I don't think OP was defending their own earlier work or otherwise exempting it from their assertion that all obfuscated code should be considered malicious.

Having reread it, I think you might be right.

> it's only admissible for hiding machinery from the general public.

I had originally read this to imply that somehow it's OK for a casino to hide its machinery from the general public, but it's not OK for TikTok to hide its machinery from the general public, but maybe "machinery" here is intended much more narrowly, and OP thinks it applies neither to casinos nor TikTok.

I read it as the only "legitimate" point is to hide it from the general public. As people with more resources will be able to figure it out. If you view that as legitimate is up to each person to decide. Does the value of trying to hide it from the general public have real value or not. In general the answer might be no.

"General public" was really the wrong term. I meant people with the ability to decompile and use assets or portions of the code for their own games. This was in the early years of Bitcoin when fly-by-night casinos were sprouting up everywhere. Most of them were really badly coded - e.g. the slot machines looked like they'd been drawn by a six year old. Others looked like legitimate casinos, but were actually running cracked versions of white label software. Ours was the only in the space that had a large, professional, fully original codebase... that was what I meant by "machinery", not the machinery governing user interactions with the server (see my response above).

That's how I read it too. I had the feeling that the experience convinced the OP that it's not valid except in some circumstances.

Because they're doing it on hardware that they control.

I think the distinction in what's obfuscated is important. Casino apps are trying to hide their code that detects cheating, number generation, etc, while TikTok is trying to hide its data collection. Obfuscation itself isn't necessarily bad.

> Number generation

Number generation is extremely important and it's also regulated. You don't put such a thing in the client obfuscated or not.

Cheating detection was essentially all conducted on the back-end in my casino, but I do think there's a use case for obfuscating some front-end monitoring, e.g. for bot-like inputs. We didn't explicitly ban poker bots, but we didn't make the API guide public, either. The cheating we were most concerned with was poker collusion, which could be detected by combing the log files for certain patterns of play correlated between users or IP addresses.

Random numbers are never generated in the client. Ours were generated on dedicated server separate from anything else - in a different country, for legal reasons - whose sole purpose was to generate random numbers on demand.

Parent / casino founder here. The casino specialized in original, exotic games. The obfuscated portions of the front-end were game modules (including art assets) that were loaded after login. We had several games that we were filing for patents on. We were also in talks with a much larger online casino about licensing individual games and/or the software as a whole to them. The purpose of the obfuscation was to make it harder for competitors to decompile and get at raw assets or read the math by which the game mechanics worked. For instance, we had a 3D slot machine based on a Rubik's Cube that paid out based on the odds of being able to solve one side in N steps from any given randomly scrambled position. That algorithm had to exist client-side to calculate the odds visible to the user in realtime, along with server-side for confirmation against someone trying to cheat in the client.

I felt it was important to make it as hard as possible for someone to reverse engineer the unique mechanisms. Ultimately, it was probably a waste of time. This is why I think in most cases the uses of obfuscation are at best limited, but they can put a costly stumbling block for competitors if you want to encourage them to license your software rather than copy it. Where I think they tilt toward the nefarious is when they're designed to extract hidden data from end users. As a distinction, what went over the wire between the client game modules and the casino back-end were completely human-readable game states in all cases (besides the user's unique ID and session hash, which were named as such). There were no bullets of obfuscated fingerprints flying around. Any user was free to read what came and went from the API, and even to mess with it by adjusting parameters if they wanted to see what the server would accept or reject.