Hiding my javascript

[Simon Wigzell]

I have developed a javascript application that can be used by my clients just by inserting the following in one of their web pages:

<script>
document.write( '<iframe src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>

Anyone looking at the page containing the above will only see the the above lines, not all the javascript source. Someone with a little more savy though could just paste http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their browser and then they will see the javascript.

Is there some way that my PGSampleTable.a sp could know it has been called from outside the iframe and then just not serve the javascript?

Any other way to hide your javascript? (The above is only a prototype, it will eventually be a full costing system for the printing industry - I don't want anyone else to be able to steal it!)

[Zoe Brown]

"Simon Wigzell" <si**********@s haw.ca> wrote in message news:cfFXe.5242 75$s54.368146@p d7tw2no...
I have developed a javascript application that can be used by my clients just by inserting the following in one of their web pages:

<script>
document.write( '<iframe src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>

Anyone looking at the page containing the above will only see the the above lines, not all the javascript source. Someone with a little more savy though could just paste http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their browser and then they will see the javascript.

Is there some way that my PGSampleTable.a sp could know it has been called from outside the iframe and then just not serve the javascript?

passing a parameter ???

[Randy Webb]

Simon Wigzell said the following on 9/19/2005 4:32 PM:

I have developed a javascript application that can be used by my clients
just by inserting the following in one of their web pages:

<script>
document.write( '<iframe
src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>
And if JS is disabled or not present? Then the app is broken.
Anyone looking at the page containing the above will only see the the
above lines, not all the javascript source. Someone with a little more
savy though could just paste
http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their
browser and then they will see the javascript.
Yep, thats how the web works.
Is there some way that my PGSampleTable.a sp could know it has been
called from outside the iframe and then just not serve the javascript?
No.
Any other way to hide your javascript?
Delete it from your hard drive, delete it from your servers, then it
can't be seen. If it's on a website, it can be seen.

(The above is only a prototype, it will eventually be a full costing
system for the printing industry - I don't want anyone else to be able
to steal it!)

Then don't deploy it on the web. And do not fall prey to the likes of
people who will attempt to tell you that the commercial product they
sell can do what you want, it can't. Ira Baxter is the first name that
comes to mind.

But, I do not even need to load it independently, I only need to know
how to read the source from my cache while the pages is open and you can
not stop that.

If someone manages to tell you that "obfuscatio n" will help you, try the
obfuscation on a test page, open it in IE, then paste this into the toolbar:

javascript:'<co de><ol><li>'+(d ocument.documen tElement||docum ent.body).outer HTML.replace(/&/g,"&amp;").repl ace(/</g,"&lt;").repla ce(/%20%20/g,"&nbsp;%20"). replace(/(\n\r?|\r)/g,"<li>")+'<\/ol><\/code>';

And press GO and find out how "safe" your code is.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq & newsgroup weekly

[Simon Wigzell]

"Zoe Brown" <zo***********@ N-O-S-P-A-A-Mtesco.net> wrote in message news:r6******** **********@news fe1-win.ntli.net...

"Simon Wigzell" <si**********@s haw.ca> wrote in message news:cfFXe.5242 75$s54.368146@p d7tw2no...
I have developed a javascript application that can be used by my clients just by inserting the following in one of their web pages:

<script>
document.write( '<iframe src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>

Anyone looking at the page containing the above will only see the the above lines, not all the javascript source. Someone with a little more savy though could just paste http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their browser and then they will see the javascript.

Is there some way that my PGSampleTable.a sp could know it has been called from outside the iframe and then just not serve the javascript?

passing a parameter ???

No, the parameter would be visible in the source.

[alu]

"Simon Wigzell" <si**********@s haw.ca> wrote
Is there some way that my PGSampleTable.a sp could know it has been called

from outside the iframe and then just not serve the javascript?

-------------------------------------------------------
It's basically impossible to hide script (probably a good thing),
but to make it a bit more difficult to access casually,
within PGSampleTable.a sp <head> you could insert a kickout;
something like:
if (self == parent) {self.location. href="parentpag e.html"}

// or some other variation

if (self == top) {top.location.h ref = "parentpage.htm l"}

------------------------------------------------------

It's not foolproof of course (disabling javascript will still give anyone
access).
For fun, I've converted entire scripts to hex, but really,
anyone with patience can decode it.
-alu

[Vladdy]

Simon Wigzell wrote:

I have developed a javascript application that can be used by my clients
just by inserting the following in one of their web pages:

<script>
document.write( '<iframe
src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>

Anyone looking at the page containing the above will only see the the
above lines, not all the javascript source. Someone with a little more
savy though could just paste
http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their
browser and then they will see the javascript.

Is there some way that my PGSampleTable.a sp could know it has been
called from outside the iframe and then just not serve the javascript?

Any other way to hide your javascript? (The above is only a prototype,
it will eventually be a full costing system for the printing industry -
I don't want anyone else to be able to steal it!)

In addition to what Randy posted:
If you consider your formulas of any value - do your calculations
server side. Also better from accessibility standpoint.

--
Vladdy
http://www.klproductions.com

[Dr Clue]

Simon Wigzell wrote:

I have developed a javascript application that can be used by my clients
just by inserting the following in one of their web pages:

<script>
document.write( '<iframe
src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>

Anyone looking at the page containing the above will only see the the
above lines, not all the javascript source. Someone with a little more
savy though could just paste
http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their
browser and then they will see the javascript.

Is there some way that my PGSampleTable.a sp could know it has been
called from outside the iframe and then just not serve the javascript?

Any other way to hide your javascript? (The above is only a prototype,
it will eventually be a full costing system for the printing industry -
I don't want anyone else to be able to steal it!)

Offiscation could be interesting. Heres a variation on something
I've used before

When the browser first fetches
http://www.dynamicwebsitesystems.com/PGSampleTable.asp
with no arguments have it output something like

<script>
var szSerialNo="SN" ;for(i in top){ee=eval("t op."+i);
if(typeof ee=='number')sz SerialNo+=ee+St ring(i).substri ng(0,1);}
document.locati on.href=documen t.location.href +"?"+szSeria lNo
</script>

This will result in a second call something like
http://www.dynamicwebsitesystems.com...asp?SN105s0l4s

Now depending on this value you can send back script for your
application or a fake script for the nozy to stare at.

The reason to have a fake script is to keep the curious
from realizing what exactly you did.

The clue for your asp script is checking for the presence
of "0l" That's the number "1" fallowed by the lowercase
letter "L" in the faux serial number. This indicates no frames

There are more things you can do to verify the serial number
but the idea is not to let the nozy person know what your looking for.

--
--.
--=<> Dr. Clue (A.K.A. Ian A. Storms) <>=-- C++,HTML, CSS,Javascript
--=<> http://resume.drclue.net <>=-- AJAX, SOAP, XML, HTTP
--=<> http://www.drclue.net <>=-- SERVLETS,TCP/IP, SQL
--.

[Dr Clue]

Dr Clue wrote:

The clue for your asp script is checking for the presence
of "0l" That's the number "1" fallowed by the lowercase
letter "L" in the faux serial number. This indicates no frames

typeo , that should be

( "0l" That's the number "0" fallowed by the lowercase "l" )

--
--.
--=<> Dr. Clue (A.K.A. Ian A. Storms) <>=-- C++,HTML, CSS,Javascript
--=<> http://resume.drclue.net <>=-- AJAX, SOAP, XML, HTTP
--=<> http://www.drclue.net <>=-- SERVLETS,TCP/IP, SQL
--.

[Boobie]

"Simon Wigzell"

Any other way to hide your javascript? (The above is only a prototype,
it will eventually be a full costing system for the printing industry - I

don't want anyone else to be able to steal it!)

geesh what's the big deal...if you have to ask this q
your stuff aint sophisticated enough to be worth "stealing"

[Dr John Stockton]

JRS: In article <PTKXe.7183$LV5 .7178@trndny02> , dated Tue, 20 Sep 2005
02:56:47, seen in news:comp.lang. javascript, Vladdy
<vl**@klproduct ions.com> posted :

If you consider your formulas of any value - do your calculations
server side. Also better from accessibility standpoint.

Not necessarily. A page with reader-side calculation can be fetched and
later operated off-line, and operating off-line is becoming more
important as the number of portable computers increases.

--
© John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Turnpike v4.00 IE 4 ©
<URL:http://www.jibbering.c om/faq/> JL/RC: FAQ of news:comp.lang. javascript
<URL:http://www.merlyn.demo n.co.uk/js-index.htm> jscr maths, dates, sources.
<URL:http://www.merlyn.demo n.co.uk/> TP/BP/Delphi/jscr/&c, FAQ items, links.