metlo VS javascript-obfuscator

So far, I’ve been using Metlo's protection features to initially test out its capabilities on my app, but there’s still a whole other Testing feature that it has that I'm starting to look into. Everything I’ve tried out has been pretty quick and easy so hopefully I can play around with the Testing more to help me catch any other authentication or authorization vulnerabilities that might exist in my app. If this is something that interests you, you can check it out at https://metlo.com .

* Once you have the right templates you can build rules to apply these templates to many endpoints at once (https://docs.metlo.com/docs/test-rules). This makes it possible to write hundreds of tests against your API in just a few clicks :)

We have more info on our docs here: https://docs.metlo.com/docs/writing-a-test. And here's a demo video if you’d like a quick walk-through :) https://www.loom.com/share/f342f186e756489aa7a500be875a5539

We’d love to hear your thoughts!

[0] https://github.com/metlo-labs/metlo

Our website is at https://metlo.com, repo is at https://github.com/metlo-labs/metlo. There’s a demo video here: https://www.loom.com/share/2c38c731cf044288995e5ee2566528a7. Check out our sandbox at https://demo.metlo.com (no email required). You can get started with our hosted service (in Beta) for free at https://app.metlo.com/signup (there’s an always free tier, and paid tier is not enforced yet) , or you can self-host by following the instructions at https://docs.metlo.com/docs/deploy-to-aws.

I don't need/use IDA, Nemlei just used https://obfuscator.io/, which just obfuscates the crap out of the code using various known methods (which I won't go into detail, it's public knowledge) and an un-obfuscation was cooked up by others. The one fucked-up thing the website does is randomizing function names, it just changes every variable/function name. We can't "un-obfuscate" those, so it's up to our brains to figure out what the code does, and change the names back.

I was considering using a obfuscation library (https://github.com/javascript-obfuscator/javascript-obfuscator) and noticed in the usage example that backticks are used and the javascript is enclosed within. The issue is that my javascript already has backticks from using template literals so my code then errors out.

Obfuscation: JavaScript Obfuscator

What I ended up doing is having two build steps, one for renderer and other for the main process, in the main process build I use https://github.com/javascript-obfuscator/javascript-obfuscator. Works pretty fine.

It's to purposefully makes your code harder to read so it prevents people from stealing your work. Here's a tool that does it: https://obfuscator.io/

I just tested it on a little snippet of my code obfuscated with https://obfuscator.io/ and it worked seemingly perfectly.

My original code:

  function resizeImage(img) {

https://obfuscator.io/ produces a similar result, perhaps that's all they used.