Re:iHeartRadio web has exposed all its source code
by 4ggr0 on Friday November 21, 2025 @09:00AM
(#46004684)
Immediately had to think about the Apple Web Store which seemed to have the same "issue" two weeks ago[0]
I guess the same thing[1] applies here.
> This is not "exposing" their source code. While yes, it may not be minified and it's slightly more human readable, it's not exposing any additional logic. Remember, obfuscation is not security.
Re:iHeartRadio web has exposed all its source code
by graemep on Friday November 21, 2025 @10:33AM
(#46005463)
That is somewhat different as it required brute forcing IDs and his conviction was overturned (although the reasons do not establish a clear precedent).
Re:iHeartRadio web has exposed all its source code
by isodev on Friday November 21, 2025 @10:08AM
(#46005272)
The reason for minification is not hiding the source code (which is impossible), but to reduce the payload size served to clients. Web pages (even web apps) are documents fully available to clients where users can choose to view, inspect and even modify their source code.
Re:iHeartRadio web has exposed all its source code
by TheAceOfHearts on Friday November 21, 2025 @09:18AM
(#46004848)
Honestly, I think including source maps for your frontend code should be the standard. Maybe web apps will get better if people can actually start studying existing frontend sourcemaps to learn good patterns which are being used in production by companies with lots of experienced engineers. Tons of people love to complaint about terrible web apps, but finding high quality web app examples to study and learn from is actually really difficult! Let's not pretend that the trivial todo-apps are where you're gonna go to learn anything about how a real-world app is organized.
I think this title is misleading, it makes it seem like more than just the unobfuscated code has been exposed.
Re:iHeartRadio web has exposed all its source code
by cxr on Friday November 21, 2025 @09:19AM
(#46004864)
Yes, the repo creator's tone is obnoxious.
> Remember: Always disable sourcemaps in production!
Or don't. There is a non-zero possibility that this wasn't even an accident.
One has serious doubts that the person who wrote this even understands (and can articulate the reasons) why they have this position.
In any case, GitHub isn't an unredactable, append-only ledger. "Archiving" this on a site that is no less subject to DMCA takedowns than any other site but that differs from other sites in having exceptionally fast response times to takedowns is not an especially well-thought-out move.
I guess the same thing[1] applies here.
> This is not "exposing" their source code. While yes, it may not be minified and it's slightly more human readable, it's not exposing any additional logic. Remember, obfuscation is not security.
[0]https://news.ycombinator.com/item?id=45804664
[1]https://www.reddit.com/r/webdev/comments/1onnzlj/comment/nmy...
However I agree that in the end outside of making it more readable, it's not making a huge difference.
This is front-end code, that gets deliberately sent to the browser. With enough work, someone can deobfuscate such code manually.
I think this title is misleading, it makes it seem like more than just the unobfuscated code has been exposed.
> Remember: Always disable sourcemaps in production!
Or don't. There is a non-zero possibility that this wasn't even an accident.
One has serious doubts that the person who wrote this even understands (and can articulate the reasons) why they have this position.
In any case, GitHub isn't an unredactable, append-only ledger. "Archiving" this on a site that is no less subject to DMCA takedowns than any other site but that differs from other sites in having exceptionally fast response times to takedowns is not an especially well-thought-out move.
I wish I could downvote this comment from the README.
Minification to reduce bandwidth is noble. But to obfuscate? Why?
https://htmx.org/essays/right-click-view-source/
the web is an open platform, sorry