Thanks!

I wrote up some notes on the options you have for Windows 8/8.1: http://www.kraigbrockschmidt.com/2013/04/04/protecting-your-code/. Windows 10 might offer some better options. For example, the Hosted Web App option described on http://blogs.windows.com/buildingapps/2015/07/06/project-westminster-in-a-nutshell/ will let you keep lots of code on the server. But I haven't looked at everything that's being done there.

Look into minification[1], like the Closure compiler: http://closure-compiler.appspot.com/home
[1]http://closure-compiler.appspot.com/home

Related

VS Code: How do I synchronize workspaces between multiple systems?

Update:
It turns out that what I really wanted was to be able to do remote development on my laptop, and - if I also did something local on my robot, to have the changes show up on my main development system.
Ref:
This substantially similar question was asked about 10 months ago and has received no replies since then.  As there have been a lot of improvements in VS Code since then, (and since Stack Overflow discourages "Me Too!" replies), I have decided to re-ask the question in hope that someone will notice it and reply.
Viz.: https://stackoverflow.com/questions/60034690/how-to-sync-workspace-folder-beween-host-and-remote-target
Environment:
A Windows 10 system running VS Code, both current as of this instant date.
A Raspberry Pi based robot, (a GoPiGo3) that has the remote development using SSH software installed that allows my Windows 10 system to communicate with it via VS Code.
I have made an exact copy of the workspace environment, in its entirety, including the enclosing workspace folder, from the Windows 10 system to the robot, using FileZilla.
My previous workflow was to develop on the Windows box, transfer to the robot, run on the 'bot using Thonny, note any errors and either fix them in-place, (within Thonny), and transfer back to the Win-10 machine or fix within Windows 10 and transfer back to the 'bot.
"Clumsy" is a masterpiece of understatement.
Now that I have set up Remote Development on the bot, I believe I can escape most of that.
What I notice is that within the robot's copy of the workspace, most, (if not all), of the files are now either "modified" or "untracked" and updating my GitHub repo from the 'bot will cause all kinds of confusion.
What I want is the ability to develop on either platform seamlessly. (i.e. Changes made on the one are automagically reflected on the other when next connected.) And I want to do this in such a way that the commit and/or change status is accurately reflected on both machines.
I could go into a long explanation as to why this is useful to me, but this question is long enough already.
Any help would be gratefully appreciated.
OK people, I think I have this figured out.
Lesson #1:
It turns out that my original problem was actually more about workflow and "what's the best way to do a specific something", as opposed to how to do dual-development.  So, in essence, I was asking the wrong question.
Lesson #2:
You do not have to install the entire VS Code IDE on the remote device.
That's the original mistake - I misunderstood "install VS Code on the remote device" and I installed the IDE itself in both locations.
The result was that it slowed down the robot so much that it was unusable.
Having more than one instance of the VS Code IDE installed created confusion about what was happening where.
Lesson #3:
I did not realize that VS Code can install a small server module, (like a shim of sorts), and do some SSH magic on the remote device that allows VS code to use the remote device as if it were local to your main computer or laptop.
What you do is open VS Code on the local device, and then tell it you want to connect to a remote device for development.
Once you have that sorted out - this is very site specific and a web search is your friend - you can edit code and even execute code from your local computer and have it run on the remote device as if you were physically there.
In my case, (after experimenting with several different ways to work on my projects), I discovered that placing the VS Code IDE on my Windows based laptop and the "server", (shim) module on the robot, (with the appropriate extensions installed), provides an almost seamless environment that doesn't appreciably load the robot's processor - a Raspberry Pi 4.
Make sure the workspace on the local computer is fully up to date on GitHub (which is where my project repo is located).
Install the requisite VS Code remote development modules and make sure you can communicate with the remote system.  Exactly how to do this is specific to your environment.
Either "sync" or "clone" the relevant GitHub repo down to the device using the remote dev tools in VS Code as if it were your local box.
Note that this is very system and site specific.  VS Code does a good job of helping walk you through this, and a web-search will rapidly clear up any lingering questions or issues.
Eventually you will have a fully up-to-date version on the remote platform.
When this is done, you won't have to mess with manually syncing code as the code is already on the 'bot. All you do is edit code on your local machine, (my Windows laptop for example), and run it from VS Code.
An additional advantage is that if you have to duplicate or clone the robot's workspace, or restore the workspace from a backup, (you DO have your projects in a separate folder don't you?), all the "vscode" and "git" information is located there too and you can re-open your project after moving it with everything intact.
Additionally, if you have VS Code set up on different machines in different places, it might be possible to connect to the same server endpoint and have the same environment available.
(i.e. One installation on a desktop at work and another installation on a laptop for use on the road, (or while quarantined), both connecting to the same server endpoint.)
Note: I have not done this personally and it might require further research.
What I ended up doing, workflow wise, is that I do the lion's share of the development within VS Code,executing remotely on the robot itself.
Sometimes, if I want to try a quick and dirty fix, I'll "break the forth wall" and open an editor directly on the 'bot itself and it automatically shows up as "modified" within VS Code.

Protecting Apps with Apache Cordova MS VS Extension on App Stores

Just have a question about apps that are uploaded on the Windows Store, Andriod Store, and Apple Store. I have never built an App before for any of the three stores, but the Multi Hybrid Extension for Visual Studio seems to be a great start to cover all three Platforms.
How do I protect my code for apps that are uploaded to the three stores? The core development for the Apache Cordova extension is done in HTML5 and Javascript. On a regular HTML / Javascript website, the end user can simply right click and View Source of the page and see all the code I've written.
My question is, how is this protected for apps that are uploaded to the app store? Will someone be able to reverse engineer my application and get the code and simply re-sell it?
Thank you all for your time
You want to, develop once, deploy many. Then, you’ll want to use HTML5 to do it.
You can use Apache Cordova directly, but you’ll want to use a service like Telerik AppBuilder, Adobe Phonegap or Intel XDK.
Regarding your question, your best bet is to use a good JavaScript source code obfuscation service to protect your sources before publishing. There is no such thing as a 100% full proof solution when it comes to JavaScript obfuscation, but professional tools such as JScrambler can take you a long way. At least JScrambler I know that it supports Mobile and HTML5, which is good because they make sure the resulting code is compliant.
There are other tools, even free ones. But be careful though, there are tons of other tools that do obfuscation, encoding/packing or minfication that seem to provide protection, but are reversed in a few minutes. So, unless you really know how to tell the difference, I recommend that you rely on a professional service.

Windows 8 Metro and Google Analytics

Will it be possible to use the Google Analytics JavaScript library (https://developers.google.com/analytics/devguides/collection/gajs/) for the Windows Metro JavaScript based application to trace views accessed by user?
In general, if a JavaScript library you want to use is on a CDN or a server external to your app, the answer is no, as Windows apps written with HTML/JavaScript cannot load external JavaScript libraries...if you try, a security exception will occur.
Many libraries will work fine if you copy the JS file into your project and run it locally. For example, jQuery works just fine this way. I have not tried the Google Analytics library, so you might just want to test it out and see if it will work with a local copy.
Something else to consider, however, is that unlike a web site, a Windows app written in HTML/JavaScript may occasionally be offline, in which case, a library written with the assumption of network connectivity would likely not work. So in this particular case, you might not get the data that you're hoping for.
Hope that helps.
we tried http://w8ga.codeplex.com/ (w8ga) to work with GA in our win8 js app.
Currently W8GA seems doesn't support html/js. Also I have no idea why developer didn't mension it( it's supports only c#/xaml metro app )
So, we found another way to do it; Look for cobra Tab 's answer at the bottom of this page: http://social.msdn.microsoft.com/Forums/en-US/winappswithhtml5/thread/f81ebbb9-d711-40f1-8a82-9aed44e2d8fe/
And finally, we are waiting Adobe's Omniture sdk:
http://microsite.omniture.com/t2/help/en_US/sc/appmeasurement/winrt/index.html#Developer_Quick_Start
Hope these answers helps...
We're using the free version of markedup in our applications with great success. In addition to simple page views it shows you some app specific numbers like number of installs, exception details, etc.
I'd recommend using the Google Analytics SDK for Windows 8 and Windows Phone. It is built as a WinRT component and therefore supports both JS & Xaml Win8 apps.
Full disclosure: I am the author of this SDK; I built it for my own app and decided to open source it. There are other frameworks out there but AFAIK, none of them support the new GA universal analytics protocol so they only work with older GA properties and don't support all the cool new features GA recently added just for apps.

GUI Tool to test javascript

I am looking for GUI/Windows based tool to test my javascript code there instead of using firebug or other in-browser tool.
I want to play around with javascript language outside of the browser to learn more about it.
Has anyone come across such tool? I could not find one :(
Edit: I am looking for GUI/Windows based on which can be used even if I am not connected to internet and still play around with javascript.
I'm a big fan of jsFiddle.
jsBin is another option.
Microsoft Web Developer Express is free and has a great JavaScript editor and debugger.
If you're looking for something that you don't need to be connected to the internet for, why can't you just use your browser? I assume you've already got some kind of development platform now. Save to a local HTML file and view it on your local browser.
Do you not have some kind of a GUI development program like DreamWeaver or CODA or something like that? (I'm on a mac, so I'm not familiar with a lot of windows based programs).

Best ways to develop painlessly in Javascript on a local machine

I'm pretty new to workign with Javascript.
In most languages you can run the code quickly locally on your machine. From what I've seen, in JS you generally only use it via the browser, and so I've been uploading my code an viewing its effects in the browser. This has proven very tiresome. Also, if I mak one error, it seems like my JS/JQuery will just do NOTHING, instead of giving me a useful error, message, which is making it painfully slow to code in.
IS there some way to run JS locally to see that it is working as I go? And then only upload it to the web when I'm mostly done? What ways are there for me to do this? What ways aer there for me to unit test the Javascript locally? Say I have some JAML that should render as <p>HI</p>, how do I run this locally in a unit test?
Thanks for the help,
Alex
EDIT:
Thanks for all the great suggestions. I'll have to take a bit of time and go through them to see which ones best help me in my situation.
Since you're using jQuery, I assume that you actually want to manipulate the various elements on your page. So depending on your specific development enviroment, uploading it each time is probably the way to go anyway. If you can set up a dev enviroment on your local machine (not always possible) then go with that.
As an actual answer to your question, I suggest using Chrome's developer tools, it doesn't just have the console, but an element inspector, and a resource tracker (resource tracker is invaluable when working with JSON and AJAX, since invalid json will fail silently)
As far as I know, the firebug plugin for firefox (dont use it myself) has a similar feature set, so if you're more comfortable with that go with it.
Just remember, as a developer, your development (and debuggin) enviroment is just as important as the code that you are writing.
EDIT: Noticed that you mentioned unit testing. There are several unit testing frameworks out there for JS including one that integrates with firebug called FireUnit. Do a quick google search to find more if you want.
You don't need to upload the JS file to a server to test it. Just write an html and declare the js binding
<script
src="js/yourJSFile.js"
type="text/javascript"></script>
Edit the JS file in your favorite editor and then refresh the page to test it.
For unit testing the best option is Selenium. It allows you to record an interaction with the browser and then play it back.
You can use Firebug with Firefox to debug JS, and Google Chrome has a debugger built-in (use the Tools -> Developer Tools menu).
You can run Javascript from the local file on your machine in your browser, so you can skip the uploading step.
Also, I'd recommend using Firefox/Firebug combo for developing Javascript as it will be very handy, especially for the part you mentioned about not seeing what's going wrong with your code.
Even if you upload your javascript it gets downloaded back to you as soon as you visit the webpage that invoques it. Its run client side always. So stick to local and use firebug as the others have said. Google`s developer tool is quite nice too.
In the browser if you open the developer tools, follow the following steps:
1) Navigate to sources
2) Under sources, click snippet and open run.js
3) You can use run.js to write as much code as you want and run it locally only to see if your code is working or not (it will give you output on the console)
4) Also you can get used to some keyboard shortcuts to make it faster for you.
5) For small javascript codes, you can navigate to console and run your code there
If you want to do unit testing with Javascript there are extension of Firebug that can help you with that. I haven't try any of them, so I can't really tell you which one are worth considering, but you can easily find them if you search for the keyword "Firebug unit testing" on Google.
What seems to be comming on top is FireUnit. You can find some information about how it works here.
Consider Spider Monkey, which is a javascript engine separate from a browser. If what you are developing does not involve rendering to a webpage or can be separated from the rendering code (good practice!), then this could be useful.
I prefer Chrome to Firefox and I just found Web Server for Chrome.
It's just a Google App that quickly sets up a web server for you and will be set up anywhere you are logged into Chrome. It only allows file access to your current devices, or if you specify, other devices only on the current LAN.
You just point it to the directory with your index.html file and type http://127.0.0.1:8887 in your browser.
Additionally to the answers given you can use Jasmine for automated testing.
A tutorial that seems to help get started with automated testing on Jasmine is provided by Evan Hahn.
I used it and for me it works like a charm. Especially if test driven development is what you are going for!

Categories

Resources