Re:Security concerns with minified JavaScript code
by tomjakubowski on Monday August 31, 2015 @08:50PM
(#10150062)
Anecdotally I've heard of cases where minifying a script (running through the "uglify2" tool) led to extreme and obvious performance issues (like the UI thread freezing for several beats in cases where unminified JS did not).
Re:Security concerns with minified JavaScript code
by 6t6t6 on Monday August 31, 2015 @09:25PM
(#10150185)
In that case, the problem doesn't happen because we are minifying the files, but because this particular implementation of the minifier has a bug. I guess...
Re:Security concerns with minified JavaScript code
by tomjakubowski on Wednesday September 02, 2015 @03:55PM
(#10161528)
In particular, it was only an issue when identifiers were mangled (i.e. made as short as possible).
When you already have a pipeline like gulp or grub (and if you are developing JavaScript, you should), adding minification is just one more line of code. So, why not minify if it doesn't represent any effort and it could mean better performance? Also, usually, developers don't have access to the production webserver.
Most of the time, people are to busy to analyze all the pros and cons of every action they do.
Said that, if Debian is an open source OS, then yes, they should have access to the unminified code of the applications they include. Or, at least, the sourcemaps.