Hide source code possibility

[darky]

I mean about executable container, which not allow to show source code.
Not offer obfuscation

[Mithgol]

The users will have that container and the open source decoder (which is node-webkit) and the key (if there is a key), because node-webkit needs to open that container somehow (in order to execute its contents).

How do you expect the container's contents to remain concealed then?

[aesposit]

@Mithgol
My suggestion is to add the capability to compile the js&css files in the exe executable as embedded resources and then use them internally as custom NWURL.
Something similar to this : http://www.developer.nokia.com/Community/Wiki/How_to_Embed_Resources_in_the_Application_Executable

[graphnode]

My suggestion is to add the capability to compile the js&css files in the exe executable as embedded resources and then use them internally as custom NWURL.

Aren't executable resources even easier to read than just appending a zip file to node-webkit like it happens in the Windows deploy?

[aesposit]

@graphnode
the problem is that the zip file is extracted in the temp dir and so easily readable.
BTW if you have hackers cracking your apps probably nothing can stop them.
What I would like to achieve is making hard (not impossible) to see my code.
I am trying to use this process in Windows:

1. Encrypt your js resources with a unique desktop key (I use node-ffi with a HW HD serial number dll)
2. Embed those resources in the exe (normal users don't know that)
3. Launch the exe and it internally in memory decrypt/loads the resources in the nw browser/node context

Any suggestion is welcome

[darky]

I front-end dev and don't want to show my source (HTML/CSS/JS) customers up to get money.
But they want to see state of project and I have next idea: to give customes special build of node-webkit (Windows) with next features:

1. without toolbar, plugins, e. t. c. superfluous...
2. open my server resource by https
3. with special user-agent password, which checked by server

How to create this build:

1. Build node-webkit master branch with features
2. Use Visual Basic Script:
   CreateObject("Wscript.Shell").Run 'nw.exe --no-toolbar --url="https://my-server.herokuapp.com" --user-agent="lhMf4Tct78ro08r74hUTR88bJ258FI" '
   This script exported in exe with ExeScript for example

[rogerwang]

It should be possible to 'protect' the JS code with something based on v8 snapshot. We'll see this feature, but some contract is still suggested to protect your IP by law.

I can see a standalone tool to compile the code into v8 snapshot and the support in node-webkit to load them on start.

[nprbst]

+1 for V8 snapshot support!

[robgrz]

I understand that this would just be an annoyance for someone who is truly dedicated to getting your code/source or copying the program but it would be a major roadblock for many people.

It would be a big benefit for some of the applications we've been looking at using node-webkit for.

+1 for me

[rogerwang]

Please see the document here:

https://github.com/rogerwang/node-webkit/wiki/Protect-JavaScript-source-code-with-v8-snapshot

Comments are welcome.

[rogerwang]

This feature was just released with 0.4.2.

[dubcanada]

@rogerwang may I ask why it is limited to such a low amount? If it's based off V8 and using a heap snapshot should it not be limited to maximum heap snapshot size (256mb?)?

[rogerwang]

@dubcanada it's not a hard limit and can be fixed. The reason of the current limitation is that the objects or code has to be in the same page when deserializing.

[kevsmt]

We are looking to use node-webkit on a application, which by nature requires the codes (some) to be compiled, specially authentication of the product limitations, etc. From the wiki; "snapshot": "mysnapshot.bin" I assume only 1 bin file? can this be "snapshot": [ "a.bin", "b.bin" ] ? and what does ~30% slower mean, assuming, the compiled js only returns js code computations or the js also touches ui staff? and the compile js can also access nodejs.require?